commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 Author: Linus Torvalds Date: Sun Jan 26 16:23:03 2020 -0800 Linux 5.5 commit 5cf9ad0e6b164a90581a59609dbf5bda3f5a089c Merge: 9dbca1608709 ebe10026210f Author: Linus Torvalds Date: Sun Jan 26 12:23:04 2020 -0800 Merge tag 'io_uring-5.5-2020-01-26' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Fix for two regressions in this cycle, both reported by the postgresql use case. One removes the added restriction on who can submit IO, making it possible for rings shared across forks to do so. The other fixes an issue for the same kind of use case, where one exiting process would cancel all IO" * tag 'io_uring-5.5-2020-01-26' of git://git.kernel.dk/linux-block: io_uring: don't cancel all work on process exit Revert "io_uring: only allow submit from owning task" commit 9dbca16087099b9d9826011cddfdae2a16404336 Merge: 54343d951838 b72053072c0b Author: Linus Torvalds Date: Sun Jan 26 12:12:36 2020 -0800 Merge tag 'block-5.5-2020-01-26' of git://git.kernel.dk/linux-block Pull block fix from Jens Axboe: "Unfortunately this weekend we had a few last minute reports, one was for block. The partition disable for zoned devices was overly restrictive, it can work (and be supported) just fine for host-aware variants. Here's a fix ensuring that's the case so we don't break existing users of that" * tag 'block-5.5-2020-01-26' of git://git.kernel.dk/linux-block: block: allow partitions on host aware zone devices commit 54343d951838ef4e423de7d124616bf66eca92e7 Merge: b1b298914f3a 04060db41178 Author: Linus Torvalds Date: Sun Jan 26 10:39:09 2020 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two last minute fixes, both in drivers. The fnic one is a highly unlikely condition, but the RDMA one is a recently introduced regression that causes a kernel warning to trigger in every RDMA logon, which would be unsightly if it got into the final release" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: RDMA/isert: Fix a recently introduced regression related to logout scsi: fnic: do not queue commands during fwreset commit b1b298914f3ae226e99c98042c1648f740015724 Merge: a45ea48e2bcd d0cb50185ae9 Author: Linus Torvalds Date: Sun Jan 26 10:33:48 2020 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fix from Al Viro: "Fix a use-after-free in do_last() handling of sysctl_protected_... checks. The use-after-free normally doesn't happen there, but race with rename() and it becomes possible" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: do_last(): fetch directory ->i_mode and ->i_uid before it's too late commit ebe10026210f9ea740b9a050ee84a166690fddde Author: Jens Axboe Date: Sun Jan 26 10:17:12 2020 -0700 io_uring: don't cancel all work on process exit If we're sharing the ring across forks, then one process exiting means that we cancel ALL work and prevent future work. This is overly restrictive. As long as we cancel the work associated with the files from the current task, it's safe to let others persist. Normal fd close on exit will still wait (and cancel) pending work. Fixes: fcb323cc53e2 ("io_uring: io_uring: add support for async work inheriting files") Reported-by: Andres Freund Signed-off-by: Jens Axboe commit b72053072c0bbe9f1cdfe2ffa3c201c185da2201 Author: Christoph Hellwig Date: Sun Jan 26 14:05:43 2020 +0100 block: allow partitions on host aware zone devices Host-aware SMR drives can be used with the commands to explicitly manage zone state, but they can also be used as normal disks. In the former case it makes perfect sense to allow partitions on them, in the latter it does not, just like for host managed devices. Add a check to add_partition to allow partitions on host aware devices, but give up any zone management capabilities in that case, which also catches the previously missed case of adding a partition vs just scanning it. Because sd can rescan the attribute at runtime it needs to check if a disk has partitions, for which a new helper is added to genhd.h. Fixes: 5eac3eb30c9a ("block: Remove partition support for zoned block devices") Reported-by: Borislav Petkov Signed-off-by: Christoph Hellwig Tested-by: Damien Le Moal Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit 73e08e711d9c1d79fae01daed4b0e1fee5f8a275 Author: Jens Axboe Date: Sun Jan 26 09:53:12 2020 -0700 Revert "io_uring: only allow submit from owning task" This ends up being too restrictive for tasks that willingly fork and share the ring between forks. Andres reports that this breaks his postgresql work. Since we're close to 5.5 release, revert this change for now. Cc: stable@vger.kernel.org Fixes: 44d282796f81 ("io_uring: only allow submit from owning task") Reported-by: Andres Freund Signed-off-by: Jens Axboe commit a45ea48e2bcd92c1f678b794f488ca0bda9835b8 Author: David Howells Date: Sun Jan 26 01:02:53 2020 +0000 afs: Fix characters allowed into cell names The afs filesystem needs to prohibit certain characters from cell names, such as '/', as these are used to form filenames in procfs, leading to the following warning being generated: WARNING: CPU: 0 PID: 3489 at fs/proc/generic.c:178 Fix afs_alloc_cell() to disallow nonprintable characters, '/', '@' and names that begin with a dot. Remove the check for "@cell" as that is then redundant. This can be tested by running: echo add foo/.bar 1.2.3.4 >/proc/fs/afs/cells Note that we will also need to deal with: - Names ending in ".invalid" shouldn't be passed to the DNS. - Names that contain non-valid domainname chars shouldn't be passed to the DNS. - DNS replies that say "your-dns-needs-immediate-attention." and replies containing A records that say 127.0.53.53 should be considered invalid. [https://www.icann.org/en/system/files/files/name-collision-mitigation-01aug14-en.pdf] but these need to be dealt with by the kafs-client DNS program rather than the kernel. Reported-by: syzbot+b904ba7c947a37b4b291@syzkaller.appspotmail.com Cc: stable@kernel.org Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit d0cb50185ae942b03c4327be322055d622dc79f6 Author: Al Viro Date: Sun Jan 26 09:29:34 2020 -0500 do_last(): fetch directory ->i_mode and ->i_uid before it's too late may_create_in_sticky() call is done when we already have dropped the reference to dir. Fixes: 30aba6656f61e (namei: allow restricted O_CREAT of FIFOs and regular files) Signed-off-by: Al Viro commit 2821e26f3a0a3872184581caac8115bb02641941 Merge: 84809aaf78b5 6849b5eba196 Author: Linus Torvalds Date: Sat Jan 25 14:32:51 2020 -0800 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: - fix ftrace relocation type filtering - relax arch timer version check * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8955/1: virt: Relax arch timer version check during early boot ARM: 8950/1: ftrace/recordmcount: filter relocation types commit 84809aaf78b5b4c2e6478dc6121a1c8fb439a024 Merge: f041eadad750 fa865ba183d6 Author: Linus Torvalds Date: Sat Jan 25 14:19:32 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Off by one in mt76 airtime calculation, from Dan Carpenter. 2) Fix TLV fragment allocation loop condition in iwlwifi, from Luca Coelho. 3) Don't confirm neigh entries when doing ipsec pmtu updates, from Xu Wang. 4) More checks to make sure we only send TSO packets to lan78xx chips that they can actually handle. From James Hughes. 5) Fix ip_tunnel namespace move, from William Dauchy. 6) Fix unintended packet reordering due to cooperation between listification done by GRO and non-GRO paths. From Maxim Mikityanskiy. 7) Add Jakub Kicincki formally as networking co-maintainer. 8) Info leak in airo ioctls, from Michael Ellerman. 9) IFLA_MTU attribute needs validation during rtnl_create_link(), from Eric Dumazet. 10) Use after free during reload in mlxsw, from Ido Schimmel. 11) Dangling pointers are possible in tp->highest_sack, fix from Eric Dumazet. 12) Missing *pos++ in various networking seq_next handlers, from Vasily Averin. 13) CHELSIO_GET_MEM operation neds CAP_NET_ADMIN check, from Michael Ellerman. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (109 commits) firestream: fix memory leaks net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM net: bcmgenet: Use netif_tx_napi_add() for TX NAPI tipc: change maintainer email address net: stmmac: platform: fix probe for ACPI devices net/mlx5e: kTLS, Do not send decrypted-marked SKBs via non-accel path net/mlx5e: kTLS, Remove redundant posts in TX resync flow net/mlx5e: kTLS, Fix corner-case checks in TX resync flow net/mlx5e: Clear VF config when switching modes net/mlx5: DR, use non preemptible call to get the current cpu number net/mlx5: E-Switch, Prevent ingress rate configuration of uplink rep net/mlx5: DR, Enable counter on non-fwd-dest objects net/mlx5: Update the list of the PCI supported devices net/mlx5: Fix lowest FDB pool size net: Fix skb->csum update in inet_proto_csum_replace16(). netfilter: nf_tables: autoload modules from the abort path netfilter: nf_tables: add __nft_chain_type_get() netfilter: nf_tables_offload: fix check the chain offload flag netfilter: conntrack: sctp: use distinct states for new SCTP connections ipv6_route_seq_next should increase position index ... commit f041eadad7504b1364274494548b9716b2ed59ac Merge: a075f23dd4b0 6716cb162deb Author: Linus Torvalds Date: Sat Jan 25 14:08:43 2020 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Olof Johansson: "A couple of fixes have come in that would be good to include in this release: - A fix for amount of memory on Beaglebone Black. Surfaced now since GRUB2 doesn't update memory size in the booted kernel. - A fix to make SPI interfaces work on am43x-epos-evm. - Small Kconfig fix for OPTEE (adds a depend on MMU) to avoid build failures" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1 tee: optee: Fix compilation issue with nommu ARM: dts: am335x-boneblack-common: fix memory size commit fa865ba183d61c1ec8cbcab8573159c3b72b89a4 Author: Wenwen Wang Date: Sat Jan 25 14:33:29 2020 +0000 firestream: fix memory leaks In fs_open(), 'vcc' is allocated through kmalloc() and assigned to 'atm_vcc->dev_data.' In the following execution, if an error occurs, e.g., there is no more free channel, an error code EBUSY or ENOMEM will be returned. However, 'vcc' is not deallocated, leading to memory leaks. Note that, in normal cases where fs_open() returns 0, 'vcc' will be deallocated in fs_close(). But, if fs_open() fails, there is no guarantee that fs_close() will be invoked. To fix this issue, deallocate 'vcc' before the error code is returned. Signed-off-by: Wenwen Wang Signed-off-by: David S. Miller commit 6badad1c1d354db1f7bc216319d81884411d5098 Merge: 722943a54de9 189c9b1e9453 Author: David S. Miller Date: Sat Jan 25 21:40:39 2020 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Missing netlink attribute sanity check for NFTA_OSF_DREG, from Florian Westphal. 2) Use bitmap infrastructure in ipset to fix KASAN slab-out-of-bounds reads, from Jozsef Kadlecsik. 3) Missing initial CLOSED state in new sctp connection through ctnetlink events, from Jiri Wiesner. 4) Missing check for NFT_CHAIN_HW_OFFLOAD in nf_tables offload indirect block infrastructure, from wenxu. 5) Add __nft_chain_type_get() to sanity check family and chain type. 6) Autoload modules from the nf_tables abort path to fix races reported by syzbot. 7) Remove unnecessary skb->csum update on inet_proto_csum_replace16(), from Praveen Chaudhary. ==================== Signed-off-by: David S. Miller commit a075f23dd4b036ebaf918b3af477aa1f249ddfa0 Merge: 93d1a05ea6b2 4cea9037f82a Author: Linus Torvalds Date: Sat Jan 25 10:55:24 2020 -0800 Merge tag 'for-5.5-rc8-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "Here's a last minute fix for a regression introduced in this development cycle. There's a small chance of a silent corruption when device replace and NOCOW data writes happen at the same time in one block group. Metadata or COW data writes are unaffected. The extra fixup patch is there to silence an unnecessary warning" * tag 'for-5.5-rc8-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: dev-replace: remove warning for unknown return codes when finished btrfs: scrub: Require mandatory block group RO for dev-replace commit 93d1a05ea6b29737715769e2c9551cfe8a5fef22 Merge: d5d359b0ac3f 319d5cce728c Author: Linus Torvalds Date: Sat Jan 25 10:46:07 2020 -0800 Merge tag 'pinctrl-v5.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fix from Linus Walleij: "A single fix for the Intel Sunrisepoint pin controller that makes the interrupts work properly on it" * tag 'pinctrl-v5.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: sunrisepoint: Add missing Interrupt Status register offset commit 722943a54de95343c97c2a9ad658253393632f97 Merge: 3546d8f1bbe9 342508c1c754 Author: David S. Miller Date: Sat Jan 25 13:46:00 2020 +0100 Merge tag 'mlx5-fixes-2020-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2020-01-24 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. Merge conflict: once merge with net-next, a contextual conflict will appear in drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c since the code moved in net-next. To resolve, just delete ALL of the conflicting hunk from net. So sorry for the small mess .. For -stable v5.4: ('net/mlx5: Update the list of the PCI supported devices') ('net/mlx5: Fix lowest FDB pool size') ('net/mlx5e: kTLS, Fix corner-case checks in TX resync flow') ('net/mlx5e: kTLS, Do not send decrypted-marked SKBs via non-accel path') ('net/mlx5: Eswitch, Prevent ingress rate configuration of uplink rep') ('net/mlx5e: kTLS, Remove redundant posts in TX resync flow') ('net/mlx5: DR, Enable counter on non-fwd-dest objects') ('net/mlx5: DR, use non preemptible call to get the current cpu number') ==================== Signed-off-by: David S. Miller commit 4cea9037f82a6deed0f2f61e4054b7ae2519ef87 Author: David Sterba Date: Sat Jan 25 12:35:38 2020 +0100 btrfs: dev-replace: remove warning for unknown return codes when finished The fstests btrfs/011 triggered a warning at the end of device replace, [ 1891.998975] BTRFS warning (device vdd): failed setting block group ro: -28 [ 1892.038338] BTRFS error (device vdd): btrfs_scrub_dev(/dev/vdd, 1, /dev/vdb) failed -28 [ 1892.059993] ------------[ cut here ]------------ [ 1892.063032] WARNING: CPU: 2 PID: 2244 at fs/btrfs/dev-replace.c:506 btrfs_dev_replace_start.cold+0xf9/0x140 [btrfs] [ 1892.074346] CPU: 2 PID: 2244 Comm: btrfs Not tainted 5.5.0-rc7-default+ #942 [ 1892.079956] RIP: 0010:btrfs_dev_replace_start.cold+0xf9/0x140 [btrfs] [ 1892.096576] RSP: 0018:ffffbb58c7b3fd10 EFLAGS: 00010286 [ 1892.098311] RAX: 00000000ffffffe4 RBX: 0000000000000001 RCX: 8888888888888889 [ 1892.100342] RDX: 0000000000000001 RSI: ffff9e889645f5d8 RDI: ffffffff92821080 [ 1892.102291] RBP: ffff9e889645c000 R08: 000001b8878fe1f6 R09: 0000000000000000 [ 1892.104239] R10: ffffbb58c7b3fd08 R11: 0000000000000000 R12: ffff9e88a0017000 [ 1892.106434] R13: ffff9e889645f608 R14: ffff9e88794e1000 R15: ffff9e88a07b5200 [ 1892.108642] FS: 00007fcaed3f18c0(0000) GS:ffff9e88bda00000(0000) knlGS:0000000000000000 [ 1892.111558] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1892.113492] CR2: 00007f52509ff420 CR3: 00000000603dd002 CR4: 0000000000160ee0 [ 1892.115814] Call Trace: [ 1892.116896] btrfs_dev_replace_by_ioctl+0x35/0x60 [btrfs] [ 1892.118962] btrfs_ioctl+0x1d62/0x2550 [btrfs] caused by the previous patch ("btrfs: scrub: Require mandatory block group RO for dev-replace"). Hitting ENOSPC is possible and could happen when the block group is set read-only, preventing NOCOW writes to the area that's being accessed by dev-replace. This has happend with scratch devices of size 12G but not with 5G and 20G, so this is depends on timing and other activity on the filesystem. The whole replace operation is restartable, the space state should be examined by the user in any case. The error code is propagated back to the ioctl caller so the kernel warning is causing false alerts. Signed-off-by: David Sterba commit 3546d8f1bbe992488ed91592cf6bf76e7114791a Author: Michael Ellerman Date: Fri Jan 24 20:41:44 2020 +1100 net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM The cxgb3 driver for "Chelsio T3-based gigabit and 10Gb Ethernet adapters" implements a custom ioctl as SIOCCHIOCTL/SIOCDEVPRIVATE in cxgb_extension_ioctl(). One of the subcommands of the ioctl is CHELSIO_GET_MEM, which appears to read memory directly out of the adapter and return it to userspace. It's not entirely clear what the contents of the adapter memory contains, but the assumption is that it shouldn't be accessible to all users. So add a CAP_NET_ADMIN check to the CHELSIO_GET_MEM case. Put it after the is_offload() check, which matches two of the other subcommands in the same function which also check for is_offload() and CAP_NET_ADMIN. Found by Ilja by code inspection, not tested as I don't have the required hardware. Reported-by: Ilja Van Sprundel Signed-off-by: Michael Ellerman Signed-off-by: David S. Miller commit 148965df1a990af98b2c84092c2a2274c7489284 Author: Florian Fainelli Date: Thu Jan 23 09:49:34 2020 -0800 net: bcmgenet: Use netif_tx_napi_add() for TX NAPI Before commit 7587935cfa11 ("net: bcmgenet: move NAPI initialization to ring initialization") moved the code, this used to be netif_tx_napi_add(), but we lost that small semantic change in the process, restore that. Fixes: 7587935cfa11 ("net: bcmgenet: move NAPI initialization to ring initialization") Signed-off-by: Florian Fainelli Acked-by: Doug Berger Signed-off-by: David S. Miller commit 61b1f2aff41141cd39686285c9b290a07e1e3051 Author: Jon Maloy Date: Thu Jan 23 10:09:39 2020 -0500 tipc: change maintainer email address Reflecting new realities. Signed-off-by: Jon Maloy Signed-off-by: David S. Miller commit b9f0b2f634c0765999bec5547bc7a4ac08fda3ff Author: Ajay Gupta Date: Wed Jan 22 17:16:35 2020 -0800 net: stmmac: platform: fix probe for ACPI devices Use generic device API to get phy mode to fix probe failure with ACPI based devices. Signed-off-by: Ajay Gupta Signed-off-by: David S. Miller commit d5d359b0ac3ffc319ca93c46a4cfd87093759ad6 Merge: 6381b442836e 996d5d5f89a5 Author: Linus Torvalds Date: Fri Jan 24 19:27:42 2020 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - add sanity checks to USB endpoints in various dirvers - max77650-onkey was missing an OF table which was preventing module autoloading - a revert and a different fix for F54 handling in Synaptics dirver - a fixup for handling register in pm8xxx vibrator driver * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: pm8xxx-vib - fix handling of separate enable register Input: keyspan-remote - fix control-message timeouts Input: max77650-onkey - add of_match table Input: rmi_f54 - read from FIFO in 32 byte blocks Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers" Input: sur40 - fix interface sanity checks Input: gtco - drop redundant variable reinit Input: gtco - fix extra-descriptor debug message Input: gtco - fix endpoint sanity check Input: aiptek - use descriptors of current altsetting Input: aiptek - fix endpoint sanity check Input: pegasus_notetaker - fix endpoint sanity check Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register Input: evdev - convert kzalloc()/vzalloc() to kvzalloc() commit 6716cb162deb9d474095a57d7a515edc13926ea7 Merge: 088307d21620 b0b039515445 Author: Olof Johansson Date: Fri Jan 24 12:05:32 2020 -0800 Merge tag 'omap-for-fixes-whenever-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Few minor fixes for omaps Looks like we have wrong default memory size for beaglebone black, it has at least 512 MB of RAM and not 256 MB. This causes an issue when booted with GRUB2 that does not seem to pass memory info to the kernel. And for am43x-epos-evm the SPI pin directions need to be configured for SPI to work. * tag 'omap-for-fixes-whenever-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1 ARM: dts: am335x-boneblack-common: fix memory size Link: https://lore.kernel.org/r/pull-1579895109-287828@atomide.com Signed-off-by: Olof Johansson commit 088307d216205227baa4707f07c73d1dcb863c9b Merge: 70db729fe1b3 9e0caab8e0f9 Author: Olof Johansson Date: Fri Jan 24 12:05:07 2020 -0800 Merge tag 'tee-optee-fix2-for-5.5' of https://git.linaro.org:/people/jens.wiklander/linux-tee into arm/fixes Fix OP-TEE compile error with nommu * tag 'tee-optee-fix2-for-5.5' of https://git.linaro.org:/people/jens.wiklander/linux-tee: tee: optee: Fix compilation issue with nommu Link: https://lore.kernel.org/r/20200123101310.GA10320@jax Signed-off-by: Olof Johansson commit 342508c1c7540e281fd36151c175ba5ff954a99f Author: Tariq Toukan Date: Mon Jan 20 13:42:00 2020 +0200 net/mlx5e: kTLS, Do not send decrypted-marked SKBs via non-accel path When TCP out-of-order is identified (unexpected tcp seq mismatch), driver analyzes the packet and decides what handling should it get: 1. go to accelerated path (to be encrypted in HW), 2. go to regular xmit path (send w/o encryption), 3. drop. Packets marked with skb->decrypted by the TLS stack in the TX flow skips SW encryption, and rely on the HW offload. Verify that such packets are never sent un-encrypted on the wire. Add a WARN to catch such bugs, and prefer dropping the packet in these cases. Fixes: 46a3ea98074e ("net/mlx5e: kTLS, Enhance TX resync flow") Signed-off-by: Tariq Toukan Signed-off-by: Boris Pismenny Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed commit 1e92899791358dba94a9db7cc3b6004636b5a2f6 Author: Tariq Toukan Date: Mon Jan 13 14:46:09 2020 +0200 net/mlx5e: kTLS, Remove redundant posts in TX resync flow The call to tx_post_resync_params() is done earlier in the flow, the post of the control WQEs is unnecessarily repeated. Remove it. Fixes: 700ec4974240 ("net/mlx5e: kTLS, Fix missing SQ edge fill") Signed-off-by: Tariq Toukan Signed-off-by: Boris Pismenny Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed commit ffbd9ca94e2ebbfe802d4b28bab5ba19818de853 Author: Tariq Toukan Date: Sun Jan 12 16:22:14 2020 +0200 net/mlx5e: kTLS, Fix corner-case checks in TX resync flow There are the following cases: 1. Packet ends before start marker: bypass offload. 2. Packet starts before start marker and ends after it: drop, not supported, breaks contract with kernel. 3. packet ends before tls record info starts: drop, this packet was already acknowledged and its record info was released. Add the above as comment in code. Mind possible wraparounds of the TCP seq, replace the simple comparison with a call to the TCP before() method. In addition, remove logic that handles negative sync_len values, as it became impossible. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Fixes: 46a3ea98074e ("net/mlx5e: kTLS, Enhance TX resync flow") Signed-off-by: Tariq Toukan Signed-off-by: Boris Pismenny Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed commit 3b83b6c2e024d85b770ddb1e19a513b5d7587f6f Author: Dmytro Linkin Date: Mon Jan 13 13:46:13 2020 +0200 net/mlx5e: Clear VF config when switching modes Currently VF in LEGACY mode are not able to go up. Also in OFFLOADS mode, when switching to it first time, VF can go up independently to his representor, which is not expected. Perform clearing of VF config when switching modes and set link state to AUTO as default value. Also, when switching to OFFLOADS mode set link state to DOWN, which allow VF link state to be controlled by its REP. Fixes: 1ab2068a4c66 ("net/mlx5: Implement vports admin state backup/restore") Fixes: 556b9d16d3f5 ("net/mlx5: Clear VF's configuration on disabling SRIOV") Signed-off-by: Dmytro Linkin Signed-off-by: Roi Dayan Signed-off-by: Saeed Mahameed commit c0702a4bd41829f05638ec2dab70f6bb8d8010ce Author: Erez Shitrit Date: Sun Jan 12 08:57:59 2020 +0200 net/mlx5: DR, use non preemptible call to get the current cpu number Use raw_smp_processor_id instead of smp_processor_id() otherwise we will get the following trace in debug-kernel: BUG: using smp_processor_id() in preemptible [00000000] code: devlink caller is dr_create_cq.constprop.2+0x31d/0x970 [mlx5_core] Call Trace: dump_stack+0x9a/0xf0 debug_smp_processor_id+0x1f3/0x200 dr_create_cq.constprop.2+0x31d/0x970 genl_family_rcv_msg+0x5fd/0x1170 genl_rcv_msg+0xb8/0x160 netlink_rcv_skb+0x11e/0x340 Fixes: 297cccebdc5a ("net/mlx5: DR, Expose an internal API to issue RDMA operations") Signed-off-by: Erez Shitrit Signed-off-by: Saeed Mahameed commit e401a1848be87123a2b2049addbf21138cb47081 Author: Eli Cohen Date: Sun Jan 12 13:43:37 2020 +0200 net/mlx5: E-Switch, Prevent ingress rate configuration of uplink rep Since the implementation relies on limiting the VF transmit rate to simulate ingress rate limiting, and since either uplink representor or ecpf are not associated with a VF, we limit the rate limit configuration for those ports. Fixes: fcb64c0f5640 ("net/mlx5: E-Switch, add ingress rate support") Signed-off-by: Eli Cohen Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit b850a82114df9b0ec1d191dc64eed1f20a772e0f Author: Erez Shitrit Date: Wed Jan 8 14:17:32 2020 +0200 net/mlx5: DR, Enable counter on non-fwd-dest objects The current code handles only counters that attached to dest, we still have the cases where we have counter on non-dest, like over drop etc. Fixes: 6a48faeeca10 ("net/mlx5: Add direct rule fs_cmd implementation") Signed-off-by: Hamdan Igbaria Signed-off-by: Erez Shitrit Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 505a7f5478062c6cd11e22022d9f1bf64cd8eab3 Author: Meir Lichtinger Date: Thu Dec 12 16:09:33 2019 +0200 net/mlx5: Update the list of the PCI supported devices Add the upcoming ConnectX-7 device ID. Fixes: 85327a9c4150 ("net/mlx5: Update the list of the PCI supported devices") Signed-off-by: Meir Lichtinger Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 93b8a7ecb7287cc9b0196f12a25b57c2462d11dc Author: Paul Blakey Date: Tue Dec 31 17:04:15 2019 +0200 net/mlx5: Fix lowest FDB pool size The pool sizes represent the pool sizes in the fw. when we request a pool size from fw, it will return the next possible group. We track how many pools the fw has left and start requesting groups from the big to the small. When we start request 4k group, which doesn't exists in fw, fw wants to allocate the next possible size, 64k, but will fail since its exhausted. The correct smallest pool size in fw is 128 and not 4k. Fixes: e52c28024008 ("net/mlx5: E-Switch, Add chains and priorities") Signed-off-by: Paul Blakey Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 189c9b1e94539b11c80636bc13e9cf47529e7bba Author: Praveen Chaudhary Date: Thu Jan 23 12:33:28 2020 -0800 net: Fix skb->csum update in inet_proto_csum_replace16(). skb->csum is updated incorrectly, when manipulation for NF_NAT_MANIP_SRC\DST is done on IPV6 packet. Fix: There is no need to update skb->csum in inet_proto_csum_replace16(), because update in two fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to update skb->csum, because update in 3 fields a.) IPv4 src/dst address, b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as L4 Header checksum for skb->csum calculation. [ pablo@netfilter.org: a few comestic documentation edits ] Signed-off-by: Praveen Chaudhary Signed-off-by: Zhenggen Xu Signed-off-by: Andy Stracner Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit eb014de4fd418de1a277913cba244e47274fe392 Author: Pablo Neira Ayuso Date: Tue Jan 21 16:48:03 2020 +0100 netfilter: nf_tables: autoload modules from the abort path This patch introduces a list of pending module requests. This new module list is composed of nft_module_request objects that contain the module name and one status field that tells if the module has been already loaded (the 'done' field). In the first pass, from the preparation phase, the netlink command finds that a module is missing on this list. Then, a module request is allocated and added to this list and nft_request_module() returns -EAGAIN. This triggers the abort path with the autoload parameter set on from nfnetlink, request_module() is called and the module request enters the 'done' state. Since the mutex is released when loading modules from the abort phase, the module list is zapped so this is iteration occurs over a local list. Therefore, the request_module() calls happen when object lists are in consistent state (after fulling aborting the transaction) and the commit list is empty. On the second pass, the netlink command will find that it already tried to load the module, so it does not request it again and nft_request_module() returns 0. Then, there is a look up to find the object that the command was missing. If the module was successfully loaded, the command proceeds normally since it finds the missing object in place, otherwise -ENOENT is reported to userspace. This patch also updates nfnetlink to include the reason to enter the abort phase, which is required for this new autoload module rationale. Fixes: ec7470b834fe ("netfilter: nf_tables: store transaction list locally while requesting module") Reported-by: syzbot+29125d208b3dae9a7019@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso commit 826035498ec14b77b62a44f0cb6b94d45530db6f Author: Pablo Neira Ayuso Date: Tue Jan 21 16:07:00 2020 +0100 netfilter: nf_tables: add __nft_chain_type_get() This new helper function validates that unknown family and chain type coming from userspace do not trigger an out-of-bound array access. Bail out in case __nft_chain_type_get() returns NULL from nft_chain_parse_hook(). Fixes: 9370761c56b6 ("netfilter: nf_tables: convert built-in tables/chains to chain types") Reported-by: syzbot+156a04714799b1d480bc@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso commit c83de17dd6308fb74696923e5245de0e3c427206 Author: wenxu Date: Sun Jan 19 13:18:30 2020 +0800 netfilter: nf_tables_offload: fix check the chain offload flag In the nft_indr_block_cb the chain should check the flag with NFT_CHAIN_HW_OFFLOAD. Fixes: 9a32669fecfb ("netfilter: nf_tables_offload: support indr block call") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit 6381b442836ea3c52eae630b10be8c27c7a17af2 Merge: 3c45d7510cf5 8c17bbf6c8f7 Author: Linus Torvalds Date: Fri Jan 24 09:56:59 2020 -0800 Merge tag 'iommu-fixes-v5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: "Two fixes: - Fix NULL-ptr dereference bug in Intel IOMMU driver - Properly save and restore AMD IOMMU performance counter registers when testing if they are writable" * tag 'iommu-fixes-v5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Fix IOMMU perf counter clobbering during init iommu/vt-d: Call __dmar_remove_one_dev_info with valid pointer commit 3c45d7510cf563be2ebc04f6864b70bc69f68cb9 Merge: 274adbff45e3 5d2e5dd5849b Author: Linus Torvalds Date: Fri Jan 24 09:49:20 2020 -0800 Merge tag 'powerpc-5.5-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Some more powerpc fixes for 5.5: - Fix our hash MMU code to avoid having overlapping ids between user and kernel, which isn't as bad as it sounds but led to crashes on some machines. - A fix for the Power9 XIVE interrupt code, which could return the wrong interrupt state in obscure error conditions. - A minor Kconfig fix for the recently added CONFIG_PPC_UV code. Thanks to Aneesh Kumar K.V, Bharata B Rao, Cédric Le Goater, Frederic Barrat" * tag 'powerpc-5.5-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/mm/hash: Fix sharing context ids between kernel & userspace powerpc/xive: Discard ESB load value when interrupt is invalid powerpc: Ultravisor: Fix the dependencies for CONFIG_PPC_UV commit 274adbff45e3c26c65b2e103581d2ab5834b0b7c Merge: ab10ae1c3bef 49412f6636ba Author: Linus Torvalds Date: Fri Jan 24 09:38:04 2020 -0800 Merge tag 'drm-fixes-2020-01-24' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "This one has a core mst fix and two i915 fixes. amdgpu just enables some hw outside experimental. The panfrost fix is a little bigger than I'd like at this stage but it fixes a fairly fundamental problem with global shared buffers in that driver, and since it's confined to that driver and I've taken a look at it, I think it's fine to get into the tree now, so it can get stable propagated as well. core/mst: - Fix SST branch device handling amdgpu: - enable renoir outside experimental i915: - Avoid overflow with huge userptr objects - uAPI fix to correctly handle negative values in engine->uabi_class/instance (cc: stable) panfrost: - Fix mapping of globally visible BO's (Boris)" * tag 'drm-fixes-2020-01-24' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu: remove the experimental flag for renoir drm/panfrost: Add the panfrost_gem_mapping concept drm/i915: Align engine->uabi_class/instance with i915_drm.h drm/i915/userptr: fix size calculation drm/dp_mst: Handle SST-only branch device case commit ab10ae1c3bef56c29bac61e1201c752221b87b41 Author: Christophe Leroy Date: Thu Jan 23 08:34:18 2020 +0000 lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user() The range passed to user_access_begin() by strncpy_from_user() and strnlen_user() starts at 'src' and goes up to the limit of userspace although reads will be limited by the 'count' param. On 32 bits powerpc (book3s/32) access has to be granted for each 256Mbytes segment and the cost increases with the number of segments to unlock. Limit the range with 'count' param. Fixes: 594cc251fdd0 ("make 'user_access_begin()' do 'access_ok()'") Signed-off-by: Christophe Leroy Signed-off-by: Linus Torvalds commit ab658b9fa7a2c467f79eac8b53ea308b8f98113d Author: Jiri Wiesner Date: Sat Jan 18 13:10:50 2020 +0100 netfilter: conntrack: sctp: use distinct states for new SCTP connections The netlink notifications triggered by the INIT and INIT_ACK chunks for a tracked SCTP association do not include protocol information for the corresponding connection - SCTP state and verification tags for the original and reply direction are missing. Since the connection tracking implementation allows user space programs to receive notifications about a connection and then create a new connection based on the values received in a notification, it makes sense that INIT and INIT_ACK notifications should contain the SCTP state and verification tags available at the time when a notification is sent. The missing verification tags cause a newly created netfilter connection to fail to verify the tags of SCTP packets when this connection has been created from the values previously received in an INIT or INIT_ACK notification. A PROTOINFO event is cached in sctp_packet() when the state of a connection changes. The CLOSED and COOKIE_WAIT state will be used for connections that have seen an INIT and INIT_ACK chunk, respectively. The distinct states will cause a connection state change in sctp_packet(). Signed-off-by: Jiri Wiesner Signed-off-by: Pablo Neira Ayuso commit 8c17bbf6c8f70058a66305f2e1982552e6ea7f47 Author: Shuah Khan Date: Thu Jan 23 15:32:14 2020 -0700 iommu/amd: Fix IOMMU perf counter clobbering during init init_iommu_perf_ctr() clobbers the register when it checks write access to IOMMU perf counters and fails to restore when they are writable. Add save and restore to fix it. Signed-off-by: Shuah Khan Fixes: 30861ddc9cca4 ("perf/x86/amd: Add IOMMU Performance Counter resource management") Reviewed-by: Suravee Suthikulpanit Tested-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit bf708cfb2f4811d1948a88c41ab96587e84ad344 Author: Jerry Snitselaar Date: Tue Jan 21 17:34:26 2020 -0700 iommu/vt-d: Call __dmar_remove_one_dev_info with valid pointer It is possible for archdata.iommu to be set to DEFER_DEVICE_DOMAIN_INFO or DUMMY_DEVICE_DOMAIN_INFO so check for those values before calling __dmar_remove_one_dev_info. Without a check it can result in a null pointer dereference. This has been seen while booting a kdump kernel on an HP dl380 gen9. Cc: Joerg Roedel Cc: Lu Baolu Cc: David Woodhouse Cc: stable@vger.kernel.org # 5.3+ Cc: linux-kernel@vger.kernel.org Fixes: ae23bfb68f28 ("iommu/vt-d: Detach domain before using a private one") Signed-off-by: Jerry Snitselaar Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 1bbb97b8ce7ddf3a56645636c905cef706706dd9 Author: Qu Wenruo Date: Fri Jan 24 07:58:20 2020 +0800 btrfs: scrub: Require mandatory block group RO for dev-replace [BUG] For dev-replace test cases with fsstress, like btrfs/06[45] btrfs/071, looped runs can lead to random failure, where scrub finds csum error. The possibility is not high, around 1/20 to 1/100, but it's causing data corruption. The bug is observable after commit b12de52896c0 ("btrfs: scrub: Don't check free space before marking a block group RO") [CAUSE] Dev-replace has two source of writes: - Write duplication All writes to source device will also be duplicated to target device. Content: Not yet persisted data/meta - Scrub copy Dev-replace reused scrub code to iterate through existing extents, and copy the verified data to target device. Content: Previously persisted data and metadata The difference in contents makes the following race possible: Regular Writer | Dev-replace ----------------------------------------------------------------- ^ | | Preallocate one data extent | | at bytenr X, len 1M | v | ^ Commit transaction | | Now extent [X, X+1M) is in | v commit root | ================== Dev replace starts ========================= | ^ | | Scrub extent [X, X+1M) | | Read [X, X+1M) | | (The content are mostly garbage | | since it's preallocated) ^ | v | Write back happens for | | extent [X, X+512K) | | New data writes to both | | source and target dev. | v | | ^ | | Scrub writes back extent [X, X+1M) | | to target device. | | This will over write the new data in | | [X, X+512K) | v This race can only happen for nocow writes. Thus metadata and data cow writes are safe, as COW will never overwrite extents of previous transaction (in commit root). This behavior can be confirmed by disabling all fallocate related calls in fsstress (*), then all related tests can pass a 2000 run loop. *: FSSTRESS_AVOID="-f fallocate=0 -f allocsp=0 -f zero=0 -f insert=0 \ -f collapse=0 -f punch=0 -f resvsp=0" I didn't expect resvsp ioctl will fallback to fallocate in VFS... [FIX] Make dev-replace to require mandatory block group RO, and wait for current nocow writes before calling scrub_chunk(). This patch will mostly revert commit 76a8efa171bf ("btrfs: Continue replace when set_block_ro failed") for dev-replace path. The side effect is, dev-replace can be more strict on avaialble space, but definitely worth to avoid data corruption. Reported-by: Filipe Manana Fixes: 76a8efa171bf ("btrfs: Continue replace when set_block_ro failed") Fixes: b12de52896c0 ("btrfs: scrub: Don't check free space before marking a block group RO") Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 623c8d5c74c69a41573da5a38bb59e8652113f56 Merge: 2bec445f9bf3 4fc427e05158 Author: David S. Miller Date: Fri Jan 24 11:42:18 2020 +0100 Merge branch 'netdev-seq_file-next-functions-should-increase-position-index' Vasily Averin says: ==================== netdev: seq_file .next functions should increase position index In Aug 2018 NeilBrown noticed commit 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code and interface") "Some ->next functions do not increment *pos when they return NULL... Note that such ->next functions are buggy and should be fixed. A simple demonstration is dd if=/proc/swaps bs=1000 skip=1 Choose any block size larger than the size of /proc/swaps. This will always show the whole last line of /proc/swaps" Described problem is still actual. If you make lseek into middle of last output line following read will output end of last line and whole last line once again. $ dd if=/proc/swaps bs=1 # usual output Filename Type Size Used Priority /dev/dm-0 partition 4194812 97536 -2 104+0 records in 104+0 records out 104 bytes copied $ dd if=/proc/swaps bs=40 skip=1 # last line was generated twice dd: /proc/swaps: cannot skip to specified offset v/dm-0 partition 4194812 97536 -2 /dev/dm-0 partition 4194812 97536 -2 3+1 records in 3+1 records out 131 bytes copied There are lot of other affected files, I've found 30+ including /proc/net/ip_tables_matches and /proc/sysvipc/* This patch-set fixes files related to netdev@ https://bugzilla.kernel.org/show_bug.cgi?id=206283 ==================== Signed-off-by: David S. Miller commit 4fc427e0515811250647d44de38d87d7b0e0790f Author: Vasily Averin Date: Thu Jan 23 10:12:06 2020 +0300 ipv6_route_seq_next should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: David S. Miller commit a3ea86739f1bc7e121d921842f0f4a8ab1af94d9 Author: Vasily Averin Date: Thu Jan 23 10:11:35 2020 +0300 rt_cpu_seq_next should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: David S. Miller commit 1e3f9f073c47bee7c23e77316b07bc12338c5bba Author: Vasily Averin Date: Thu Jan 23 10:11:28 2020 +0300 neigh_stat_seq_next() should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: David S. Miller commit 8bf7092021f283944f0c5f4c364853201c45c611 Author: Vasily Averin Date: Thu Jan 23 10:11:20 2020 +0300 vcc_seq_next should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: David S. Miller commit 66018a102f7756cf72db4d2704e1b93969d9d332 Author: Vasily Averin Date: Thu Jan 23 10:11:13 2020 +0300 l2t_seq_next should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: David S. Miller commit 70a87287c821e9721b62463777f55ba588ac4623 Author: Vasily Averin Date: Thu Jan 23 10:11:08 2020 +0300 seq_tab_next() should increase position index if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: David S. Miller commit 2bec445f9bf35e52e395b971df48d3e1e5dc704a Author: Eric Dumazet Date: Wed Jan 22 21:03:00 2020 -0800 tcp: do not leave dangling pointers in tp->highest_sack Latest commit 853697504de0 ("tcp: Fix highest_sack and highest_sack_seq") apparently allowed syzbot to trigger various crashes in TCP stack [1] I believe this commit only made things easier for syzbot to find its way into triggering use-after-frees. But really the bugs could lead to bad TCP behavior or even plain crashes even for non malicious peers. I have audited all calls to tcp_rtx_queue_unlink() and tcp_rtx_queue_unlink_and_free() and made sure tp->highest_sack would be updated if we are removing from rtx queue the skb that tp->highest_sack points to. These updates were missing in three locations : 1) tcp_clean_rtx_queue() [This one seems quite serious, I have no idea why this was not caught earlier] 2) tcp_rtx_queue_purge() [Probably not a big deal for normal operations] 3) tcp_send_synack() [Probably not a big deal for normal operations] [1] BUG: KASAN: use-after-free in tcp_highest_sack_seq include/net/tcp.h:1864 [inline] BUG: KASAN: use-after-free in tcp_highest_sack_seq include/net/tcp.h:1856 [inline] BUG: KASAN: use-after-free in tcp_check_sack_reordering+0x33c/0x3a0 net/ipv4/tcp_input.c:891 Read of size 4 at addr ffff8880a488d068 by task ksoftirqd/1/16 CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:639 __asan_report_load4_noabort+0x14/0x20 mm/kasan/generic_report.c:134 tcp_highest_sack_seq include/net/tcp.h:1864 [inline] tcp_highest_sack_seq include/net/tcp.h:1856 [inline] tcp_check_sack_reordering+0x33c/0x3a0 net/ipv4/tcp_input.c:891 tcp_try_undo_partial net/ipv4/tcp_input.c:2730 [inline] tcp_fastretrans_alert+0xf74/0x23f0 net/ipv4/tcp_input.c:2847 tcp_ack+0x2577/0x5bf0 net/ipv4/tcp_input.c:3710 tcp_rcv_established+0x6dd/0x1e90 net/ipv4/tcp_input.c:5706 tcp_v4_do_rcv+0x619/0x8d0 net/ipv4/tcp_ipv4.c:1619 tcp_v4_rcv+0x307f/0x3b40 net/ipv4/tcp_ipv4.c:2001 ip_protocol_deliver_rcu+0x5a/0x880 net/ipv4/ip_input.c:204 ip_local_deliver_finish+0x23b/0x380 net/ipv4/ip_input.c:231 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_local_deliver+0x1e9/0x520 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:442 [inline] ip_rcv_finish+0x1db/0x2f0 net/ipv4/ip_input.c:428 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_rcv+0xe8/0x3f0 net/ipv4/ip_input.c:538 __netif_receive_skb_one_core+0x113/0x1a0 net/core/dev.c:5148 __netif_receive_skb+0x2c/0x1d0 net/core/dev.c:5262 process_backlog+0x206/0x750 net/core/dev.c:6093 napi_poll net/core/dev.c:6530 [inline] net_rx_action+0x508/0x1120 net/core/dev.c:6598 __do_softirq+0x262/0x98c kernel/softirq.c:292 run_ksoftirqd kernel/softirq.c:603 [inline] run_ksoftirqd+0x8e/0x110 kernel/softirq.c:595 smpboot_thread_fn+0x6a3/0xa40 kernel/smpboot.c:165 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 10091: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:521 slab_post_alloc_hook mm/slab.h:584 [inline] slab_alloc_node mm/slab.c:3263 [inline] kmem_cache_alloc_node+0x138/0x740 mm/slab.c:3575 __alloc_skb+0xd5/0x5e0 net/core/skbuff.c:198 alloc_skb_fclone include/linux/skbuff.h:1099 [inline] sk_stream_alloc_skb net/ipv4/tcp.c:875 [inline] sk_stream_alloc_skb+0x113/0xc90 net/ipv4/tcp.c:852 tcp_sendmsg_locked+0xcf9/0x3470 net/ipv4/tcp.c:1282 tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1432 inet_sendmsg+0x9e/0xe0 net/ipv4/af_inet.c:807 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 __sys_sendto+0x262/0x380 net/socket.c:1998 __do_sys_sendto net/socket.c:2010 [inline] __se_sys_sendto net/socket.c:2006 [inline] __x64_sys_sendto+0xe1/0x1a0 net/socket.c:2006 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 10095: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:335 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:474 kasan_slab_free+0xe/0x10 mm/kasan/common.c:483 __cache_free mm/slab.c:3426 [inline] kmem_cache_free+0x86/0x320 mm/slab.c:3694 kfree_skbmem+0x178/0x1c0 net/core/skbuff.c:645 __kfree_skb+0x1e/0x30 net/core/skbuff.c:681 sk_eat_skb include/net/sock.h:2453 [inline] tcp_recvmsg+0x1252/0x2930 net/ipv4/tcp.c:2166 inet_recvmsg+0x136/0x610 net/ipv4/af_inet.c:838 sock_recvmsg_nosec net/socket.c:886 [inline] sock_recvmsg net/socket.c:904 [inline] sock_recvmsg+0xce/0x110 net/socket.c:900 __sys_recvfrom+0x1ff/0x350 net/socket.c:2055 __do_sys_recvfrom net/socket.c:2073 [inline] __se_sys_recvfrom net/socket.c:2069 [inline] __x64_sys_recvfrom+0xe1/0x1a0 net/socket.c:2069 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880a488d040 which belongs to the cache skbuff_fclone_cache of size 456 The buggy address is located 40 bytes inside of 456-byte region [ffff8880a488d040, ffff8880a488d208) The buggy address belongs to the page: page:ffffea0002922340 refcount:1 mapcount:0 mapping:ffff88821b057000 index:0x0 raw: 00fffe0000000200 ffffea00022a5788 ffffea0002624a48 ffff88821b057000 raw: 0000000000000000 ffff8880a488d040 0000000100000006 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a488cf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a488cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880a488d000: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8880a488d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a488d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 853697504de0 ("tcp: Fix highest_sack and highest_sack_seq") Fixes: 50895b9de1d3 ("tcp: highest_sack fix") Fixes: 737ff314563c ("tcp: use sequence distance to detect reordering") Signed-off-by: Eric Dumazet Cc: Cambda Zhu Cc: Yuchung Cheng Cc: Neal Cardwell Acked-by: Neal Cardwell Acked-by: Yuchung Cheng Signed-off-by: David S. Miller commit 4d299f183314aa79131abdfa2c528f8807010ea8 Author: Colin Ian King Date: Thu Jan 23 09:27:30 2020 +0000 net/rose: fix spelling mistake "to" -> "too" There is a spelling mistake in a printk message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 43d88774d138496c88920e2bb012f5fd098ee6ad Author: Colin Ian King Date: Thu Jan 23 00:45:55 2020 +0000 caif_usb: fix spelling mistake "to" -> "too" There is a spelling mistake in a pr_warn message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 971485a0d681954677ec6a7ed990359aceabc06e Author: Colin Ian King Date: Thu Jan 23 00:43:28 2020 +0000 ipvs: fix spelling mistake "to" -> "too" There is a spelling mistake in a IP_VS_ERR_RL message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 959b1825d9ab5081f7446ed3f4329384c7818af7 Author: Colin Ian King Date: Thu Jan 23 00:14:29 2020 +0000 i40e: fix spelling mistake "to" -> "too" There is a spelling mistake in a hw_dbg message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 838a860a390547dc6f8bc9d0a77d4ebad1dc8ff1 Merge: 4703d9119972 2a187d033520 Author: Linus Torvalds Date: Thu Jan 23 16:02:00 2020 -0800 Merge tag 'mmc-v5.5-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "A couple of MMC host fixes: - sdhci: Fix minimum clock rate for v3 controllers - sdhci-tegra: Fix SDR50 tuning override - sdhci_am654: Fixup tuning issues and support for CQHCI - sdhci_am654: Remove wrong write protect flag" * tag 'mmc-v5.5-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci: fix minimum clock rate for v3 controller mmc: tegra: fix SDR50 tuning override mmc: sdhci_am654: Fix Command Queuing in AM65x mmc: sdhci_am654: Reset Command and Data line after tuning mmc: sdhci_am654: Remove Inverted Write Protect flag commit 49412f6636bab17dbdc25e36d6482013e4188c88 Merge: b52937145d6f 23fe1390c7f1 Author: Dave Airlie Date: Fri Jan 24 08:58:12 2020 +1000 Merge tag 'amd-drm-fixes-5.5-2020-01-23' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.5-2020-01-23: amdgpu: - remove the experimental flag from renoir Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200123191424.3849-1-alexander.deucher@amd.com commit b52937145d6f7cad4957c8df43e89497b6329420 Merge: a48d4a33b6ef 5eec71829ad7 Author: Dave Airlie Date: Fri Jan 24 08:57:37 2020 +1000 Merge tag 'drm-intel-fixes-2020-01-23' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Avoid overflow with huge userptr objects - uAPI fix to correctly handle negative values in engine->uabi_class/instance (cc: stable) Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20200123135045.GA12584@jlahtine-desk.ger.corp.intel.com commit 61678d28d4a45ef376f5d02a839cc37509ae9281 Author: Cong Wang Date: Wed Jan 22 15:42:02 2020 -0800 net_sched: fix datalen for ematch syzbot reported an out-of-bound access in em_nbyte. As initially analyzed by Eric, this is because em_nbyte sets its own em->datalen in em_nbyte_change() other than the one specified by user, but this value gets overwritten later by its caller tcf_em_validate(). We should leave em->datalen untouched to respect their choices. I audit all the in-tree ematch users, all of those implement ->change() set em->datalen, so we can just avoid setting it twice in this case. Reported-and-tested-by: syzbot+5af9a90dad568aa9f611@syzkaller.appspotmail.com Reported-by: syzbot+2f07903a5b05e7f36410@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: Eric Dumazet Signed-off-by: Cong Wang Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 42c9bdae2366072aa7c4d680c429fcdec22b44f2 Merge: 457bfc0a4bf5 686f85d71d09 Author: David S. Miller Date: Thu Jan 23 21:24:37 2020 +0100 Merge branch 'Fixes-for-SONIC-ethernet-driver' Finn Thain says: ==================== Fixes for SONIC ethernet driver Various SONIC driver problems have become apparent over the years, including tx watchdog timeouts, lost packets and duplicated packets. The problems are mostly caused by bugs in buffer handling, locking and (re-)initialization code. This patch series resolves these problems. This series has been tested on National Semiconductor hardware (macsonic), qemu-system-m68k (macsonic) and qemu-system-mips64el (jazzsonic). The emulated dp8393x device used in QEMU also has bugs. I have fixed the bugs that I know of in a series of patches at, https://github.com/fthain/qemu/commits/sonic Changed since v1: - Minor revisions as described in commit logs. - Deferred net-next patches. Changed since v2: - Minor revisions as described in commit logs. ==================== Signed-off-by: David S. Miller commit 686f85d71d095f1d26b807e23b0f0bfd22042c45 Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Prevent tx watchdog timeout Section 5.5.3.2 of the datasheet says, If FIFO Underrun, Byte Count Mismatch, Excessive Collision, or Excessive Deferral (if enabled) errors occur, transmission ceases. In this situation, the chip asserts a TXER interrupt rather than TXDN. But the handler for the TXDN is the only way that the transmit queue gets restarted. Hence, an aborted transmission can result in a watchdog timeout. This problem can be reproduced on congested link, as that can result in excessive transmitter collisions. Another way to reproduce this is with a FIFO Underrun, which may be caused by DMA latency. In event of a TXER interrupt, prevent a watchdog timeout by restarting transmission. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 772f66421d5aa0b9f256056f513bbc38ac132271 Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Fix CAM initialization Section 4.3.1 of the datasheet says, This bit [TXP] must not be set if a Load CAM operation is in progress (LCAM is set). The SONIC will lock up if both bits are set simultaneously. Testing has shown that the driver sometimes attempts to set LCAM while TXP is set. Avoid this by waiting for command completion before and after giving the LCAM command. After issuing the Load CAM command, poll for !SONIC_CR_LCAM rather than SONIC_INT_LCD, because the SONIC_CR_TXP bit can't be used until !SONIC_CR_LCAM. When in reset mode, take the opportunity to reset the CAM Enable register. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 27e0c31c5f27c1d1a1d9d135c123069f60dcf97b Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Fix command register usage There are several issues relating to command register usage during chip initialization. Firstly, the SONIC sometimes comes out of software reset with the Start Timer bit set. This gets logged as, macsonic macsonic eth0: sonic_init: status=24, i=101 Avoid this by giving the Stop Timer command earlier than later. Secondly, the loop that waits for the Read RRA command to complete has the break condition inverted. That's why the for loop iterates until its termination condition. Call the helper for this instead. Finally, give the Receiver Enable command after clearing interrupts, not before, to avoid the possibility of losing an interrupt. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 3f4b7e6a2be982fd8820a2b54d46dd9c351db899 Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Quiesce SONIC before re-initializing descriptor memory Make sure the SONIC's DMA engine is idle before altering the transmit and receive descriptors. Add a helper for this as it will be needed again. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 89ba879e95582d3bba55081e45b5409e883312ca Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Fix receive buffer replenishment As soon as the driver is finished with a receive buffer it allocs a new one and overwrites the corresponding RRA entry with a new buffer pointer. Problem is, the buffer pointer is split across two word-sized registers. It can't be updated in one atomic store. So this operation races with the chip while it stores received packets and advances its RRP register. This could result in memory corruption by a DMA write. Avoid this problem by adding buffers only at the location given by the RWP register, in accordance with the National Semiconductor datasheet. Re-factor this code into separate functions to calculate a RRA pointer and to update the RWP. Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 94b166349503957079ef5e7d6f667f157aea014a Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Improve receive descriptor status flag check After sonic_tx_timeout() calls sonic_init(), it can happen that sonic_rx() will subsequently encounter a receive descriptor with no flags set. Remove the comment that says that this can't happen. When giving a receive descriptor to the SONIC, clear the descriptor status field. That way, any rx descriptor with flags set can only be a newly received packet. Don't process a descriptor without the LPKT bit set. The buffer is still in use by the SONIC. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit eaabfd19b2c787bbe88dc32424b9a43d67293422 Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Avoid needless receive descriptor EOL flag updates The while loop in sonic_rx() traverses the rx descriptor ring. It stops when it reaches a descriptor that the SONIC has not used. Each iteration advances the EOL flag so the SONIC can keep using more descriptors. Therefore, the while loop has no definite termination condition. The algorithm described in the National Semiconductor literature is quite different. It consumes descriptors up to the one with its EOL flag set (which will also have its "in use" flag set). All freed descriptors are then returned to the ring at once, by adjusting the EOL flags (and link pointers). Adopt the algorithm from datasheet as it's simpler, terminates quickly and avoids a lot of pointless descriptor EOL flag changes. Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 9e311820f67e740f4fb8dcb82b4c4b5b05bdd1a5 Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Fix receive buffer handling The SONIC can sometimes advance its rx buffer pointer (RRP register) without advancing its rx descriptor pointer (CRDA register). As a result the index of the current rx descriptor may not equal that of the current rx buffer. The driver mistakenly assumes that they are always equal. This assumption leads to incorrect packet lengths and possible packet duplication. Avoid this by calling a new function to locate the buffer corresponding to a given descriptor. Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 427db97df1ee721c20bdc9a66db8a9e1da719855 Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Fix interface error stats collection The tx_aborted_errors statistic should count packets flagged with EXD, EXC, FU, or BCM bits because those bits denote an aborted transmission. That corresponds to the bitmask 0x0446, not 0x0642. Use macros for these constants to avoid mistakes. Better to leave out FIFO Underruns (FU) as there's a separate counter for that purpose. Don't lump all these errors in with the general tx_errors counter as that's used for tx timeout events. On the rx side, don't count RDE and RBAE interrupts as dropped packets. These interrupts don't indicate a lost packet, just a lack of resources. When a lack of resources results in a lost packet, this gets reported in the rx_missed_errors counter (along with RFO events). Don't double-count rx_frame_errors and rx_crc_errors. Don't use the general rx_errors counter for events that already have special counters. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit e3885f576196ddfc670b3d53e745de96ffcb49ab Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Use MMIO accessors The driver accesses descriptor memory which is simultaneously accessed by the chip, so the compiler must not be allowed to re-order CPU accesses. sonic_buf_get() used 'volatile' to prevent that. sonic_buf_put() should have done so too but was overlooked. Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 5fedabf5a70be26b19d7520f09f12a62274317c6 Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Clear interrupt flags immediately The chip can change a packet's descriptor status flags at any time. However, an active interrupt flag gets cleared rather late. This allows a race condition that could theoretically lose an interrupt. Fix this by clearing asserted interrupt flags immediately. Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 865ad2f2201dc18685ba2686f13217f8b3a9c52c Author: Finn Thain Date: Thu Jan 23 09:07:26 2020 +1100 net/sonic: Add mutual exclusion for accessing shared state The netif_stop_queue() call in sonic_send_packet() races with the netif_wake_queue() call in sonic_interrupt(). This causes issues like "NETDEV WATCHDOG: eth0 (macsonic): transmit queue 0 timed out". Fix this by disabling interrupts when accessing tx_skb[] and next_tx. Update a comment to clarify the synchronization properties. Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 457bfc0a4bf531487ecc3cf82ec728a5e114fb1e Author: Madalin Bucur Date: Wed Jan 22 16:15:14 2020 +0200 net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G As the only 10G PHY interface type defined at the moment the code was developed was XGMII, although the PHY interface mode used was not XGMII, XGMII was used in the code to denote 10G. This patch renames the 10G interface mode to remove the ambiguity. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 72b5917413e19529dd9495852fc10892f749c4ef Merge: 22e984493a41 1d3ca681b9d9 Author: David S. Miller Date: Thu Jan 23 21:17:13 2020 +0100 Merge branch 'net-fsl-fman-address-erratum-A011043' Madalin Bucur says: ==================== net: fsl/fman: address erratum A011043 This addresses a HW erratum on some QorIQ DPAA devices. MDIO reads to internal PCS registers may result in having the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no error and read data (MDIO_DATA[MDIO_DATA]) is correct. Software may get false read error when reading internal PCS registers through MDIO. As a workaround, all internal MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit. When the issue was present, one could see such errors during boot: mdio_bus ffe4e5000: Error while reading PHY0 reg at 3.3 ==================== Signed-off-by: David S. Miller commit 1d3ca681b9d9575ccf696ebc2840a1ebb1fd4074 Author: Madalin Bucur Date: Wed Jan 22 15:20:29 2020 +0200 net/fsl: treat fsl,erratum-a011043 When fsl,erratum-a011043 is set, adjust for erratum A011043: MDIO reads to internal PCS registers may result in having the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no error and read data (MDIO_DATA[MDIO_DATA]) is correct. Software may get false read error when reading internal PCS registers through MDIO. As a workaround, all internal MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 73d527aef68f7644e59f22ce7f9ac75e7b533aea Author: Madalin Bucur Date: Wed Jan 22 15:20:28 2020 +0200 powerpc/fsl/dts: add fsl,erratum-a011043 Add fsl,erratum-a011043 to internal MDIO buses. Software may get false read error when reading internal PCS registers through MDIO. As a workaround, all internal MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 2934d2c67838ba442fbd0b0560ba641044a5ceba Author: Madalin Bucur Date: Wed Jan 22 15:20:27 2020 +0200 dt-bindings: net: add fsl,erratum-a011043 Add an entry for erratum A011043: the MDIO_CFG[MDIO_RD_ER] bit may be falsely set when reading internal PCS registers. MDIO reads to internal PCS registers may result in having the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no error and read data (MDIO_DATA[MDIO_DATA]) is correct. Software may get false read error when reading internal PCS registers through MDIO. As a workaround, all internal MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 22e984493a41bf8081f13d9ed84def3ca8cfd427 Author: Manish Chopra Date: Wed Jan 22 01:43:38 2020 -0800 qlcnic: Fix CPU soft lockup while collecting firmware dump Driver while collecting firmware dump takes longer time to collect/process some of the firmware dump entries/memories. Bigger capture masks makes it worse as it results in larger amount of data being collected and results in CPU soft lockup. Place cond_resched() in some of the driver flows that are expectedly time consuming to relinquish the CPU to avoid CPU soft lockup panic. Signed-off-by: Shahed Shaikh Tested-by: Yonggen Xu Signed-off-by: Manish Chopra Signed-off-by: David S. Miller commit 4703d9119972bf586d2cca76ec6438f819ffa30e Merge: 34597c85be98 00ed452c210a Author: Linus Torvalds Date: Thu Jan 23 11:37:19 2020 -0800 Merge tag 'xarray-5.5' of git://git.infradead.org/users/willy/linux-dax Pull XArray fixes from Matthew Wilcox: "Primarily bugfixes, mostly around handling index wrap-around correctly. A couple of doc fixes and adding missing APIs. I had an oops live on stage at linux.conf.au this year, and it turned out to be a bug in xas_find() which I can't prove isn't triggerable in the current codebase. Then in looking for the bug, I spotted two more bugs. The bots have had a few days to chew on this with no problems reported, and it passes the test-suite (which now has more tests to make sure these problems don't come back)" * tag 'xarray-5.5' of git://git.infradead.org/users/willy/linux-dax: XArray: Add xa_for_each_range XArray: Fix xas_find returning too many entries XArray: Fix xa_find_after with multi-index entries XArray: Fix infinite loop with entry at ULONG_MAX XArray: Add wrappers for nested spinlocks XArray: Improve documentation of search marks XArray: Fix xas_pause at ULONG_MAX commit 34597c85be987cc731a840fa0c9bb969c92bd986 Merge: fa0a4e3b5412 b61387cb732c Author: Linus Torvalds Date: Thu Jan 23 11:23:37 2020 -0800 Merge tag 'trace-v5.5-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Various tracing fixes: - Fix a function comparison warning for a xen trace event macro - Fix a double perf_event linking to a trace_uprobe_filter for multiple events - Fix suspicious RCU warnings in trace event code for using list_for_each_entry_rcu() when the "_rcu" portion wasn't needed. - Fix a bug in the histogram code when using the same variable - Fix a NULL pointer dereference when tracefs lockdown enabled and calling trace_set_default_clock() - A fix to a bug found with the double perf_event linking patch" * tag 'trace-v5.5-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/uprobe: Fix to make trace_uprobe_filter alignment safe tracing: Do not set trace clock if tracefs lockdown is in effect tracing: Fix histogram code when expression has same var as value tracing: trigger: Replace unneeded RCU-list traversals tracing/uprobe: Fix double perf_event linking on multiprobe uprobe tracing: xen: Ordered comparison of function pointers commit fa0a4e3b541257da515def87b84529b3bfd08119 Merge: 3a83c8c81c91 9c1c2b35f1d9 Author: Linus Torvalds Date: Thu Jan 23 11:21:35 2020 -0800 Merge tag 'ceph-for-5.5-rc8' of https://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A fix for a potential use-after-free from Jeff, marked for stable" * tag 'ceph-for-5.5-rc8' of https://github.com/ceph/ceph-client: ceph: hold extra reference to r_parent over life of request commit 3a83c8c81c91fe10e7002c2c0e74b23e80f41f28 Merge: a572582b1a4d 18451f9f9e58 Author: Linus Torvalds Date: Thu Jan 23 11:10:21 2020 -0800 Merge tag 'pm-5.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Prevent the kernel from crashing during resume from hibernation if free pages contain leftover data from the restore kernel and init_on_free is set (Alexander Potapenko)" * tag 'pm-5.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: hibernate: fix crashes with init_on_free=1 commit a572582b1a4d6c8418739abfdfa5d1796d148d35 Merge: 3c2659bd1db8 5e89cd303e3a Author: Linus Torvalds Date: Thu Jan 23 11:08:15 2020 -0800 Merge tag 'pci-v5.5-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fix from Bjorn Helgaas: "Mark ATS as broken on AMD Navi14 GPU rev 0xc5 (Alex Deucher)" * tag 'pci-v5.5-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken commit 3c2659bd1db81ed6a264a9fc6262d51667d655ad Author: Linus Torvalds Date: Wed Jan 22 12:37:25 2020 -0800 readdir: make user_access_begin() use the real access range In commit 9f79b78ef744 ("Convert filldir[64]() from __put_user() to unsafe_put_user()") I changed filldir to not do individual __put_user() accesses, but instead use unsafe_put_user() surrounded by the proper user_access_begin/end() pair. That make them enormously faster on modern x86, where the STAC/CLAC games make individual user accesses fairly heavy-weight. However, the user_access_begin() range was not really the exact right one, since filldir() has the unfortunate problem that it needs to not only fill out the new directory entry, it also needs to fix up the previous one to contain the proper file offset. It's unfortunate, but the "d_off" field in "struct dirent" is _not_ the file offset of the directory entry itself - it's the offset of the next one. So we end up backfilling the offset in the previous entry as we walk along. But since x86 didn't really care about the exact range, and used to be the only architecture that did anything fancy in user_access_begin() to begin with, the filldir[64]() changes did something lazy, and even commented on it: /* * Note! This range-checks 'previous' (which may be NULL). * The real range was checked in getdents */ if (!user_access_begin(dirent, sizeof(*dirent))) goto efault; and it all worked fine. But now 32-bit ppc is starting to also implement user_access_begin(), and the fact that we faked the range to only be the (possibly not even valid) previous directory entry becomes a problem, because ppc32 will actually be using the range that is passed in for more than just "check that it's user space". This is a complete rewrite of Christophe's original patch. By saving off the record length of the previous entry instead of a pointer to it in the filldir data structures, we can simplify the range check and the writing of the previous entry d_off field. No need for any conditionals in the user accesses themselves, although we retain the conditional EINTR checking for the "was this the first directory entry" signal handling latency logic. Fixes: 9f79b78ef744 ("Convert filldir[64]() from __put_user() to unsafe_put_user()") Link: https://lore.kernel.org/lkml/a02d3426f93f7eb04960a4d9140902d278cab0bb.1579697910.git.christophe.leroy@c-s.fr/ Link: https://lore.kernel.org/lkml/408c90c4068b00ea8f1c41cca45b84ec23d4946b.1579783936.git.christophe.leroy@c-s.fr/ Reported-and-tested-by: Christophe Leroy Signed-off-by: Linus Torvalds commit 2c6b7bcd747201441923a0d3062577a8d1fbd8f8 Author: Linus Torvalds Date: Thu Jan 23 10:05:05 2020 -0800 readdir: be more conservative with directory entry names Commit 8a23eb804ca4 ("Make filldir[64]() verify the directory entry filename is valid") added some minimal validity checks on the directory entries passed to filldir[64](). But they really were pretty minimal. This fleshes out at least the name length check: we used to disallow zero-length names, but really, negative lengths or oevr-long names aren't ok either. Both could happen if there is some filesystem corruption going on. Now, most filesystems tend to use just an "unsigned char" or similar for the length of a directory entry name, so even with a corrupt filesystem you should never see anything odd like that. But since we then use the name length to create the directory entry record length, let's make sure it actually is half-way sensible. Note how POSIX states that the size of a path component is limited by NAME_MAX, but we actually use PATH_MAX for the check here. That's because while NAME_MAX is generally the correct maximum name length (it's 255, for the same old "name length is usually just a byte on disk"), there's nothing in the VFS layer that really cares. So the real limitation at a VFS layer is the total pathname length you can pass as a filename: PATH_MAX. Signed-off-by: Linus Torvalds commit 23fe1390c7f13af417069fc0787f7cc82839a6bd Author: Alex Deucher Date: Wed Jan 22 11:17:24 2020 -0500 drm/amdgpu: remove the experimental flag for renoir Should work properly with the latest sbios on 5.5 and newer kernels. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b0b03951544534d6d9ad4aa2787eefec988fff20 Author: Raag Jadav Date: Sun Jan 19 16:58:59 2020 +0530 ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1 Set d0 and d1 pin directions for spi0 and spi1 as per their pinmux. Signed-off-by: Raag Jadav Signed-off-by: Tony Lindgren commit bb48eb9b12a95db9d679025927269d4adda6dbd1 Author: Kristian Evensen Date: Thu Jan 23 13:20:18 2020 +0100 fou: Fix IPv6 netlink policy When submitting v2 of "fou: Support binding FoU socket" (1713cb37bf67), I accidentally sent the wrong version of the patch and one fix was missing. In the initial version of the patch, as well as the version 2 that I submitted, I incorrectly used ".type" for the two V6-attributes. The correct is to use ".len". Reported-by: Dmitry Vyukov Fixes: 1713cb37bf67 ("fou: Support binding FoU socket") Signed-off-by: Kristian Evensen Signed-off-by: David S. Miller commit 5169adbc982400f214bc0bcad1fcc076bd342987 Merge: 1efba987c486 d829229e35f3 Author: David S. Miller Date: Thu Jan 23 14:30:20 2020 +0100 Merge tag 'wireless-drivers-2020-01-23' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for v5.5 Second set of fixes for v5.5. There are quite a few patches, especially on iwlwifi, due to me being on a long break. Libertas also has a security fix and mt76 a build fix. iwlwifi * don't send the PPAG command when PPAG is disabled, since it can cause problems * a few fixes for a HW bug * a fix for RS offload; * a fix for 3168 devices where the NVM tables where the wrong tables were being read * fix a couple of potential memory leaks in TXQ code * disable L0S states in all hardware since our hardware doesn't officially support them anymore (and older versions of the hardware had instability in these states) * remove lar_disable parameter since it has been causing issues for some people who erroneously disable it * force the debug monitor HW to stop also when debug is disabled, since it sometimes stays on and prevents low system power states * don't send IWL_MVM_RXQ_NSSN_SYNC notification due to DMA problems libertas * fix two buffer overflows mt76 * build fix related to CONFIG_MT76_LEDS * fix off by one in bitrates handling ==================== Signed-off-by: David S. Miller commit 1efba987c48629c0c64703bb4ea76ca1a3771d17 Author: Eric Dumazet Date: Wed Jan 22 09:07:35 2020 -0800 tun: add mutex_unlock() call and napi.skb clearing in tun_get_user() If both IFF_NAPI_FRAGS mode and XDP are enabled, and the XDP program consumes the skb, we need to clear the napi.skb (or risk a use-after-free) and release the mutex (or risk a deadlock) WARNING: lock held when returning to user space! 5.5.0-rc6-syzkaller #0 Not tainted ------------------------------------------------ syz-executor.0/455 is leaving the kernel with locks still held! 1 lock held by syz-executor.0/455: #0: ffff888098f6e748 (&tfile->napi_mutex){+.+.}, at: tun_get_user+0x1604/0x3fc0 drivers/net/tun.c:1835 Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Petar Penkov Cc: Willem de Bruijn Signed-off-by: David S. Miller commit 971de2e572118c1128bff295341e37b6c8b8f108 Author: Ido Schimmel Date: Wed Jan 22 20:09:52 2020 +0200 mlxsw: spectrum_acl: Fix use-after-free during reload During reload (or module unload), the router block is de-initialized. Among other things, this results in the removal of a default multicast route from each active virtual router (VRF). These default routes are configured during initialization to trap packets to the CPU. In Spectrum-2, unlike Spectrum-1, multicast routes are implemented using ACL rules. Since the router block is de-initialized before the ACL block, it is possible that the ACL rules corresponding to the default routes are deleted while being accessed by the ACL delayed work that queries rules' activity from the device. This can result in a rare use-after-free [1]. Fix this by protecting the rules list accessed by the delayed work with a lock. We cannot use a spinlock as the activity read operation is blocking. [1] [ 123.331662] ================================================================== [ 123.339920] BUG: KASAN: use-after-free in mlxsw_sp_acl_rule_activity_update_work+0x330/0x3b0 [ 123.349381] Read of size 8 at addr ffff8881f3bb4520 by task kworker/0:2/78 [ 123.357080] [ 123.358773] CPU: 0 PID: 78 Comm: kworker/0:2 Not tainted 5.5.0-rc5-custom-33108-gf5df95d3ef41 #2209 [ 123.368898] Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 [ 123.378456] Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work [ 123.385970] Call Trace: [ 123.388734] dump_stack+0xc6/0x11e [ 123.392568] print_address_description.constprop.4+0x21/0x340 [ 123.403236] __kasan_report.cold.8+0x76/0xb1 [ 123.414884] kasan_report+0xe/0x20 [ 123.418716] mlxsw_sp_acl_rule_activity_update_work+0x330/0x3b0 [ 123.444034] process_one_work+0xb06/0x19a0 [ 123.453731] worker_thread+0x91/0xe90 [ 123.467348] kthread+0x348/0x410 [ 123.476847] ret_from_fork+0x24/0x30 [ 123.480863] [ 123.482545] Allocated by task 73: [ 123.486273] save_stack+0x19/0x80 [ 123.490000] __kasan_kmalloc.constprop.6+0xc1/0xd0 [ 123.495379] mlxsw_sp_acl_rule_create+0xa7/0x230 [ 123.500566] mlxsw_sp2_mr_tcam_route_create+0xf6/0x3e0 [ 123.506334] mlxsw_sp_mr_tcam_route_create+0x5b4/0x820 [ 123.512102] mlxsw_sp_mr_table_create+0x3b5/0x690 [ 123.517389] mlxsw_sp_vr_get+0x289/0x4d0 [ 123.521797] mlxsw_sp_fib_node_get+0xa2/0x990 [ 123.526692] mlxsw_sp_router_fib4_event_work+0x54c/0x2d60 [ 123.532752] process_one_work+0xb06/0x19a0 [ 123.537352] worker_thread+0x91/0xe90 [ 123.541471] kthread+0x348/0x410 [ 123.545103] ret_from_fork+0x24/0x30 [ 123.549113] [ 123.550795] Freed by task 518: [ 123.554231] save_stack+0x19/0x80 [ 123.557958] __kasan_slab_free+0x125/0x170 [ 123.562556] kfree+0xd7/0x3a0 [ 123.565895] mlxsw_sp_acl_rule_destroy+0x63/0xd0 [ 123.571081] mlxsw_sp2_mr_tcam_route_destroy+0xd5/0x130 [ 123.576946] mlxsw_sp_mr_tcam_route_destroy+0xba/0x260 [ 123.582714] mlxsw_sp_mr_table_destroy+0x1ab/0x290 [ 123.588091] mlxsw_sp_vr_put+0x1db/0x350 [ 123.592496] mlxsw_sp_fib_node_put+0x298/0x4c0 [ 123.597486] mlxsw_sp_vr_fib_flush+0x15b/0x360 [ 123.602476] mlxsw_sp_router_fib_flush+0xba/0x470 [ 123.607756] mlxsw_sp_vrs_fini+0xaa/0x120 [ 123.612260] mlxsw_sp_router_fini+0x137/0x384 [ 123.617152] mlxsw_sp_fini+0x30a/0x4a0 [ 123.621374] mlxsw_core_bus_device_unregister+0x159/0x600 [ 123.627435] mlxsw_devlink_core_bus_device_reload_down+0x7e/0xb0 [ 123.634176] devlink_reload+0xb4/0x380 [ 123.638391] devlink_nl_cmd_reload+0x610/0x700 [ 123.643382] genl_rcv_msg+0x6a8/0xdc0 [ 123.647497] netlink_rcv_skb+0x134/0x3a0 [ 123.651904] genl_rcv+0x29/0x40 [ 123.655436] netlink_unicast+0x4d4/0x700 [ 123.659843] netlink_sendmsg+0x7c0/0xc70 [ 123.664251] __sys_sendto+0x265/0x3c0 [ 123.668367] __x64_sys_sendto+0xe2/0x1b0 [ 123.672773] do_syscall_64+0xa0/0x530 [ 123.676892] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 123.682552] [ 123.684238] The buggy address belongs to the object at ffff8881f3bb4500 [ 123.684238] which belongs to the cache kmalloc-128 of size 128 [ 123.698261] The buggy address is located 32 bytes inside of [ 123.698261] 128-byte region [ffff8881f3bb4500, ffff8881f3bb4580) [ 123.711303] The buggy address belongs to the page: [ 123.716682] page:ffffea0007ceed00 refcount:1 mapcount:0 mapping:ffff888236403500 index:0x0 [ 123.725958] raw: 0200000000000200 dead000000000100 dead000000000122 ffff888236403500 [ 123.734646] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 123.743315] page dumped because: kasan: bad access detected [ 123.749562] [ 123.751241] Memory state around the buggy address: [ 123.756620] ffff8881f3bb4400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 123.764716] ffff8881f3bb4480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 123.772812] >ffff8881f3bb4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 123.780904] ^ [ 123.785697] ffff8881f3bb4580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 123.793793] ffff8881f3bb4600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 123.801883] ================================================================== Fixes: cf7221a4f5a5 ("mlxsw: spectrum_router: Add Multicast routing support for Spectrum-2") Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 5d2e5dd5849b4ef5e8ec35e812cdb732c13cd27e Author: Aneesh Kumar K.V Date: Wed Jan 8 11:14:22 2020 +0530 powerpc/mm/hash: Fix sharing context ids between kernel & userspace Commit 0034d395f89d ("powerpc/mm/hash64: Map all the kernel regions in the same 0xc range") has a bug in the definition of MIN_USER_CONTEXT. The result is that the context id used for the vmemmap and the lowest context id handed out to userspace are the same. The context id is essentially the process identifier as far as the first stage of the MMU translation is concerned. This can result in multiple SLB entries with the same VSID (Virtual Segment ID), accessible to the kernel and some random userspace process that happens to get the overlapping id, which is not expected eg: 07 c00c000008000000 40066bdea7000500 1T ESID= c00c00 VSID= 66bdea7 LLP:100 12 0002000008000000 40066bdea7000d80 1T ESID= 200 VSID= 66bdea7 LLP:100 Even though the user process and the kernel use the same VSID, the permissions in the hash page table prevent the user process from reading or writing to any kernel mappings. It can also lead to SLB entries with different base page size encodings (LLP), eg: 05 c00c000008000000 00006bde0053b500 256M ESID=c00c00000 VSID= 6bde0053b LLP:100 09 0000000008000000 00006bde0053bc80 256M ESID= 0 VSID= 6bde0053b LLP: 0 Such SLB entries can result in machine checks, eg. as seen on a G5: Oops: Machine check, sig: 7 [#1] BE PAGE SIZE=64K MU-Hash SMP NR_CPUS=4 NUMA Power Mac NIP: c00000000026f248 LR: c000000000295e58 CTR: 0000000000000000 REGS: c0000000erfd3d70 TRAP: 0200 Tainted: G M (5.5.0-rcl-gcc-8.2.0-00010-g228b667d8ea1) MSR: 9000000000109032 CR: 24282048 XER: 00000000 DAR: c00c000000612c80 DSISR: 00000400 IRQMASK: 0 ... NIP [c00000000026f248] .kmem_cache_free+0x58/0x140 LR [c088000008295e58] .putname 8x88/0xa Call Trace: .putname+0xB8/0xa .filename_lookup.part.76+0xbe/0x160 .do_faccessat+0xe0/0x380 system_call+0x5c/ex68 This happens with 256MB segments and 64K pages, as the duplicate VSID is hit with the first vmemmap segment and the first user segment, and older 32-bit userspace maps things in the first user segment. On other CPUs a machine check is not seen. Instead the userspace process can get stuck continuously faulting, with the fault never properly serviced, due to the kernel not understanding that there is already a HPTE for the address but with inaccessible permissions. On machines with 1T segments we've not seen the bug hit other than by deliberately exercising it. That seems to be just a matter of luck though, due to the typical layout of the user virtual address space and the ranges of vmemmap that are typically populated. To fix it we add 2 to MIN_USER_CONTEXT. This ensures the lowest context given to userspace doesn't overlap with the VMEMMAP context, or with the context for INVALID_REGION_ID. Fixes: 0034d395f89d ("powerpc/mm/hash64: Map all the kernel regions in the same 0xc range") Cc: stable@vger.kernel.org # v5.2+ Reported-by: Christian Marillat Reported-by: Romain Dolbeau Signed-off-by: Aneesh Kumar K.V [mpe: Account for INVALID_REGION_ID, mostly rewrite change log] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200123102547.11623-1-mpe@ellerman.id.au commit edf9acf5f5663f067e31152c75c1019378ebc505 Merge: 940ba1498665 aa475d935272 Author: David S. Miller Date: Thu Jan 23 11:20:57 2020 +0100 Merge branch 'r8152-serial-fixes' Hayes Wang says: ==================== r8152: serial fixes v3: 1. Fix the typos for patch #5 and #6. 2. Modify the commit message of patch #9. v2: For patch #2, move declaring the variable "ocp_data". v1: These patches are used to fix some issues for RTL8153. ==================== Signed-off-by: David S. Miller commit aa475d935272481c9ffb1ae54eeca5c1819fbe1a Author: Hayes Wang Date: Wed Jan 22 16:02:13 2020 +0800 r8152: disable DelayPhyPwrChg When enabling this, the device would wait an internal signal which wouldn't be triggered. Then, the device couldn't enter P3 mode, so the power consumption is increased. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 19813162895a696c5814d76e5f8fb6203d70f6e0 Author: Hayes Wang Date: Wed Jan 22 16:02:12 2020 +0800 r8152: avoid the MCU to clear the lanwake Avoid the MCU to clear the lanwake after suspending. It may cause the WOL fail. Disable LANWAKE_CLR_EN before suspending. Besides,enable it and reset the lanwake status when resuming or initializing. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit a0246dafe684a6d5ad31ccd59af0334ccf0cc7b2 Author: Hayes Wang Date: Wed Jan 22 16:02:11 2020 +0800 r8152: don't enable U1U2 with USB_SPEED_HIGH for RTL8153B For certain platforms, it causes USB reset periodically. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit d7f1b59655efb5a285d227c8f9853a98eab5c2fd Author: Hayes Wang Date: Wed Jan 22 16:02:10 2020 +0800 r8152: disable test IO for RTL8153B For RTL8153B with QFN32, disable test IO. Otherwise, it may cause abnormal behavior for the device randomly. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 08997b5eec08a2c29367f19a74abdea54b299406 Author: Hayes Wang Date: Wed Jan 22 16:02:09 2020 +0800 r8152: Disable PLA MCU clock speed down PLA MCU clock speed down could only be enabled when tx/rx are disabled. Otherwise, the packet loss may occur. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 809a7fc6593f288d6f820ef6cc57b9d69b5f9474 Author: Hayes Wang Date: Wed Jan 22 16:02:08 2020 +0800 r8152: disable U2P3 for RTL8153B Enable U2P3 may miss zero packet for bulk-in. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 9583a3638dc07cc1878f41265e85ed497f72efcb Author: Hayes Wang Date: Wed Jan 22 16:02:07 2020 +0800 r8152: get default setting of WOL before initializing Initailization would reset runtime suspend by tp->saved_wolopts, so the tp->saved_wolopts should be set before initializing. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit f99cd20eda12b1920ffc284a736437c016b3a5a2 Author: Hayes Wang Date: Wed Jan 22 16:02:06 2020 +0800 r8152: reset flow control patch when linking on for RTL8153B When linking ON, the patch of flow control has to be reset. This makes sure the patch works normally. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit a39142728d0e60a76b67db3cbc187d61fde7b46d Author: Hayes Wang Date: Wed Jan 22 16:02:05 2020 +0800 r8152: fix runtime resume for linking change Fix the runtime resume doesn't work normally for linking change. 1. Reset the settings and status of runtime suspend. 2. Sync the linking status. 3. Poll the linking change. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 940ba14986657a50c15f694efca1beba31fa568f Author: Eric Dumazet Date: Tue Jan 21 23:17:14 2020 -0800 gtp: make sure only SOCK_DGRAM UDP sockets are accepted A malicious user could use RAW sockets and fool GTP using them as standard SOCK_DGRAM UDP sockets. BUG: KMSAN: uninit-value in udp_tunnel_encap_enable include/net/udp_tunnel.h:174 [inline] BUG: KMSAN: uninit-value in setup_udp_tunnel_sock+0x45e/0x6f0 net/ipv4/udp_tunnel.c:85 CPU: 0 PID: 11262 Comm: syz-executor613 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 udp_tunnel_encap_enable include/net/udp_tunnel.h:174 [inline] setup_udp_tunnel_sock+0x45e/0x6f0 net/ipv4/udp_tunnel.c:85 gtp_encap_enable_socket+0x37f/0x5a0 drivers/net/gtp.c:827 gtp_encap_enable drivers/net/gtp.c:844 [inline] gtp_newlink+0xfb/0x1e50 drivers/net/gtp.c:666 __rtnl_newlink net/core/rtnetlink.c:3305 [inline] rtnl_newlink+0x2973/0x3920 net/core/rtnetlink.c:3363 rtnetlink_rcv_msg+0x1153/0x1570 net/core/rtnetlink.c:5424 netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5442 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x1248/0x14d0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x441359 Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fff1cd0ac28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441359 RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003 RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8 R10: 00000000004002c8 R11: 0000000000000246 R12: 00000000004020d0 R13: 0000000000402160 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:144 kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:307 [inline] kmsan_alloc_page+0x12a/0x310 mm/kmsan/kmsan_shadow.c:336 __alloc_pages_nodemask+0x57f2/0x5f60 mm/page_alloc.c:4800 alloc_pages_current+0x67d/0x990 mm/mempolicy.c:2207 alloc_pages include/linux/gfp.h:534 [inline] alloc_slab_page+0x111/0x12f0 mm/slub.c:1511 allocate_slab mm/slub.c:1656 [inline] new_slab+0x2bc/0x1130 mm/slub.c:1722 new_slab_objects mm/slub.c:2473 [inline] ___slab_alloc+0x1533/0x1f30 mm/slub.c:2624 __slab_alloc mm/slub.c:2664 [inline] slab_alloc_node mm/slub.c:2738 [inline] slab_alloc mm/slub.c:2783 [inline] kmem_cache_alloc+0xb23/0xd70 mm/slub.c:2788 sk_prot_alloc+0xf2/0x620 net/core/sock.c:1597 sk_alloc+0xf0/0xbe0 net/core/sock.c:1657 inet_create+0x7c7/0x1370 net/ipv4/af_inet.c:321 __sock_create+0x8eb/0xf00 net/socket.c:1420 sock_create net/socket.c:1471 [inline] __sys_socket+0x1a1/0x600 net/socket.c:1513 __do_sys_socket net/socket.c:1522 [inline] __se_sys_socket+0x8d/0xb0 net/socket.c:1520 __x64_sys_socket+0x4a/0x70 net/socket.c:1520 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet Cc: Pablo Neira Reported-by: syzbot Signed-off-by: David S. Miller commit d836f5c69d87473ff65c06a6123e5b2cf5e56f5b Author: Eric Dumazet Date: Tue Jan 21 22:47:29 2020 -0800 net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link() rtnl_create_link() needs to apply dev->min_mtu and dev->max_mtu checks that we apply in do_setlink() Otherwise malicious users can crash the kernel, for example after an integer overflow : BUG: KASAN: use-after-free in memset include/linux/string.h:365 [inline] BUG: KASAN: use-after-free in __alloc_skb+0x37b/0x5e0 net/core/skbuff.c:238 Write of size 32 at addr ffff88819f20b9c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.5.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:639 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192 memset+0x24/0x40 mm/kasan/common.c:108 memset include/linux/string.h:365 [inline] __alloc_skb+0x37b/0x5e0 net/core/skbuff.c:238 alloc_skb include/linux/skbuff.h:1049 [inline] alloc_skb_with_frags+0x93/0x590 net/core/skbuff.c:5664 sock_alloc_send_pskb+0x7ad/0x920 net/core/sock.c:2242 sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2259 mld_newpack+0x1d7/0x7f0 net/ipv6/mcast.c:1609 add_grhead.isra.0+0x299/0x370 net/ipv6/mcast.c:1713 add_grec+0x7db/0x10b0 net/ipv6/mcast.c:1844 mld_send_cr net/ipv6/mcast.c:1970 [inline] mld_ifc_timer_expire+0x3d3/0x950 net/ipv6/mcast.c:2477 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786 __do_softirq+0x262/0x98c kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x19b/0x1e0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61 Code: 98 6b ea f9 eb 8a cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d 44 1c 60 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 34 1c 60 00 fb f4 cc 55 48 89 e5 41 57 41 56 41 55 41 54 53 e8 4e 5d 9a f9 e8 79 RSP: 0018:ffffffff89807ce8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff13266ae RBX: ffffffff8987a1c0 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffffffff8987aa54 RBP: ffffffff89807d18 R08: ffffffff8987a1c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 R13: ffffffff8a799980 R14: 0000000000000000 R15: 0000000000000000 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690 default_idle_call+0x84/0xb0 kernel/sched/idle.c:94 cpuidle_idle_call kernel/sched/idle.c:154 [inline] do_idle+0x3c8/0x6e0 kernel/sched/idle.c:269 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361 rest_init+0x23b/0x371 init/main.c:451 arch_call_rest_init+0xe/0x1b start_kernel+0x904/0x943 init/main.c:784 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490 x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:471 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242 The buggy address belongs to the page: page:ffffea00067c82c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 raw: 057ffe0000000000 ffffea00067c82c8 ffffea00067c82c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88819f20b880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88819f20b900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88819f20b980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88819f20ba00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88819f20ba80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Fixes: 61e84623ace3 ("net: centralize net_device min/max MTU checking") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit 78f7a7566f5eb59321e99b55a6fdb16ea05b37d1 Author: Michael Ellerman Date: Wed Jan 22 15:07:28 2020 +1100 airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE The driver for Cisco Aironet 4500 and 4800 series cards (airo.c), implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl(). The ioctl handler copies an aironet_ioctl struct from userspace, which includes a command. Some of the commands are handled in readrids(), where the user controlled command is converted into a driver-internal value called "ridcode". There are two command values, AIROGWEPKTMP and AIROGWEPKNV, which correspond to ridcode values of RID_WEP_TEMP and RID_WEP_PERM respectively. These commands both have checks that the user has CAP_NET_ADMIN, with the comment that "Only super-user can read WEP keys", otherwise they return -EPERM. However there is another command value, AIRORRID, that lets the user specify the ridcode value directly, with no other checks. This means the user can bypass the CAP_NET_ADMIN check on AIROGWEPKTMP and AIROGWEPKNV. Fix it by moving the CAP_NET_ADMIN check out of the command handling and instead do it later based on the ridcode. That way regardless of whether the ridcode is set via AIROGWEPKTMP or AIROGWEPKNV, or passed in using AIRORID, we always do the CAP_NET_ADMIN check. Found by Ilja by code inspection, not tested as I don't have the required hardware. Reported-by: Ilja Van Sprundel Signed-off-by: Michael Ellerman Signed-off-by: David S. Miller commit d6bce2137f5d6bb1093e96d2f801479099b28094 Author: Michael Ellerman Date: Wed Jan 22 15:07:27 2020 +1100 airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE The driver for Cisco Aironet 4500 and 4800 series cards (airo.c), implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl(). The ioctl handler copies an aironet_ioctl struct from userspace, which includes a command and a length. Some of the commands are handled in readrids(), which kmalloc()'s a buffer of RIDSIZE (2048) bytes. That buffer is then passed to PC4500_readrid(), which has two cases. The else case does some setup and then reads up to RIDSIZE bytes from the hardware into the kmalloc()'ed buffer. Here len == RIDSIZE, pBuf is the kmalloc()'ed buffer: // read the rid length field bap_read(ai, pBuf, 2, BAP1); // length for remaining part of rid len = min(len, (int)le16_to_cpu(*(__le16*)pBuf)) - 2; ... // read remainder of the rid rc = bap_read(ai, ((__le16*)pBuf)+1, len, BAP1); PC4500_readrid() then returns to readrids() which does: len = comp->len; if (copy_to_user(comp->data, iobuf, min(len, (int)RIDSIZE))) { Where comp->len is the user controlled length field. So if the "rid length field" returned by the hardware is < 2048, and the user requests 2048 bytes in comp->len, we will leak the previous contents of the kmalloc()'ed buffer to userspace. Fix it by kzalloc()'ing the buffer. Found by Ilja by code inspection, not tested as I don't have the required hardware. Reported-by: Ilja Van Sprundel Signed-off-by: Michael Ellerman Signed-off-by: David S. Miller commit 9e0caab8e0f96f0af7d1dd388e62f44184a75372 Author: Vincenzo Frascino Date: Fri Jan 10 12:28:07 2020 +0000 tee: optee: Fix compilation issue with nommu The optee driver uses specific page table types to verify if a memory region is normal. These types are not defined in nommu systems. Trying to compile the driver in these systems results in a build error: linux/drivers/tee/optee/call.c: In function ‘is_normal_memory’: linux/drivers/tee/optee/call.c:533:26: error: ‘L_PTE_MT_MASK’ undeclared (first use in this function); did you mean ‘PREEMPT_MASK’? return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC; ^~~~~~~~~~~~~ PREEMPT_MASK linux/drivers/tee/optee/call.c:533:26: note: each undeclared identifier is reported only once for each function it appears in linux/drivers/tee/optee/call.c:533:44: error: ‘L_PTE_MT_WRITEALLOC’ undeclared (first use in this function) return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC; ^~~~~~~~~~~~~~~~~~~ Make the optee driver depend on MMU to fix the compilation issue. Signed-off-by: Vincenzo Frascino [jw: update commit title] Signed-off-by: Jens Wiklander commit 3adb4eaa1b4cbadc7858679334d19e840e7df6db Author: Andrew Lunn Date: Wed Jan 22 20:23:15 2020 +0100 MAINTAINERS: Make Russell King designated reviewer of phylib phylink and phylib are interconnected. It makes sense for phylib and phy driver patches to be also reviewed by the phylink maintainer. So add Russell King as a designed reviewer of phylib. Signed-off-by: Andrew Lunn Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit a48d4a33b6eff9531676008badadbddd19162f74 Merge: def9d2780727 bdefca2d8dc0 Author: Dave Airlie Date: Thu Jan 23 09:57:08 2020 +1000 Merge tag 'drm-misc-fixes-2020-01-22-1' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes -mst: Fix SST branch device handling (Wayne) -panfrost: Fix mapping of globally visible BO's (Boris) Cc: Wayne Lin CC: Boris Brezillon Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20200122213725.GA22099@art_vandelay commit 131701c697e85d5d0726e6152219359639fae98f Merge: 1b4e677f86c7 43108c72cf1d Author: Linus Torvalds Date: Wed Jan 22 12:56:19 2020 -0800 Merge tag 'leds-5.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds Pull LED fixes from Pavel Machek: "Jacek's fix for an uninitialized gpio label is why I'm requesting this pull; it fixes regression in debugging output in sysfs. Others are just bugfixes that should be safe. Everything has been in -next for while" * tag 'leds-5.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds: leds: lm3532: add pointer to documentation and fix typo leds: rb532: cleanup whitespace ledtrig-pattern: fix email address quoting in MODULE_AUTHOR() led: max77650: add of_match table leds-as3645a: Drop fwnode reference on ignored node leds: gpio: Fix uninitialized gpio label for fwnode based probe commit 1b4e677f86c7f730999223053534973bd0818c3c Merge: dbab40bdb42c 3bf8bdcf3bad Author: Linus Torvalds Date: Wed Jan 22 12:38:10 2020 -0800 Merge tag 'hwmon-for-v5.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - In hwmon core, do not use the hwmon parent device for device managed memory allocations, since parent device lifetime may not match hwmon device lifetime. - Fix discrepancy between read and write values in adt7475 driver. - Fix alarms and voltage limits in nct7802 driver. * tag 'hwmon-for-v5.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (core) Do not use device managed functions for memory allocations hwmon: (adt7475) Make volt2reg return same reg as reg2volt input hwmon: (nct7802) Fix non-working alarm on voltages hwmon: (nct7802) Fix voltage limits to wrong registers commit 5311a69aaca30fa849c3cc46fb25f75727fb72d0 Author: William Dauchy Date: Tue Jan 21 21:49:54 2020 +0100 net, ip6_tunnel: fix namespaces move in the same manner as commit d0f418516022 ("net, ip_tunnel: fix namespaces move"), fix namespace moving as it was broken since commit 8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnel"), but for ipv6 this time; there is no reason to keep it for ip6_tunnel. Fixes: 8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnel") Signed-off-by: William Dauchy Acked-by: Nicolas Dichtel Signed-off-by: David S. Miller commit 36d79af7fb59d6d9106feb9c1855eb93d6d53fe6 Author: Eric Dumazet Date: Tue Jan 21 11:02:20 2020 -0800 net_sched: use validated TCA_KIND attribute in tc_new_tfilter() sysbot found another issue in tc_new_tfilter(). We probably should use @name which contains the sanitized version of TCA_KIND. BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:608 [inline] BUG: KMSAN: uninit-value in string+0x522/0x690 lib/vsprintf.c:689 CPU: 1 PID: 10753 Comm: syz-executor.1 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 string_nocheck lib/vsprintf.c:608 [inline] string+0x522/0x690 lib/vsprintf.c:689 vsnprintf+0x207d/0x31b0 lib/vsprintf.c:2574 __request_module+0x2ad/0x11c0 kernel/kmod.c:143 tcf_proto_lookup_ops+0x241/0x720 net/sched/cls_api.c:139 tcf_proto_create net/sched/cls_api.c:262 [inline] tc_new_tfilter+0x2a4e/0x5010 net/sched/cls_api.c:2058 rtnetlink_rcv_msg+0xcb7/0x1570 net/core/rtnetlink.c:5415 netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5442 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x1248/0x14d0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45b349 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f88b3948c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f88b39496d4 RCX: 000000000045b349 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000099f R14: 00000000004cb163 R15: 000000000075bfd4 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2774 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4382 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1174 [inline] netlink_sendmsg+0x7d3/0x14d0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x451/0x5f0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 6f96c3c6904c ("net_sched: fix backward compatibility for TCA_KIND") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Cong Wang Cc: Marcelo Ricardo Leitner Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: David S. Miller commit d39ca2590d10712f412add7a88e1dd467a7246f4 Author: Paolo Abeni Date: Tue Jan 21 16:50:49 2020 +0100 Revert "udp: do rmem bulk free even if the rx sk queue is empty" This reverts commit 0d4a6608f68c7532dcbfec2ea1150c9761767d03. Williem reported that after commit 0d4a6608f68c ("udp: do rmem bulk free even if the rx sk queue is empty") the memory allocated by an almost idle system with many UDP sockets can grow a lot. For stable kernel keep the solution as simple as possible and revert the offending commit. Reported-by: Willem de Bruijn Diagnosed-by: Eric Dumazet Fixes: 0d4a6608f68c ("udp: do rmem bulk free even if the rx sk queue is empty") Signed-off-by: Paolo Abeni Acked-by: Willem de Bruijn Signed-off-by: David S. Miller commit 43108c72cf1d518f3ce62d3b1c8a9ffa38ddc28b Author: Pavel Date: Sun Jan 5 23:36:58 2020 +0100 leds: lm3532: add pointer to documentation and fix typo Add pointer to datasheet and fix typo in printk message. Signed-off-by: Pavel Machek commit 51eb5a24de9134f6a31a6219d147ea5c388f5200 Author: Pavel Machek Date: Thu Jan 2 22:29:35 2020 +0100 leds: rb532: cleanup whitespace Trivial cleanup removing empty line at wrong place. Signed-off-by: Pavel Machek commit 30d57d55abd7cc2c08ba032f1dc3079b1b42b9dc Author: Pavel Machek Date: Sun Mar 10 19:54:40 2019 +0100 ledtrig-pattern: fix email address quoting in MODULE_AUTHOR() Apparently it is quite easy to forget ">" in quoting of email address. This fixes it. Signed-off-by: Pavel Machek commit 2424415d25a765d4302ddfb4de75427e9294dc09 Author: Bartosz Golaszewski Date: Tue Dec 10 11:08:32 2019 +0100 led: max77650: add of_match table We need the of_match table if we want to use the compatible string in the pmic's child node and get the led driver loaded automatically. Signed-off-by: Bartosz Golaszewski Signed-off-by: Pavel Machek commit 22cb0a76e0059701bce395bd8832ea94342cbf4a Author: Sakari Ailus Date: Wed Dec 4 09:56:42 2019 +0200 leds-as3645a: Drop fwnode reference on ignored node If a node is ignored, do not get a reference to it. Fix the bug by moving fwnode_handle_get() where a reference to an fwnode is saved for clarity. Reported-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Sakari Ailus Signed-off-by: Pavel Machek commit 90a8e82d3ca8c1f85ac63f4a94c9b034f05af4ee Author: Jacek Anaszewski Date: Thu Dec 5 22:25:01 2019 +0100 leds: gpio: Fix uninitialized gpio label for fwnode based probe When switching to using generic LED name composition mechanism via devm_led_classdev_register_ext() API the part of code initializing struct gpio_led's template name property was removed alongside. It was however overlooked that the property was also passed to devm_fwnode_get_gpiod_from_child() in place of "label" parameter, which when set to NULL, results in gpio label being initialized to '?'. It could be observed in debugfs and failed to properly identify gpio association with LED consumer. Fix this shortcoming by updating the GPIO label after the LED is registered and its final name is known. Fixes: d7235f5feaa0 ("leds: gpio: Use generic support for composing LED names") Cc: Russell King Reviewed-by: Linus Walleij Signed-off-by: Jacek Anaszewski [fixed comment] Signed-off-by: Pavel Machek commit bda6a35505e28b70d48096c933d5949c9b6caf9a Author: David S. Miller Date: Wed Jan 22 20:38:39 2020 +0100 net: Add Jakub to MAINTAINERS for networking general. Signed-off-by: David S. Miller Acked-by: Jakub Kicinski commit c80794323e82ac6ab45052ebba5757ce47b4b588 Author: Maxim Mikityanskiy Date: Tue Jan 21 15:09:40 2020 +0000 net: Fix packet reordering caused by GRO and listified RX cooperation Commit 323ebb61e32b ("net: use listified RX for handling GRO_NORMAL skbs") introduces batching of GRO_NORMAL packets in napi_frags_finish, and commit 6570bc79c0df ("net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()") adds the same to napi_skb_finish. However, dev_gro_receive (that is called just before napi_{frags,skb}_finish) can also pass skbs to the networking stack: e.g., when the GRO session is flushed, napi_gro_complete is called, which passes pp directly to netif_receive_skb_internal, skipping napi->rx_list. It means that the packet stored in pp will be handled by the stack earlier than the packets that arrived before, but are still waiting in napi->rx_list. It leads to TCP reorderings that can be observed in the TCPOFOQueue counter in netstat. This commit fixes the reordering issue by making napi_gro_complete also use napi->rx_list, so that all packets going through GRO will keep their order. In order to keep napi_gro_flush working properly, gro_normal_list calls are moved after the flush to clear napi->rx_list. iwlwifi calls napi_gro_flush directly and does the same thing that is done by gro_normal_list, so the same change is applied there: napi_gro_flush is moved to be before the flush of napi->rx_list. A few other drivers also use napi_gro_flush (brocade/bna/bnad.c, cortina/gemini.c, hisilicon/hns3/hns3_enet.c). The first two also use napi_complete_done afterwards, which performs the gro_normal_list flush, so they are fine. The latter calls napi_gro_receive right after napi_gro_flush, so it can end up with non-empty napi->rx_list anyway. Fixes: 323ebb61e32b ("net: use listified RX for handling GRO_NORMAL skbs") Signed-off-by: Maxim Mikityanskiy Cc: Alexander Lobakin Cc: Edward Cree Acked-by: Alexander Lobakin Acked-by: Saeed Mahameed Acked-by: Edward Cree Signed-off-by: David S. Miller commit 0ace17d56824165c7f4c68785d6b58971db954dd Author: Richard Palethorpe Date: Tue Jan 21 14:42:58 2020 +0100 can, slip: Protect tty->disc_data in write_wakeup and close with RCU write_wakeup can happen in parallel with close/hangup where tty->disc_data is set to NULL and the netdevice is freed thus also freeing disc_data. write_wakeup accesses disc_data so we must prevent close from freeing the netdev while write_wakeup has a non-NULL view of tty->disc_data. We also need to make sure that accesses to disc_data are atomic. Which can all be done with RCU. This problem was found by Syzkaller on SLCAN, but the same issue is reproducible with the SLIP line discipline using an LTP test based on the Syzkaller reproducer. A fix which didn't use RCU was posted by Hillf Danton. Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") Reported-by: syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com Signed-off-by: Richard Palethorpe Cc: Wolfgang Grandegger Cc: Marc Kleine-Budde Cc: "David S. Miller" Cc: Tyler Hall Cc: linux-can@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: syzkaller@googlegroups.com Signed-off-by: David S. Miller commit 58c8db929db1c1d785a6f5d8f8692e5dbcc35e84 Author: Jakub Sitnicki Date: Tue Jan 21 13:31:47 2020 +0100 net, sk_msg: Don't check if sock is locked when tearing down psock As John Fastabend reports [0], psock state tear-down can happen on receive path *after* unlocking the socket, if the only other psock user, that is sockmap or sockhash, releases its psock reference before tcp_bpf_recvmsg does so: tcp_bpf_recvmsg() psock = sk_psock_get(sk) <- refcnt 2 lock_sock(sk); ... sock_map_free() <- refcnt 1 release_sock(sk) sk_psock_put() <- refcnt 0 Remove the lockdep check for socket lock in psock tear-down that got introduced in 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down"). [0] https://lore.kernel.org/netdev/5e25dc995d7d_74082aaee6e465b441@john-XPS-13-9370.notmuch/ Fixes: 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down") Reported-by: syzbot+d73682fcf7fee6982fe3@syzkaller.appspotmail.com Suggested-by: John Fastabend Signed-off-by: Jakub Sitnicki Acked-by: John Fastabend Acked-by: Daniel Borkmann Signed-off-by: David S. Miller commit 6849b5eba1965ceb0cad3a75877ef4569dd3638e Author: Vladimir Murzin Date: Mon Jan 20 15:07:46 2020 +0100 ARM: 8955/1: virt: Relax arch timer version check during early boot Updates to the Generic Timer architecture allow ID_PFR1.GenTimer to have values other than 0 or 1 while still preserving backward compatibility. At the moment, Linux is quite strict in the way it handles this field at early boot and will not configure arch timer if it doesn't find the value 1. Since here use ubfx for arch timer version extraction (hyb-stub build with -march=armv7-a, so it is safe) To help backports (even though the code was correct at the time of writing) Fixes: 8ec58be9f3ff ("ARM: virt: arch_timers: enable access to physical timers") Acked-by: Marc Zyngier Signed-off-by: Vladimir Murzin Signed-off-by: Russell King commit d829229e35f302fd49c052b5c5906c90ecf9911d Author: Emmanuel Grumbach Date: Tue Dec 3 10:08:49 2019 +0200 iwlwifi: mvm: don't send the IWL_MVM_RXQ_NSSN_SYNC notif to Rx queues The purpose of this was to keep all the queues updated with the Rx sequence numbers because unlikely yet possible situations where queues can't understand if a specific packet needs to be dropped or not. Unfortunately, it was reported that this caused issues in our DMA engine. We don't fully understand how this is related, but this is being currently debugged. For now, just don't send this notification to the Rx queues. This de-facto reverts my commit 3c514bf831ac12356b695ff054bef641b9e99593: iwlwifi: mvm: add a loose synchronization of the NSSN across Rx queues This issue was reported here: https://bugzilla.kernel.org/show_bug.cgi?id=204873 https://bugzilla.kernel.org/show_bug.cgi?id=205001 and others maybe. Fixes: 3c514bf831ac ("iwlwifi: mvm: add a loose synchronization of the NSSN across Rx queues") CC: # 5.3+ Signed-off-by: Emmanuel Grumbach Signed-off-by: Kalle Valo commit dbab40bdb42c03ab12096d4aaf2dbef3fb55282c Merge: d96d875ef5dd 1292e972fff2 Author: Linus Torvalds Date: Wed Jan 22 08:30:09 2020 -0800 Merge tag 'io_uring-5.5-2020-01-22' of git://git.kernel.dk/linux-block Pull io_uring fix from Jens Axboe: "This was supposed to have gone in last week, but due to a brain fart on my part, I forgot that we made this struct addition in the 5.5 cycle. So here it is for 5.5, to prevent having a 32 vs 64-bit compatability issue with the files_update command" * tag 'io_uring-5.5-2020-01-22' of git://git.kernel.dk/linux-block: io_uring: fix compat for IORING_REGISTER_FILES_UPDATE commit b61387cb732cf283d318b2165c44913525fe545f Author: Masami Hiramatsu Date: Wed Jan 22 12:23:25 2020 +0900 tracing/uprobe: Fix to make trace_uprobe_filter alignment safe Commit 99c9a923e97a ("tracing/uprobe: Fix double perf_event linking on multiprobe uprobe") moved trace_uprobe_filter on trace_probe_event. However, since it introduced a flexible data structure with char array and type casting, the alignment of trace_uprobe_filter can be broken. This changes the type of the array to trace_uprobe_filter data strucure to fix it. Link: http://lore.kernel.org/r/20200120124022.GA14897@hirez.programming.kicks-ass.net Link: http://lkml.kernel.org/r/157966340499.5107.10978352478952144902.stgit@devnote2 Fixes: 99c9a923e97a ("tracing/uprobe: Fix double perf_event linking on multiprobe uprobe") Suggested-by: Peter Zijlstra Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 17328f218fb760c9c6accc5b52494889243a6b98 Author: Frederic Barrat Date: Mon Jan 13 14:01:18 2020 +0100 powerpc/xive: Discard ESB load value when interrupt is invalid A load on an ESB page returning all 1's means that the underlying device has invalidated the access to the PQ state of the interrupt through mmio. It may happen, for example when querying a PHB interrupt while the PHB is in an error state. In that case, we should consider the interrupt to be invalid when checking its state in the irq_get_irqchip_state() handler. Fixes: da15c03b047d ("powerpc/xive: Implement get_irqchip_state method for XIVE to fix shutdown race") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Frederic Barrat [clg: wrote a commit log, introduced XIVE_ESB_INVALID ] Signed-off-by: Cédric Le Goater Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200113130118.27969-1-clg@kaod.org commit a2db55dda9cf9c24427ccd5da8792b028ebff46c Author: Bharata B Rao Date: Thu Jan 9 14:50:47 2020 +0530 powerpc: Ultravisor: Fix the dependencies for CONFIG_PPC_UV Let PPC_UV depend only on DEVICE_PRIVATE which in turn will satisfy all the other required dependencies Fixes: 013a53f2d25a ("powerpc: Ultravisor: Add PPC_UV config option") Reported-by: kbuild test robot Signed-off-by: Bharata B Rao Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200109092047.24043-1-bharata@linux.ibm.com commit 9c1c2b35f1d94de8325344c2777d7ee67492db3b Author: Jeff Layton Date: Wed Apr 3 13:16:01 2019 -0400 ceph: hold extra reference to r_parent over life of request Currently, we just assume that it will stick around by virtue of the submitter's reference, but later patches will allow the syscall to return early and we can't rely on that reference at that point. While I'm not aware of any reports of it, Xiubo pointed out that this may fix a use-after-free. If the wait for a reply times out or is canceled via signal, and then the reply comes in after the syscall returns, the client can end up trying to access r_parent without a reference. Take an extra reference to the inode when setting r_parent and release it when releasing the request. Cc: stable@vger.kernel.org Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit bdefca2d8dc0f80bbe49e08bf52a717146490706 Author: Boris Brezillon Date: Wed Jan 15 20:15:54 2020 -0600 drm/panfrost: Add the panfrost_gem_mapping concept With the introduction of per-FD address space, the same BO can be mapped in different address space if the BO is globally visible (GEM_FLINK) and opened in different context or if the dmabuf is self-imported. The current implementation does not take case into account, and attaches the mapping directly to the panfrost_gem_object. Let's create a panfrost_gem_mapping struct and allow multiple mappings per BO. The mappings are refcounted which helps solve another problem where mappings were torn down (GEM handle closed by userspace) while GPU jobs accessing those BOs were still in-flight. Jobs now keep a reference on the mappings they use. v2 (robh): - Minor review comment clean-ups from Steven - Use list_is_singular helper - Just WARN if we add a mapping when madvise state is not WILLNEED. With that, drop the use of object_name_lock. v3 (robh): - Revert returning list iterator in panfrost_gem_mapping_get() Fixes: a5efb4c9a562 ("drm/panfrost: Restructure the GEM object creation") Fixes: 7282f7645d06 ("drm/panfrost: Implement per FD address spaces") Cc: Signed-off-by: Boris Brezillon Signed-off-by: Rob Herring Acked-by: Boris Brezillon Reviewed-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20200116021554.15090-1-robh@kernel.org commit d0f418516022c32ecceaf4275423e5bd3f8743a9 Author: William Dauchy Date: Tue Jan 21 15:26:24 2020 +0100 net, ip_tunnel: fix namespaces move in the same manner as commit 690afc165bb3 ("net: ip6_gre: fix moving ip6gre between namespaces"), fix namespace moving as it was broken since commit 2e15ea390e6f ("ip_gre: Add support to collect tunnel metadata."). Indeed, the ip6_gre commit removed the local flag for collect_md condition, so there is no reason to keep it for ip_gre/ip_tunnel. this patch will fix both ip_tunnel and ip_gre modules. Fixes: 2e15ea390e6f ("ip_gre: Add support to collect tunnel metadata.") Signed-off-by: William Dauchy Acked-by: Nicolas Dichtel Signed-off-by: David S. Miller commit bfe02b9f9476bc8784ebb0f78fa244ad15bb15ea Author: Theodore Dubois Date: Mon Jan 20 14:10:53 2020 -0800 tcp: remove redundant assigment to snd_cwnd Not sure how this got in here. git blame says the second assignment was added in 3a9a57f6, but that commit also removed the first assignment. Signed-off-by: Theodore Dubois Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit ce896476c65d72b4b99fa09c2f33436b4198f034 Author: James Hughes Date: Mon Jan 20 11:12:40 2020 +0000 net: usb: lan78xx: Add .ndo_features_check As reported by Eric Dumazet, there are still some outstanding cases where the driver does not handle TSO correctly when skb's are over a certain size. Most cases have been fixed, this patch should ensure that forwarded SKB's that are greater than MAX_SINGLE_PACKET_SIZE - TX_OVERHEAD are software segmented and handled correctly. Signed-off-by: James Hughes Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 5b2f1f3070b6447b76174ea8bfb7390dc6253ebd Author: Wen Yang Date: Mon Jan 20 18:04:56 2020 +0800 tcp_bbr: improve arithmetic division in bbr_update_bw() do_div() does a 64-by-32 division. Use div64_long() instead of it if the divisor is long, to avoid truncation to 32-bit. And as a nice side effect also cleans up the function a bit. Signed-off-by: Wen Yang Cc: Eric Dumazet Cc: "David S. Miller" Cc: Alexey Kuznetsov Cc: Hideaki YOSHIFUJI Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit cb626bf566eb4433318d35681286c494f04fedcc Author: Jouni Hogander Date: Mon Jan 20 09:51:03 2020 +0200 net-sysfs: Fix reference count leak Netdev_register_kobject is calling device_initialize. In case of error reference taken by device_initialize is not given up. Drivers are supposed to call free_netdev in case of error. In non-error case the last reference is given up there and device release sequence is triggered. In error case this reference is kept and the release sequence is never started. Fix this by setting reg_state as NETREG_UNREGISTERED if registering fails. This is the rootcause for couple of memory leaks reported by Syzkaller: BUG: memory leak unreferenced object 0xffff8880675ca008 (size 256): comm "netdev_register", pid 281, jiffies 4294696663 (age 6.808s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000058ca4711>] kmem_cache_alloc_trace+0x167/0x280 [<000000002340019b>] device_add+0x882/0x1750 [<000000001d588c3a>] netdev_register_kobject+0x128/0x380 [<0000000011ef5535>] register_netdevice+0xa1b/0xf00 [<000000007fcf1c99>] __tun_chr_ioctl+0x20d5/0x3dd0 [<000000006a5b7b2b>] tun_chr_ioctl+0x2f/0x40 [<00000000f30f834a>] do_vfs_ioctl+0x1c7/0x1510 [<00000000fba062ea>] ksys_ioctl+0x99/0xb0 [<00000000b1c1b8d2>] __x64_sys_ioctl+0x78/0xb0 [<00000000984cabb9>] do_syscall_64+0x16f/0x580 [<000000000bde033d>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [<00000000e6ca2d9f>] 0xffffffffffffffff BUG: memory leak unreferenced object 0xffff8880668ba588 (size 8): comm "kobject_set_nam", pid 286, jiffies 4294725297 (age 9.871s) hex dump (first 8 bytes): 6e 72 30 00 cc be df 2b nr0....+ backtrace: [<00000000a322332a>] __kmalloc_track_caller+0x16e/0x290 [<00000000236fd26b>] kstrdup+0x3e/0x70 [<00000000dd4a2815>] kstrdup_const+0x3e/0x50 [<0000000049a377fc>] kvasprintf_const+0x10e/0x160 [<00000000627fc711>] kobject_set_name_vargs+0x5b/0x140 [<0000000019eeab06>] dev_set_name+0xc0/0xf0 [<0000000069cb12bc>] netdev_register_kobject+0xc8/0x320 [<00000000f2e83732>] register_netdevice+0xa1b/0xf00 [<000000009e1f57cc>] __tun_chr_ioctl+0x20d5/0x3dd0 [<000000009c560784>] tun_chr_ioctl+0x2f/0x40 [<000000000d759e02>] do_vfs_ioctl+0x1c7/0x1510 [<00000000351d7c31>] ksys_ioctl+0x99/0xb0 [<000000008390040a>] __x64_sys_ioctl+0x78/0xb0 [<0000000052d196b7>] do_syscall_64+0x16f/0x580 [<0000000019af9236>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [<00000000bc384531>] 0xffffffffffffffff v3 -> v4: Set reg_state to NETREG_UNREGISTERED if registering fails v2 -> v3: * Replaced BUG_ON with WARN_ON in free_netdev and netdev_release v1 -> v2: * Relying on driver calling free_netdev rather than calling put_device directly in error path Reported-by: syzbot+ad8ca40ecd77896d51e2@syzkaller.appspotmail.com Cc: David Miller Cc: Greg Kroah-Hartman Cc: Lukas Bulwahn Signed-off-by: Jouni Hogander Signed-off-by: David S. Miller commit 62ebaeaedee7591c257543d040677a60e35c7aec Author: Yuki Taguchi Date: Mon Jan 20 13:48:37 2020 +0900 ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions After LRO/GRO is applied, SRv6 encapsulated packets have SKB_GSO_IPXIP6 feature flag, and this flag must be removed right after decapulation procedure. Currently, SKB_GSO_IPXIP6 flag is not removed on End.D* actions, which creates inconsistent packet state, that is, a normal TCP/IP packets have the SKB_GSO_IPXIP6 flag. This behavior can cause unexpected fallback to GSO on routing to netdevices that do not support SKB_GSO_IPXIP6. For example, on inter-VRF forwarding, decapsulated packets separated into small packets by GSO because VRF devices do not support TSO for packets with SKB_GSO_IPXIP6 flag, and this degrades forwarding performance. This patch removes encapsulation related GSO flags from the skb right after the End.D* action is applied. Fixes: d7a669dd2f8b ("ipv6: sr: add helper functions for seg6local") Signed-off-by: Yuki Taguchi Signed-off-by: David S. Miller commit 9c5ed2f831c603439c699f8cd69e9998de472526 Merge: 80892772c4ed 4e4362d2bf2a Author: David S. Miller Date: Tue Jan 21 09:25:58 2020 +0100 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2020-01-21 1) Fix packet tx through bpf_redirect() for xfrm and vti interfaces. From Nicolas Dichtel. 2) Do not confirm neighbor when do pmtu update on a virtual xfrm interface. From Xu Wang. 3) Support output_mark for offload ESP packets, this was forgotten when the output_mark was added initially. From Ulrich Weber. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 5eec71829ad7749a8c918f66a91a9bcf6fb4462a Author: Tvrtko Ursulin Date: Thu Jan 16 13:45:08 2020 +0000 drm/i915: Align engine->uabi_class/instance with i915_drm.h In our ABI we have defined I915_ENGINE_CLASS_INVALID_NONE and I915_ENGINE_CLASS_INVALID_VIRTUAL as negative values which creates implicit coupling with type widths used in, also ABI, struct i915_engine_class_instance. One place where we export engine->uabi_class I915_ENGINE_CLASS_INVALID_VIRTUAL is from our our tracepoints. Because the type of the former is u8 in contrast to u16 defined in the ABI, 254 will be returned instead of 65534 which userspace would legitimately expect. Another place is I915_CONTEXT_PARAM_ENGINES. Therefore we need to align the type used to store engine ABI class and instance. v2: * Update the commit message mentioning get_engines and cc stable. (Chris) Signed-off-by: Tvrtko Ursulin Fixes: 6d06779e8672 ("drm/i915: Load balancing across a virtual engine") Cc: Chris Wilson Cc: # v5.3+ Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200116134508.25211-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 0b3bd0cdc329a1e2e00995cffd61aacf58c87cb4) Signed-off-by: Joonas Lahtinen commit ecc4d2a52df65479de5e333a9065ed02202a400f Author: Matthew Auld Date: Fri Jan 17 13:24:13 2020 +0000 drm/i915/userptr: fix size calculation If we create a rather large userptr object(e.g 1ULL << 32) we might shift past the type-width of num_pages: (int)num_pages << PAGE_SHIFT, resulting in a totally bogus sg_table, which fortunately will eventually manifest as: gen8_ppgtt_insert_huge:463 GEM_BUG_ON(iter->sg->length < page_size) kernel BUG at drivers/gpu/drm/i915/gt/gen8_ppgtt.c:463! v2: more unsigned long prefer I915_GTT_PAGE_SIZE Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl") Signed-off-by: Matthew Auld Cc: Chris Wilson Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200117132413.1170563-2-matthew.auld@intel.com (cherry picked from commit 8e78871bc1e5efec22c950d3fd24ddb63d4ff28a) Signed-off-by: Joonas Lahtinen commit 04060db41178c7c244f2c7dcd913e7fd331de915 Author: Bart Van Assche Date: Wed Jan 15 20:47:37 2020 -0800 scsi: RDMA/isert: Fix a recently introduced regression related to logout iscsit_close_connection() calls isert_wait_conn(). Due to commit e9d3009cb936 both functions call target_wait_for_sess_cmds() although that last function should be called only once. Fix this by removing the target_wait_for_sess_cmds() call from isert_wait_conn() and by only calling isert_wait_conn() after target_wait_for_sess_cmds(). Fixes: e9d3009cb936 ("scsi: target: iscsi: Wait for all commands to finish before freeing a session"). Link: https://lore.kernel.org/r/20200116044737.19507-1-bvanassche@acm.org Reported-by: Rahul Kundu Signed-off-by: Bart Van Assche Tested-by: Mike Marciniszyn Acked-by: Sagi Grimberg Signed-off-by: Martin K. Petersen commit 0e2209629fec427ba75a6351486153a9feddd36b Author: Hannes Reinecke Date: Thu Jan 16 11:20:53 2020 +0100 scsi: fnic: do not queue commands during fwreset When a link is going down the driver will be calling fnic_cleanup_io(), which will traverse all commands and calling 'done' for each found command. While the traversal is handled under the host_lock, calling 'done' happens after the host_lock is being dropped. As fnic_queuecommand_lck() is being called with the host_lock held, it might well be that it will pick the command being selected for abortion from the above routine and enqueue it for sending, but then 'done' is being called on that very command from the above routine. Which of course confuses the hell out of the scsi midlayer. So fix this by not queueing commands when fnic_cleanup_io is active. Link: https://lore.kernel.org/r/20200116102053.62755-1-hare@suse.de Signed-off-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 996d5d5f89a558a3608a46e73ccd1b99f1b1d058 Author: Stephan Gerhold Date: Fri Jan 17 13:40:36 2020 -0800 Input: pm8xxx-vib - fix handling of separate enable register Setting the vibrator enable_mask is not implemented correctly: For regmap_update_bits(map, reg, mask, val) we give in either regs->enable_mask or 0 (= no-op) as mask and "val" as value. But "val" actually refers to the vibrator voltage control register, which has nothing to do with the enable_mask. So we usually end up doing nothing when we really wanted to enable the vibrator. We want to set or clear the enable_mask (to enable/disable the vibrator). Therefore, change the call to always modify the enable_mask and set the bits only if we want to enable the vibrator. Fixes: d4c7c5c96c92 ("Input: pm8xxx-vib - handle separate enable register") Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20200114183442.45720-1-stephan@gerhold.net Signed-off-by: Dmitry Torokhov commit 1292e972fff2b2d81e139e0c2fe5f50249e78c58 Author: Eugene Syromiatnikov Date: Wed Jan 15 17:35:38 2020 +0100 io_uring: fix compat for IORING_REGISTER_FILES_UPDATE fds field of struct io_uring_files_update is problematic with regards to compat user space, as pointer size is different in 32-bit, 32-on-64-bit, and 64-bit user space. In order to avoid custom handling of compat in the syscall implementation, make fds __u64 and use u64_to_user_ptr in order to retrieve it. Also, align the field naturally and check that no garbage is passed there. Fixes: c3a31e605620c279 ("io_uring: add support for IORING_REGISTER_FILES_UPDATE") Signed-off-by: Eugene Syromiatnikov Signed-off-by: Jens Axboe commit bf24daac8f2bd5b8affaec03c2be1d20bcdd6837 Author: Masami Ichikawa Date: Thu Jan 16 22:12:36 2020 +0900 tracing: Do not set trace clock if tracefs lockdown is in effect When trace_clock option is not set and unstable clcok detected, tracing_set_default_clock() sets trace_clock(ThinkPad A285 is one of case). In that case, if lockdown is in effect, null pointer dereference error happens in ring_buffer_set_clock(). Link: http://lkml.kernel.org/r/20200116131236.3866925-1-masami256@gmail.com Cc: stable@vger.kernel.org Fixes: 17911ff38aa58 ("tracing: Add locked_down checks to the open calls of files created for tracefs") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1788488 Signed-off-by: Masami Ichikawa Signed-off-by: Steven Rostedt (VMware) commit 8bcebc77e85f3d7536f96845a0fe94b1dddb6af0 Author: Steven Rostedt (VMware) Date: Mon Jan 20 13:07:31 2020 -0500 tracing: Fix histogram code when expression has same var as value While working on a tool to convert SQL syntex into the histogram language of the kernel, I discovered the following bug: # echo 'first u64 start_time u64 end_time pid_t pid u64 delta' >> synthetic_events # echo 'hist:keys=pid:start=common_timestamp' > events/sched/sched_waking/trigger # echo 'hist:keys=next_pid:delta=common_timestamp-$start,start2=$start:onmatch(sched.sched_waking).trace(first,$start2,common_timestamp,next_pid,$delta)' > events/sched/sched_switch/trigger Would not display any histograms in the sched_switch histogram side. But if I were to swap the location of "delta=common_timestamp-$start" with "start2=$start" Such that the last line had: # echo 'hist:keys=next_pid:start2=$start,delta=common_timestamp-$start:onmatch(sched.sched_waking).trace(first,$start2,common_timestamp,next_pid,$delta)' > events/sched/sched_switch/trigger The histogram works as expected. What I found out is that the expressions clear out the value once it is resolved. As the variables are resolved in the order listed, when processing: delta=common_timestamp-$start The $start is cleared. When it gets to "start2=$start", it errors out with "unresolved symbol" (which is silent as this happens at the location of the trace), and the histogram is dropped. When processing the histogram for variable references, instead of adding a new reference for a variable used twice, use the same reference. That way, not only is it more efficient, but the order will no longer matter in processing of the variables. From Tom Zanussi: "Just to clarify some more about what the problem was is that without your patch, we would have two separate references to the same variable, and during resolve_var_refs(), they'd both want to be resolved separately, so in this case, since the first reference to start wasn't part of an expression, it wouldn't get the read-once flag set, so would be read normally, and then the second reference would do the read-once read and also be read but using read-once. So everything worked and you didn't see a problem: from: start2=$start,delta=common_timestamp-$start In the second case, when you switched them around, the first reference would be resolved by doing the read-once, and following that the second reference would try to resolve and see that the variable had already been read, so failed as unset, which caused it to short-circuit out and not do the trigger action to generate the synthetic event: to: delta=common_timestamp-$start,start2=$start With your patch, we only have the single resolution which happens correctly the one time it's resolved, so this can't happen." Link: https://lore.kernel.org/r/20200116154216.58ca08eb@gandalf.local.home Cc: stable@vger.kernel.org Fixes: 067fe038e70f6 ("tracing: Add variable reference handling to hist triggers") Reviewed-by: Tom Zanuss Tested-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit d96d875ef5dd372f533059a44f98e92de9cf0d42 Merge: def9d2780727 394440d46941 Author: Linus Torvalds Date: Mon Jan 20 11:24:13 2020 -0800 Merge tag 'fixes_for_v5.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull reiserfs fix from Jan Kara: "A fixup of a recently merged reiserfs fix which has caused problem when xattrs were not compiled in" * tag 'fixes_for_v5.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr commit 32c72165dbd0e246e69d16a3ad348a4851afd415 Author: Kadlecsik József Date: Sun Jan 19 22:06:49 2020 +0100 netfilter: ipset: use bitmap infrastructure completely The bitmap allocation did not use full unsigned long sizes when calculating the required size and that was triggered by KASAN as slab-out-of-bounds read in several places. The patch fixes all of them. Reported-by: syzbot+fabca5cbf5e54f3fe2de@syzkaller.appspotmail.com Reported-by: syzbot+827ced406c9a1d9570ed@syzkaller.appspotmail.com Reported-by: syzbot+190d63957b22ef673ea5@syzkaller.appspotmail.com Reported-by: syzbot+dfccdb2bdb4a12ad425e@syzkaller.appspotmail.com Reported-by: syzbot+df0d0f5895ef1f41a65b@syzkaller.appspotmail.com Reported-by: syzbot+b08bd19bb37513357fd4@syzkaller.appspotmail.com Reported-by: syzbot+53cdd0ec0bbabd53370a@syzkaller.appspotmail.com Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 80892772c4edac88c538165d26a0105f19b61c1c Author: xiaofeng.yan Date: Mon Jan 20 14:26:39 2020 +0800 hsr: Fix a compilation error A compliation error happen when building branch 5.5-rc7 In file included from net/hsr/hsr_main.c:12:0: net/hsr/hsr_main.h:194:20: error: two or more data types in declaration specifiers static inline void void hsr_debugfs_rename(struct net_device *dev) So Removed one void. Fixes: 4c2d5e33dcd3 ("hsr: rename debugfs file when interface name is changed") Signed-off-by: xiaofeng.yan Acked-by: Taehee Yoo Signed-off-by: David S. Miller commit 2a187d03352086e300daa2044051db00044cd171 Author: Michał Mirosław Date: Wed Jan 15 10:54:35 2020 +0100 mmc: sdhci: fix minimum clock rate for v3 controller For SDHCIv3+ with programmable clock mode, minimal clock frequency is still base clock / max(divider). Minimal programmable clock frequency is always greater than minimal divided clock frequency. Without this patch, SDHCI uses out-of-spec initial frequency when multiplier is big enough: mmc1: mmc_rescan_try_freq: trying to init card at 468750 Hz [for 480 MHz source clock divided by 1024] The code in sdhci_calc_clk() already chooses a correct SDCLK clock mode. Fixes: c3ed3877625f ("mmc: sdhci: add support for programmable clock mode") Cc: # 4f6aa3264af4: mmc: tegra: Only advertise UHS modes if IO regulator is present Cc: Signed-off-by: Michał Mirosław Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/ffb489519a446caffe7a0a05c4b9372bd52397bb.1579082031.git.mirq-linux@rere.qmqm.pl Signed-off-by: Ulf Hansson commit 690afc165bb314354667f67157c1a1aea7dc797a Author: Niko Kortstrom Date: Thu Jan 16 11:43:27 2020 +0200 net: ip6_gre: fix moving ip6gre between namespaces Support for moving IPv4 GRE tunnels between namespaces was added in commit b57708add314 ("gre: add x-netns support"). The respective change for IPv6 tunnels, commit 22f08069e8b4 ("ip6gre: add x-netns support") did not drop NETIF_F_NETNS_LOCAL flag so moving them from one netns to another is still denied in IPv6 case. Drop NETIF_F_NETNS_LOCAL flag from ip6gre tunnels to allow moving ip6gre tunnel endpoints between network namespaces. Signed-off-by: Niko Kortstrom Acked-by: Nicolas Dichtel Acked-by: William Tu Signed-off-by: David S. Miller commit def9d2780727cec3313ed3522d0123158d87224d Author: Linus Torvalds Date: Sun Jan 19 16:02:49 2020 -0800 Linux 5.5-rc7 commit 7008ee121089b8193aea918b98850fe87d996508 Merge: 11a827294755 fc585d4a5cf6 Author: Linus Torvalds Date: Sun Jan 19 12:10:28 2020 -0800 Merge tag 'riscv/for-v5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "Three fixes for RISC-V: - Don't free and reuse memory containing the code that CPUs parked at boot reside in. - Fix rv64 build problems for ubsan and some modules by adding logical and arithmetic shift helpers for 128-bit values. These are from libgcc and are similar to what's present for ARM64. - Fix vDSO builds to clean up their own temporary files" * tag 'riscv/for-v5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Less inefficient gcc tishift helpers (and export their symbols) riscv: delete temporary files riscv: make sure the cores stay looping in .Lsecondary_park commit 11a827294755ce3d07e14cfe257b3ec16ab56f34 Merge: 5f43644394a9 b2383ad987a6 Author: Linus Torvalds Date: Sun Jan 19 12:03:53 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Fix non-blocking connect() in x25, from Martin Schiller. 2) Fix spurious decryption errors in kTLS, from Jakub Kicinski. 3) Netfilter use-after-free in mtype_destroy(), from Cong Wang. 4) Limit size of TSO packets properly in lan78xx driver, from Eric Dumazet. 5) r8152 probe needs an endpoint sanity check, from Johan Hovold. 6) Prevent looping in tcp_bpf_unhash() during sockmap/tls free, from John Fastabend. 7) hns3 needs short frames padded on transmit, from Yunsheng Lin. 8) Fix netfilter ICMP header corruption, from Eyal Birger. 9) Fix soft lockup when low on memory in hns3, from Yonglong Liu. 10) Fix NTUPLE firmware command failures in bnxt_en, from Michael Chan. 11) Fix memory leak in act_ctinfo, from Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (91 commits) cxgb4: reject overlapped queues in TC-MQPRIO offload cxgb4: fix Tx multi channel port rate limit net: sched: act_ctinfo: fix memory leak bnxt_en: Do not treat DSN (Digital Serial Number) read failure as fatal. bnxt_en: Fix ipv6 RFS filter matching logic. bnxt_en: Fix NTUPLE firmware command failures. net: systemport: Fixed queue mapping in internal ring map net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec net: dsa: sja1105: Don't error out on disabled ports with no phy-mode net: phy: dp83867: Set FORCE_LINK_GOOD to default after reset net: hns: fix soft lockup when there is not enough memory net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key() net/sched: act_ife: initalize ife->metalist earlier netfilter: nat: fix ICMP header corruption on ICMP errors net: wan: lapbether.c: Use built-in RCU list checking netfilter: nf_tables: fix flowtable list del corruption netfilter: nf_tables: fix memory leak in nf_tables_parse_netdev_hooks() netfilter: nf_tables: remove WARN and add NLA_STRING upper limits netfilter: nft_tunnel: ERSPAN_VERSION must not be null netfilter: nft_tunnel: fix null-attribute check ... commit 5f43644394a96a8bcd8fc29a8bbd9c40b4465b54 Merge: 8f8972a3127f e64175776d06 Author: Linus Torvalds Date: Sun Jan 19 12:02:06 2020 -0800 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Two runtime PM fixes and one leak fix" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: iop3xx: Fix memory leak in probe error path i2c: tegra: Properly disable runtime PM on driver's probe error i2c: tegra: Fix suspending in active runtime PM state commit 927d780ee371d7e121cea4fc7812f6ef2cea461c Author: Alex Sverdlin Date: Wed Jan 8 15:57:47 2020 +0100 ARM: 8950/1: ftrace/recordmcount: filter relocation types Scenario 1, ARMv7 ================= If code in arch/arm/kernel/ftrace.c would operate on mcount() pointer the following may be generated: 00000230 : 230: b5f8 push {r3, r4, r5, r6, r7, lr} 232: b500 push {lr} 234: f7ff fffe bl 0 <__gnu_mcount_nc> 234: R_ARM_THM_CALL __gnu_mcount_nc 238: f240 0600 movw r6, #0 238: R_ARM_THM_MOVW_ABS_NC __gnu_mcount_nc 23c: f8d0 1180 ldr.w r1, [r0, #384] ; 0x180 FTRACE currently is not able to deal with it: WARNING: CPU: 0 PID: 0 at .../kernel/trace/ftrace.c:1979 ftrace_bug+0x1ad/0x230() ... CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.116-... #1 ... [] (unwind_backtrace) from [] (show_stack+0x11/0x14) [] (show_stack) from [] (dump_stack+0x81/0xa8) [] (dump_stack) from [] (warn_slowpath_common+0x69/0x90) [] (warn_slowpath_common) from [] (warn_slowpath_null+0x17/0x1c) [] (warn_slowpath_null) from [] (ftrace_bug+0x1ad/0x230) [] (ftrace_bug) from [] (ftrace_process_locs+0x27d/0x444) [] (ftrace_process_locs) from [] (ftrace_init+0x91/0xe8) [] (ftrace_init) from [] (start_kernel+0x34b/0x358) [] (start_kernel) from [<00308095>] (0x308095) ---[ end trace cb88537fdc8fa200 ]--- ftrace failed to modify [] prealloc_fixed_plts+0x8/0x60 actual: 44:f2:e1:36 ftrace record flags: 0 (0) expected tramp: c03143e9 Scenario 2, ARMv4T ================== ftrace: allocating 14435 entries in 43 pages ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:2029 ftrace_bug+0x204/0x310 CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.5 #1 Hardware name: Cirrus Logic EDB9302 Evaluation Board [] (unwind_backtrace) from [] (show_stack+0x20/0x2c) [] (show_stack) from [] (dump_stack+0x20/0x30) [] (dump_stack) from [] (__warn+0xdc/0x104) [] (__warn) from [] (warn_slowpath_null+0x4c/0x5c) [] (warn_slowpath_null) from [] (ftrace_bug+0x204/0x310) [] (ftrace_bug) from [] (ftrace_init+0x3b4/0x4d4) [] (ftrace_init) from [] (start_kernel+0x20c/0x410) [] (start_kernel) from [<00000000>] ( (null)) ---[ end trace 0506a2f5dae6b341 ]--- ftrace failed to modify [] perf_trace_sys_exit+0x5c/0xe8 actual: 1e:ff:2f:e1 Initializing ftrace call sites ftrace record flags: 0 (0) expected tramp: c000fb24 The analysis for this problem has been already performed previously, refer to the link below. Fix the above problems by allowing only selected reloc types in __mcount_loc. The list itself comes from the legacy recordmcount.pl script. Link: https://lore.kernel.org/lkml/56961010.6000806@pengutronix.de/ Cc: stable@vger.kernel.org Fixes: ed60453fa8f8 ("ARM: 6511/1: ftrace: add ARM support for C version of recordmcount") Signed-off-by: Alexander Sverdlin Acked-by: Steven Rostedt (VMware) Signed-off-by: Russell King commit b2383ad987a61bdd3a0a4ec3f343fbf0e3d9067b Author: Rahul Lakkireddy Date: Fri Jan 17 18:21:47 2020 +0530 cxgb4: reject overlapped queues in TC-MQPRIO offload A queue can't belong to multiple traffic classes. So, reject any such configuration that results in overlapped queues for a traffic class. Fixes: b1396c2bd675 ("cxgb4: parse and configure TC-MQPRIO offload") Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit c856e2b6fc5c675512e578225ade545c1834f3ee Author: Rahul Lakkireddy Date: Fri Jan 17 18:23:55 2020 +0530 cxgb4: fix Tx multi channel port rate limit T6 can support 2 egress traffic management channels per port to double the total number of traffic classes that can be configured. In this configuration, if the class belongs to the other channel, then all the queues must be bound again explicitly to the new class, for the rate limit parameters on the other channel to take effect. So, always explicitly bind all queues to the port rate limit traffic class, regardless of the traffic management channel that it belongs to. Also, only bind queues to port rate limit traffic class, if all the queues don't already belong to an existing different traffic class. Fixes: 4ec4762d8ec6 ("cxgb4: add TC-MATCHALL classifier egress offload") Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit 09d4f10a5e78d76a53e3e584f1e6a701b6d24108 Author: Eric Dumazet Date: Sat Jan 18 20:45:06 2020 -0800 net: sched: act_ctinfo: fix memory leak Implement a cleanup method to properly free ci->params BUG: memory leak unreferenced object 0xffff88811746e2c0 (size 64): comm "syz-executor617", pid 7106, jiffies 4294943055 (age 14.250s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ c0 34 60 84 ff ff ff ff 00 00 00 00 00 00 00 00 .4`............. backtrace: [<0000000015aa236f>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<0000000015aa236f>] slab_post_alloc_hook mm/slab.h:586 [inline] [<0000000015aa236f>] slab_alloc mm/slab.c:3320 [inline] [<0000000015aa236f>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549 [<000000002c946bd1>] kmalloc include/linux/slab.h:556 [inline] [<000000002c946bd1>] kzalloc include/linux/slab.h:670 [inline] [<000000002c946bd1>] tcf_ctinfo_init+0x21a/0x530 net/sched/act_ctinfo.c:236 [<0000000086952cca>] tcf_action_init_1+0x400/0x5b0 net/sched/act_api.c:944 [<000000005ab29bf8>] tcf_action_init+0x135/0x1c0 net/sched/act_api.c:1000 [<00000000392f56f9>] tcf_action_add+0x9a/0x200 net/sched/act_api.c:1410 [<0000000088f3c5dd>] tc_ctl_action+0x14d/0x1bb net/sched/act_api.c:1465 [<000000006b39d986>] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424 [<00000000fd6ecace>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477 [<0000000047493d02>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442 [<00000000bdcf8286>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] [<00000000bdcf8286>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328 [<00000000fc5b92d9>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917 [<00000000da84d076>] sock_sendmsg_nosec net/socket.c:639 [inline] [<00000000da84d076>] sock_sendmsg+0x54/0x70 net/socket.c:659 [<0000000042fb2eee>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330 [<000000008f23f67e>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384 [<00000000d838e4f6>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417 [<00000000289a9cb1>] __do_sys_sendmsg net/socket.c:2426 [inline] [<00000000289a9cb1>] __se_sys_sendmsg net/socket.c:2424 [inline] [<00000000289a9cb1>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424 Fixes: 24ec483cec98 ("net: sched: Introduce act_ctinfo action") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Kevin 'ldir' Darbyshire-Bryant Cc: Cong Wang Cc: Toke Høiland-Jørgensen Acked-by: Kevin 'ldir' Darbyshire-Bryant Signed-off-by: David S. Miller commit fc585d4a5cf614727f64d86550b794bcad29d5c3 Author: Olof Johansson Date: Mon Dec 16 20:06:31 2019 -0800 riscv: Less inefficient gcc tishift helpers (and export their symbols) The existing __lshrti3 was really inefficient, and the other two helpers are also needed to compile some modules. Add the missing versions, and export all of the symbols like arm64 already does. This code is based on the assembly generated by libgcc builds. This fixes a build break triggered by ubsan: riscv64-unknown-linux-gnu-ld: lib/ubsan.o: in function `.L2': ubsan.c:(.text.unlikely+0x38): undefined reference to `__ashlti3' riscv64-unknown-linux-gnu-ld: ubsan.c:(.text.unlikely+0x42): undefined reference to `__ashrti3' Signed-off-by: Olof Johansson [paul.walmsley@sifive.com: use SYM_FUNC_{START,END} instead of ENTRY/ENDPROC; note libgcc origin] Signed-off-by: Paul Walmsley commit 8f8972a3127ff46df62ae30057d29606968ec4aa Merge: 244dc2689085 d70486668cdf Author: Linus Torvalds Date: Sat Jan 18 16:34:17 2020 -0800 Merge tag 'mtd/fixes-for-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fixes from Miquel Raynal: "Raw NAND: - GPMI: Fix the suspend/resume SPI-NOR: - Fix quad enable on Spansion like flashes - Fix selection of 4-byte addressing opcodes on Spansion" * tag 'mtd/fixes-for-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: rawnand: gpmi: Restore nfc timing setup after suspend/resume mtd: rawnand: gpmi: Fix suspend/resume problem mtd: spi-nor: Fix quad enable for Spansion like flashes mtd: spi-nor: Fix selection of 4-byte addressing opcodes on Spansion commit 244dc2689085d7ff478f7b61841e62e59bea4557 Merge: 0cc2682d8baa f66d84c8b4db Author: Linus Torvalds Date: Sat Jan 18 13:57:31 2020 -0800 Merge tag 'drm-fixes-2020-01-19' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Back from LCA2020, fixes wasn't too busy last week, seems to have quieten down appropriately, some amdgpu, i915, then a core mst fix and one fix for virtio-gpu and one for rockchip: core mst: - serialize down messages and clear timeslots are on unplug amdgpu: - Update golden settings for renoir - eDP fix i915: - uAPI fix: Remove dash and colon from PMU names to comply with tools/perf - Fix for include file that was indirectly included - Two fixes to make sure VMA are marked active for error capture virtio: - maintain obj reservation lock when submitting cmds rockchip: - increase link rate var size to accommodate rates" * tag 'drm-fixes-2020-01-19' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: Reorder detect_edp_sink_caps before link settings read. drm/amdgpu: update goldensetting for renoir drm/dp_mst: Have DP_Tx send one msg at a time drm/dp_mst: clear time slots for ports invalid drm/i915/pmu: Do not use colons or dashes in PMU names drm/rockchip: fix integer type used for storing dp data rate drm/i915/gt: Mark ring->vma as active while pinned drm/i915/gt: Mark context->state vma as active while pinned drm/i915/gt: Skip trying to unbind in restore_ggtt_mappings drm/i915: Add missing include file drm/virtio: add missing virtio_gpu_array_lock_resv call commit 95f4d9cced96afa9c69b3da8e79e96102c84fc60 Author: Ilie Halip Date: Wed Jan 15 13:32:42 2020 +0200 riscv: delete temporary files Temporary files used in the VDSO build process linger on even after make mrproper: vdso-dummy.o.tmp, vdso.so.dbg.tmp. Delete them once they're no longer needed. Signed-off-by: Ilie Halip Signed-off-by: Paul Walmsley commit 0cc2682d8baaa6c7383e40153afc19239ad28d77 Merge: 7ff15cd0458c a006483b2f97 Author: Linus Torvalds Date: Sat Jan 18 13:02:12 2020 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: - a resctrl fix for uninitialized objects found by debugobjects - a resctrl memory leak fix - fix the unintended re-enabling of the of SME and SEV CPU flags if memory encryption was disabled at bootup via the MSR space" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Ensure clearing of SME/SEV features is maintained x86/resctrl: Fix potential memory leak x86/resctrl: Fix an imbalance in domain_remove_cpu() commit 7ff15cd0458c288afa954de843bb1903c723e5b3 Merge: 9e79c5233290 de95a991bb72 Author: Linus Torvalds Date: Sat Jan 18 13:00:59 2020 -0800 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Ingo Molnar: "Three fixes: fix link failure on Alpha, fix a Sparse warning and annotate/robustify a lockless access in the NOHZ code" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tick/sched: Annotate lockless access to last_jiffies_update lib/vdso: Make __cvdso_clock_getres() static time/posix-stubs: Provide compat itimer supoprt for alpha commit 9e79c5233290884d54addb601afc7ece2f70c79e Merge: a186c112c7a4 dc8d37ed304e Author: Linus Torvalds Date: Sat Jan 18 12:57:41 2020 -0800 Merge branch 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull cpu/SMT fix from Ingo Molnar: "Fix a build bug on CONFIG_HOTPLUG_SMT=y && !CONFIG_SYSFS kernels" * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpu/SMT: Fix x86 link error without CONFIG_SYSFS commit a186c112c7a44fefdf9e4208f2b38c31b53f3c1d Merge: b07b9e8d6318 978370956d20 Author: Linus Torvalds Date: Sat Jan 18 12:56:36 2020 -0800 Merge branch 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 RAS fix from Ingo Molnar: "Fix a thermal throttling race that can result in easy to trigger boot crashes on certain Ice Lake platforms" * 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce/therm_throt: Do not access uninitialized therm_work commit b07b9e8d631856c9e42af79900527509449206f4 Merge: 124b5547ec1e 2167f1625c2f Author: Linus Torvalds Date: Sat Jan 18 12:55:19 2020 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Tooling fixes, three Intel uncore driver fixes, plus an AUX events fix uncovered by the perf fuzzer" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/uncore: Remove PCIe3 unit for SNR perf/x86/intel/uncore: Fix missing marker for snr_uncore_imc_freerunning_events perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family perf: Correctly handle failed perf_get_aux_event() perf hists: Fix variable name's inconsistency in hists__for_each() macro perf map: Set kmap->kmaps backpointer for main kernel map chunks perf report: Fix incorrectly added dimensions as switch perf data file tools lib traceevent: Fix memory leakage in filter_event commit 124b5547ec1e1c935c5cc3dfe9f3c04669ecb5e4 Merge: a1c6f87efc0a 39e7234f00bc Author: Linus Torvalds Date: Sat Jan 18 12:53:28 2020 -0800 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Ingo Molnar: "Three fixes: - Fix an rwsem spin-on-owner crash, introduced in v5.4 - Fix a lockdep bug when running out of stack_trace entries, introduced in v5.4 - Docbook fix" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/rwsem: Fix kernel crash when spinning on RWSEM_OWNER_UNKNOWN futex: Fix kernel-doc notation warning locking/lockdep: Fix buffer overrun problem in stack_trace[] commit a1c6f87efc0ad67797bc81071b6e6291896d7460 Merge: e2f73d1e52a5 1fd224e35c14 Author: Linus Torvalds Date: Sat Jan 18 12:52:18 2020 -0800 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Ingo Molnar: "Fix a recent regression in the Ingenic SoCs irqchip driver that floods the syslog" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/ingenic: Get rid of the legacy IRQ domain commit e2f73d1e52a5b3c53f11861f31d726168ca92ce6 Merge: ba0f47220384 4911ee401b7c Author: Linus Torvalds Date: Sat Jan 18 12:50:14 2020 -0800 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "Three EFI fixes: - Fix a slow-boot-scrolling regression but making sure we use WC for EFI earlycon framebuffer mappings on x86 - Fix a mixed EFI mode boot crash - Disable paging explicitly before entering startup_32() in mixed mode bootup" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/efistub: Disable paging at mixed mode entry efi/libstub/random: Initialize pointer variables to zero for mixed mode efi/earlycon: Fix write-combine mapping on x86 commit ba0f47220384ff160c9df93dedbbef26d7b67f7b Merge: 8cac89909a30 463f550fb47b Author: Linus Torvalds Date: Sat Jan 18 12:29:13 2020 -0800 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull rseq fixes from Ingo Molnar: "Two rseq bugfixes: - CLONE_VM !CLONE_THREAD didn't work properly, the kernel would end up corrupting the TLS of the parent. Technically a change in the ABI but the previous behavior couldn't resonably have been relied on by applications so this looks like a valid exception to the ABI rule. - Make the RSEQ_FLAG_UNREGISTER ABI behavior consistent with the handling of other flags. This is not thought to impact any applications either" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq: Unregister rseq for clone CLONE_VM rseq: Reject unknown flags on rseq unregister commit 8cac89909a30807eb4aba56a0e29f55e3b6df42f Merge: 2324de6fab22 6b3ad6649a4c Author: Linus Torvalds Date: Sat Jan 18 12:23:31 2020 -0800 Merge tag 'for-linus-2020-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull thread fixes from Christian Brauner: "Here is an urgent fix for ptrace_may_access() permission checking. Commit 69f594a38967 ("ptrace: do not audit capability check when outputing /proc/pid/stat") introduced the ability to opt out of audit messages for accesses to various proc files since they are not violations of policy. While doing so it switched the check from ns_capable() to has_ns_capability{_noaudit}(). That means it switched from checking the subjective credentials (ktask->cred) of the task to using the objective credentials (ktask->real_cred). This is appears to be wrong. ptrace_has_cap() is currently only used in ptrace_may_access() And is used to check whether the calling task (subject) has the CAP_SYS_PTRACE capability in the provided user namespace to operate on the target task (object). According to the cred.h comments this means the subjective credentials of the calling task need to be used. With this fix we switch ptrace_has_cap() to use security_capable() and thus back to using the subjective credentials. As one example where this might be particularly problematic, Jann pointed out that in combination with the upcoming IORING_OP_OPENAT{2} feature, this bug might allow unprivileged users to bypass the capability checks while asynchronously opening files like /proc/*/mem, because the capability checks for this would be performed against kernel credentials. To illustrate on the former point about this being exploitable: When io_uring creates a new context it records the subjective credentials of the caller. Later on, when it starts to do work it creates a kernel thread and registers a callback. The callback runs with kernel creds for ktask->real_cred and ktask->cred. To prevent this from becoming a full-blown 0-day io_uring will call override_cred() and override ktask->cred with the subjective credentials of the creator of the io_uring instance. With ptrace_has_cap() currently looking at ktask->real_cred this override will be ineffective and the caller will be able to open arbitray proc files as mentioned above. Luckily, this is currently not exploitable but would be so once IORING_OP_OPENAT{2} land in v5.6. Let's fix it now. To minimize potential regressions I successfully ran the criu testsuite. criu makes heavy use of ptrace() and extensively hits ptrace_may_access() codepaths and has a good change of detecting any regressions. Additionally, I succesfully ran the ptrace and seccomp kernel tests" * tag 'for-linus-2020-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: ptrace: reintroduce usage of subjective credentials in ptrace_has_cap() commit 2324de6fab2223287da7628ba92dc6cfed4f46ca Merge: 8965de70cbaf 40260b01d029 Author: Linus Torvalds Date: Sat Jan 18 12:18:55 2020 -0800 Merge tag 's390-5.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix printing misleading Secure-IPL enabled message when it is not. - Fix a race condition between host ap bus and guest ap bus doing device reset in crypto code. - Fix sanity check in CCA cipher key function (CCA AES cipher key support), which fails otherwise. * tag 's390-5.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/setup: Fix secure ipl message s390/zcrypt: move ap device reset from bus to driver code s390/zcrypt: Fix CCA cipher key gen with clear key value function commit 7eaecf7963c1c8f62d62c6a8e7c439b0e7f2d365 Author: Florian Westphal Date: Sat Jan 18 11:27:25 2020 +0100 netfilter: nft_osf: add missing check for DREG attribute syzbot reports just another NULL deref crash because of missing test for presence of the attribute. Reported-by: syzbot+cf23983d697c26c34f60@syzkaller.appspotmail.com Fixes: b96af92d6eaf9fadd ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 8965de70cbafec673417eed423bd5e0e9c244079 Merge: f04dba64d667 28d76df18f0a Author: Linus Torvalds Date: Sat Jan 18 12:12:36 2020 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Three fixes in drivers with no impact to core code. The mptfusion fix is enormous because the driver API had to be rethreaded to pass down the necessary iocp pointer, but once that's done a significant chunk of code is deleted. The other two patches are small" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: mptfusion: Fix double fetch bug in ioctl scsi: storvsc: Correctly set number of hardware queues for IDE disk scsi: fnic: fix invalid stack access commit f04dba64d667419493d1f9aadd50b19860312b6c Merge: bf3f401db6cb fb85145c0444 Author: Linus Torvalds Date: Sat Jan 18 12:08:57 2020 -0800 Merge tag 'char-misc-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are some small fixes for 5.5-rc7 Included here are: - two lkdtm fixes - coresight build fix - Documentation update for the hw process document All of these have been in linux-next with no reported issues" * tag 'char-misc-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: Documentation/process: Add Amazon contact for embargoed hardware issues lkdtm/bugs: fix build error in lkdtm_UNSET_SMEP lkdtm/bugs: Make double-fault test always available coresight: etm4x: Fix unused function warning commit bf3f401db6cbe010095fe3d1e233a5fde54e8b78 Merge: c5fd2c5b8bcd 9fea3a40f6b0 Author: Linus Torvalds Date: Sat Jan 18 12:06:09 2020 -0800 Merge tag 'staging-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging and IIO driver fixes from Greg KH: "Here are some small staging and iio driver fixes for 5.5-rc7 All of them are for some small reported issues. Nothing major, full details in the shortlog. All have been in linux-next with no reported issues" * tag 'staging-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: comedi: ni_routes: allow partial routing information staging: comedi: ni_routes: fix null dereference in ni_find_route_source() iio: light: vcnl4000: Fix scale for vcnl4040 iio: buffer: align the size of scan bytes to size of the largest element iio: chemical: pms7003: fix unmet triggered buffer dependency iio: imu: st_lsm6dsx: Fix selection of ST_LSM6DS3_ID iio: adc: ad7124: Fix DT channel configuration commit c5fd2c5b8bcd274718c3370b39913f68587fb9cc Merge: 25e73aadf297 453495d4e791 Author: Linus Torvalds Date: Sat Jan 18 12:02:33 2020 -0800 Merge tag 'usb-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB driver fixes from Greg KH: "Here are some small USB driver and core fixes for 5.5-rc7 There's one fix for hub wakeup issues and a number of small usb-serial driver fixes and device id updates. The hub fix has been in linux-next for a while with no reported issues, and the usb-serial ones have all passed 0-day with no problems" * tag 'usb-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: quatech2: handle unbound ports USB: serial: keyspan: handle unbound ports USB: serial: io_edgeport: add missing active-port sanity check USB: serial: io_edgeport: handle unbound ports on URB completion USB: serial: ch341: handle unbound port at reset_resume USB: serial: suppress driver bind attributes USB: serial: option: add support for Quectel RM500Q in QDL mode usb: core: hub: Improved device recognition on remote wakeup USB: serial: opticon: fix control-message timeouts USB: serial: option: Add support for Quectel RM500Q USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx commit e02d9c4c68dc0ca08ded9487720bba775c09669b Merge: 5a9ef19454cd d061b2411d5f Author: David S. Miller Date: Sat Jan 18 14:38:30 2020 +0100 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes. 3 small bug fix patches. The 1st two are aRFS fixes and the last one fixes a fatal driver load failure on some kernels without PCIe extended config space support enabled. Please also queue these for -stable. Thanks. ==================== Signed-off-by: David S. Miller commit d061b2411d5f3d6272187ab734ce0640827fca13 Author: Michael Chan Date: Fri Jan 17 00:32:47 2020 -0500 bnxt_en: Do not treat DSN (Digital Serial Number) read failure as fatal. DSN read can fail, for example on a kdump kernel without PCIe extended config space support. If DSN read fails, don't set the BNXT_FLAG_DSN_VALID flag and continue loading. Check the flag to see if the stored DSN is valid before using it. Only VF reps creation should fail without valid DSN. Fixes: 03213a996531 ("bnxt: move bp->switch_id initialization to PF probe") Reported-by: Marc Smith Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 6fc7caa84e713f7627e171ab1e7c4b5be0dc9b3d Author: Michael Chan Date: Fri Jan 17 00:32:46 2020 -0500 bnxt_en: Fix ipv6 RFS filter matching logic. Fix bnxt_fltr_match() to match ipv6 source and destination addresses. The function currently only checks ipv4 addresses and will not work corrently on ipv6 filters. Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit ceb3284c588eee5ea256c70e4d8d7cf399b8134e Author: Michael Chan Date: Fri Jan 17 00:32:45 2020 -0500 bnxt_en: Fix NTUPLE firmware command failures. The NTUPLE related firmware commands are sent to the wrong firmware channel, causing all these commands to fail on new firmware that supports the new firmware channel. Fix it by excluding the 3 NTUPLE firmware commands from the list for the new firmware channel. Fixes: 760b6d33410c ("bnxt_en: Add support for 2nd firmware message channel.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 6b3ad6649a4c75504edeba242d3fd36b3096a57f Author: Christian Brauner Date: Wed Jan 15 14:42:34 2020 +0100 ptrace: reintroduce usage of subjective credentials in ptrace_has_cap() Commit 69f594a38967 ("ptrace: do not audit capability check when outputing /proc/pid/stat") introduced the ability to opt out of audit messages for accesses to various proc files since they are not violations of policy. While doing so it somehow switched the check from ns_capable() to has_ns_capability{_noaudit}(). That means it switched from checking the subjective credentials of the task to using the objective credentials. This is wrong since. ptrace_has_cap() is currently only used in ptrace_may_access() And is used to check whether the calling task (subject) has the CAP_SYS_PTRACE capability in the provided user namespace to operate on the target task (object). According to the cred.h comments this would mean the subjective credentials of the calling task need to be used. This switches ptrace_has_cap() to use security_capable(). Because we only call ptrace_has_cap() in ptrace_may_access() and in there we already have a stable reference to the calling task's creds under rcu_read_lock() there's no need to go through another series of dereferences and rcu locking done in ns_capable{_noaudit}(). As one example where this might be particularly problematic, Jann pointed out that in combination with the upcoming IORING_OP_OPENAT feature, this bug might allow unprivileged users to bypass the capability checks while asynchronously opening files like /proc/*/mem, because the capability checks for this would be performed against kernel credentials. To illustrate on the former point about this being exploitable: When io_uring creates a new context it records the subjective credentials of the caller. Later on, when it starts to do work it creates a kernel thread and registers a callback. The callback runs with kernel creds for ktask->real_cred and ktask->cred. To prevent this from becoming a full-blown 0-day io_uring will call override_cred() and override ktask->cred with the subjective credentials of the creator of the io_uring instance. With ptrace_has_cap() currently looking at ktask->real_cred this override will be ineffective and the caller will be able to open arbitray proc files as mentioned above. Luckily, this is currently not exploitable but will turn into a 0-day once IORING_OP_OPENAT{2} land in v5.6. Fix it now! Cc: Oleg Nesterov Cc: Eric Paris Cc: stable@vger.kernel.org Reviewed-by: Kees Cook Reviewed-by: Serge Hallyn Reviewed-by: Jann Horn Fixes: 69f594a38967 ("ptrace: do not audit capability check when outputing /proc/pid/stat") Signed-off-by: Christian Brauner commit 00ed452c210a0bc1ff3ee79e1ce6b199f00a0638 Author: Matthew Wilcox (Oracle) Date: Sun Jan 12 15:54:10 2020 -0500 XArray: Add xa_for_each_range This function supports iterating over a range of an array. Also add documentation links for xa_for_each_start(). Signed-off-by: Matthew Wilcox (Oracle) commit c44aa5e8ab58b5f4cf473970ec784c3333496a2e Author: Matthew Wilcox (Oracle) Date: Fri Jan 17 22:13:21 2020 -0500 XArray: Fix xas_find returning too many entries If you call xas_find() with the initial index > max, it should have returned NULL but was returning the entry at index. Signed-off-by: Matthew Wilcox (Oracle) Cc: stable@vger.kernel.org commit 19c30f4dd0923ef191f35c652ee4058e91e89056 Author: Matthew Wilcox (Oracle) Date: Fri Jan 17 22:00:41 2020 -0500 XArray: Fix xa_find_after with multi-index entries If the entry is of an order which is a multiple of XA_CHUNK_SIZE, the current detection of sibling entries does not work. Factor out an xas_sibling() function to make xa_find_after() a little more understandable, and write a new implementation that doesn't suffer from the same bug. Signed-off-by: Matthew Wilcox (Oracle) Cc: stable@vger.kernel.org commit 430f24f94c8a174d411a550d7b5529301922e67a Author: Matthew Wilcox (Oracle) Date: Fri Jan 17 17:45:12 2020 -0500 XArray: Fix infinite loop with entry at ULONG_MAX If there is an entry at ULONG_MAX, xa_for_each() will overflow the 'index + 1' in xa_find_after() and wrap around to 0. Catch this case and terminate the loop by returning NULL. Signed-off-by: Matthew Wilcox (Oracle) Cc: stable@vger.kernel.org commit 82a958497dc9120e0e8043da82273baedd255aaf Author: Matthew Wilcox (Oracle) Date: Fri Jan 17 12:36:32 2020 -0500 XArray: Add wrappers for nested spinlocks Some users need to take an xarray lock while holding another xarray lock. Reported-by: Doug Gilbert Signed-off-by: Matthew Wilcox (Oracle) commit f66d84c8b4db9a4f77f29e2d8fd521196c879582 Merge: e33c7ba89263 5a64967a2f3b Author: Dave Airlie Date: Sat Jan 18 12:54:10 2020 +1000 Merge tag 'drm-misc-fixes-2020-01-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes virtio: maintain obj reservation lock when submitting cmds (Gerd) rockchip: increase link rate var size to accommodate rates (Tobias) mst: serialize down messages and clear timeslots are on unplug (Wayne) Cc: Gerd Hoffmann Cc: Tobias Schramm Cc: Wayne Lin Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20200116162856.GA11524@art_vandelay commit e33c7ba89263c4bf5d0553907f315dd38751e684 Merge: 16a89856f0a5 88550e1c345c Author: Dave Airlie Date: Sat Jan 18 12:53:53 2020 +1000 Merge tag 'drm-intel-fixes-2020-01-16' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - uAPI fix: Remove dash and colon from PMU names to comply with tools/perf - Fix for include file that was indirectly included - Two fixes to make sure VMA are marked active for error capture Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20200116161419.GA13594@jlahtine-desk.ger.corp.intel.com commit db1a079569687eeb7f617a50bbb0474e9e11b64a Author: Wayne Lin Date: Fri Jan 17 14:03:50 2020 +0800 drm/dp_mst: Handle SST-only branch device case [Why] While handling LINK_ADDRESS reply, current code expects a peer device can handle sideband message once the peer device type is reported as DP_PEER_DEVICE_MST_BRANCHING. However, when the connected device is a SST branch case, it can't handle the sideband message(MST_CAP=0 in DPCD 00021h). Current code will try to send LINK_ADDRESS to SST branch device and end up with message timeout and monitor can't display normally. As the result of that, we should take SST branch device into account. [How] According to DP 1.4 spec, we can use Peer_Device_Type as DP_PEER_DEVICE_MST_BRANCHING and Message_Capability_Status as 0 to indicate peer device as a SST-only branch device. Fix following: - Add the function drm_dp_mst_is_dp_mst_end_device() to decide whether a peer device connected to a DFP is mst end device. Which also indicates if the peer device is capable of handling message or not. - Take SST-only branch device case into account in drm_dp_port_set_pdt() and add a new parameter 'new_mcs'. Take sst branch device case as the same case as DP_PEER_DEVICE_DP_LEGACY_CONV and DP_PEER_DEVICE_SST_SINK. All original handling logics remain. - Take SST-only branch device case into account in drm_dp_mst_port_add_connector(). - Fix some parts in drm_dp_mst_handle_link_address_port() to have SST branch device case into consideration. - Fix the arguments of drm_dp_port_set_pdt() in drm_dp_mst_handle_conn_stat(). - Have SST branch device also report connector_status_connected when the ddps is true in drm_dp_mst_detect_port() - Fix the arguments of drm_dp_port_set_pdt() in drm_dp_delayed_destroy_port() Changes since v1:(https://patchwork.kernel.org/patch/11323079/) * Squash previous patch into one patch and merge the commit message here. * Combine the if statements mentioned in comments Fixes: c485e2c97dae ("drm/dp_mst: Refactor pdt setup/teardown, add more locking") Cc: Ville Syrjälä Cc: Harry Wentland Cc: Lyude Paul Signed-off-by: Wayne Lin Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20200117060350.26358-2-Wayne.Lin@amd.com commit d70486668cdf51b14a50425ab45fc18677a167b2 Author: Esben Haabendal Date: Fri Jan 17 21:05:37 2020 +0100 mtd: rawnand: gpmi: Restore nfc timing setup after suspend/resume As we reset the GPMI block at resume, the timing parameters setup by a previous exec_op is lost. Rewriting GPMI timing registers on first exec_op after resume fixes the problem. Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op") Cc: stable@vger.kernel.org Signed-off-by: Esben Haabendal Acked-by: Han Xu Signed-off-by: Miquel Raynal commit 5bc6bb603b4d0c8802af75e4932232683ab2d761 Author: Esben Haabendal Date: Fri Jan 17 21:05:36 2020 +0100 mtd: rawnand: gpmi: Fix suspend/resume problem On system resume, the gpmi clock must be enabled before accessing gpmi block. Without this, resume causes something like [ 661.348790] gpmi_reset_block(5cbb0f7e): module reset timeout [ 661.348889] gpmi-nand 1806000.gpmi-nand: Error setting GPMI : -110 [ 661.348928] PM: dpm_run_callback(): platform_pm_resume+0x0/0x44 returns -110 [ 661.348961] PM: Device 1806000.gpmi-nand failed to resume: error -110 Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op") Cc: stable@vger.kernel.org Signed-off-by: Esben Haabendal Acked-by: Han Xu Signed-off-by: Miquel Raynal commit da2ef8124f20b4ce18d1d3d24fc7b88e687e10bb Author: Michael Walle Date: Thu Jan 16 10:37:00 2020 +0100 mtd: spi-nor: Fix quad enable for Spansion like flashes The commit 7b678c69c0ca ("mtd: spi-nor: Merge spansion Quad Enable methods") forgot to actually set the QE bit in some cases. Thus this breaks quad mode accesses to flashes which support readback of the status register-2. Fix it. Fixes: 7b678c69c0ca ("mtd: spi-nor: Merge spansion Quad Enable methods") Signed-off-by: Michael Walle Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit 440b6d50254bdbd84c2a665c7f53ec69dd741a4f Author: Vignesh Raghavendra Date: Wed Jan 8 10:43:43 2020 +0530 mtd: spi-nor: Fix selection of 4-byte addressing opcodes on Spansion mtd->size is still unassigned when running spansion_post_sfdp_fixups() hook, therefore use nor->params.size to determine the size of flash device. This makes sure that 4-byte addressing opcodes are used on Spansion flashes that are larger than 16MiB and don't have SFDP 4BAIT table populated. Fixes: 92094ebc385e ("mtd: spi-nor: Add spansion_post_sfdp_fixups()") Signed-off-by: Vignesh Raghavendra Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit 25e73aadf297d78cf528841795cd37bad8320642 Merge: effaf90137e3 44d282796f81 Author: Linus Torvalds Date: Fri Jan 17 11:25:45 2020 -0800 Merge tag 'io_uring-5.5-2020-01-16' of git://git.kernel.dk/linux-block Pull io_uring fixes form Jens Axboe: - Ensure ->result is always set when IO is retried (Bijan) - In conjunction with the above, fix a regression in polled IO issue when retried (me/Bijan) - Don't setup async context for read/write fixed, otherwise we may wrongly map the iovec on retry (me) - Cancel io-wq work if we fail getting mm reference (me) - Ensure dependent work is always initialized correctly (me) - Only allow original task to submit IO, don't allow it from a passed ring fd (me) * tag 'io_uring-5.5-2020-01-16' of git://git.kernel.dk/linux-block: io_uring: only allow submit from owning task io_uring: ensure workqueue offload grabs ring mutex for poll list io_uring: clear req->result always before issuing a read/write request io_uring: be consistent in assigning next work from handler io-wq: cancel work if we fail getting a mm reference io_uring: don't setup async context for read/write fixed commit effaf90137e3a9bb9702746f993f369a53c4185f Merge: ab7541c3addd b35cf1f0bf1f Author: Linus Torvalds Date: Fri Jan 17 11:21:05 2020 -0800 Merge tag 'for-5.5-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few more fixes that have been in the works during last twp weeks. All have a user visible effect and are stable material: - scrub: properly update progress after calling cancel ioctl, calling 'resume' would start from the beginning otherwise - fix subvolume reference removal, after moving out of the original path the reference is not recognized and will lead to transaction abort - fix reloc root lifetime checks, could lead to crashes when there's subvolume cleaning running in parallel - fix memory leak when quotas get disabled in the middle of extent accounting - fix transaction abort in case of balance being started on degraded mount on eg. RAID1" * tag 'for-5.5-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: check rw_devices, not num_devices for balance Btrfs: always copy scrub arguments back to user space btrfs: relocation: fix reloc_root lifespan and access btrfs: fix memory leak in qgroup accounting btrfs: do not delete mismatched root refs btrfs: fix invalid removal of root ref btrfs: rework arguments of btrfs_unlink_subvol commit 453495d4e791664e42be2254a6a8acb84b991417 Merge: 9c06ac4c83df 9715a43eea77 Author: Greg Kroah-Hartman Date: Fri Jan 17 19:40:06 2020 +0100 Merge tag 'usb-serial-5.5-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.5-rc7 Here are a few fixes for issues related to unbound port devices which could lead to NULL-pointer dereferences. Notably the bind attributes for usb-serial (port) drivers are removed as almost none of the drivers can handle individual ports going away once they've been bound. Included are also some new device ids. All but the unbound-port fixes have been in linux-next with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-5.5-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: quatech2: handle unbound ports USB: serial: keyspan: handle unbound ports USB: serial: io_edgeport: add missing active-port sanity check USB: serial: io_edgeport: handle unbound ports on URB completion USB: serial: ch341: handle unbound port at reset_resume USB: serial: suppress driver bind attributes USB: serial: option: add support for Quectel RM500Q in QDL mode USB: serial: opticon: fix control-message timeouts USB: serial: option: Add support for Quectel RM500Q USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx commit ab7541c3addd344939e76d0636da0048ce24f2db Merge: 07d5ac6a1254 7df1e988c723 Author: Linus Torvalds Date: Fri Jan 17 08:42:02 2020 -0800 Merge tag 'fuse-fixes-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fix from Miklos Szeredi: "Fix a regression in the last release affecting the ftp module of the gvfs filesystem" * tag 'fuse-fixes-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: fix fuse_send_readpages() in the syncronous read case commit 07d5ac6a12546fd23619ea60b211654efa55db86 Merge: 13b2668d6fc9 e5dbdcb31285 Author: Linus Torvalds Date: Fri Jan 17 08:38:35 2020 -0800 Merge tag 'sound-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This became bigger than I have hoped for rc7. But, the only large LOC is for stm32 fixes that are simple rewriting of register access helpers, while the rest are all nice and small fixes: - A few ASoC fixes for the remaining probe error handling bugs - ALSA sequencer core fix for racy proc file accesses - Revert the option rename of snd-hda-intel to make compatible again - Various device-specific fixes" * tag 'sound-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: seq: Fix racy access for queue timer in proc read ALSA: usb-audio: fix sync-ep altsetting sanity check ASoC: msm8916-wcd-digital: Reset RX interpolation path after use ASoC: msm8916-wcd-analog: Fix MIC BIAS Internal1 ASoC: cros_ec_codec: Make the device acpi compatible ASoC: sti: fix possible sleep-in-atomic ASoC: msm8916-wcd-analog: Fix selected events for MIC BIAS External1 ASoC: hdac_hda: Fix error in driver removal after failed probe ASoC: SOF: Intel: fix HDA codec driver probe with multiple controllers ASoC: SOF: Intel: lower print level to dbg if we will reinit DSP ALSA: dice: fix fallback from protocol extension into limited functionality ALSA: firewire-tascam: fix corruption due to spin lock without restoration in SoftIRQ context ALSA: hda: Rename back to dmic_detect option ASoC: stm32: dfsdm: fix 16 bits record ASoC: stm32: sai: fix possible circular locking ASoC: Fix NULL dereference at freeing ASoC: Intel: bytcht_es8316: Fix Irbis NB41 netbook quirk ASoC: rt5640: Fix NULL dereference on module unload commit 3bf8bdcf3bada771eb12b57f2a30caee69e8ab8d Author: Guenter Roeck Date: Thu Jan 16 10:44:17 2020 -0800 hwmon: (core) Do not use device managed functions for memory allocations The hwmon core uses device managed functions, tied to the hwmon parent device, for various internal memory allocations. This is problematic since hwmon device lifetime does not necessarily match its parent's device lifetime. If there is a mismatch, memory leaks will accumulate until the parent device is released. Fix the problem by managing all memory allocations internally. The only exception is memory allocation for thermal device registration, which can be tied to the hwmon device, along with thermal device registration itself. Fixes: d560168b5d0f ("hwmon: (core) New hwmon registration API") Cc: stable@vger.kernel.org # v4.14.x: 47c332deb8e8: hwmon: Deal with errors from the thermal subsystem Cc: stable@vger.kernel.org # v4.14.x: 74e3512731bd: hwmon: (core) Fix double-free in __hwmon_device_register() Cc: stable@vger.kernel.org # v4.9.x: 3a412d5e4a1c: hwmon: (core) Simplify sysfs attribute name allocation Cc: stable@vger.kernel.org # v4.9.x: 47c332deb8e8: hwmon: Deal with errors from the thermal subsystem Cc: stable@vger.kernel.org # v4.9.x: 74e3512731bd: hwmon: (core) Fix double-free in __hwmon_device_register() Cc: stable@vger.kernel.org # v4.9+ Cc: Martin K. Petersen Signed-off-by: Guenter Roeck commit cf3ca1877574a306c0207cbf7fdf25419d9229df Author: Luuk Paulussen Date: Fri Dec 6 12:16:59 2019 +1300 hwmon: (adt7475) Make volt2reg return same reg as reg2volt input reg2volt returns the voltage that matches a given register value. Converting this back the other way with volt2reg didn't return the same register value because it used truncation instead of rounding. This meant that values read from sysfs could not be written back to sysfs to set back the same register value. With this change, volt2reg will return the same value for every voltage previously returned by reg2volt (for the set of possible input values) Signed-off-by: Luuk Paulussen Link: https://lore.kernel.org/r/20191205231659.1301-1-luuk.paulussen@alliedtelesis.co.nz cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck commit e51a7dda299815e92f43960d620cdfc8dfc144f2 Author: Gilles Buloz Date: Fri Nov 29 10:56:05 2019 +0100 hwmon: (nct7802) Fix non-working alarm on voltages No alarm is reported by /sys/.../inX_alarm In detail: The SMI Voltage status register is the only register giving a status for voltages, but it does not work like the non-SMI status registers used for temperatures and fans. A bit is set for each input crossing a threshold, in both direction, but the "inside" or "outside" limits info is not available. Also this register is cleared on read. Note : this is not explicitly spelled out in the datasheet, but from experiment. As a result if an input is crossing a threshold (min or max in any direction), the alarm is reported only once even if the input is still outside limits. Also if the alarm for another input is read before the one of this input, no alarm is reported at all. Signed-off-by: Gilles Buloz Link: https://lore.kernel.org/r/5de0f566.tBga5POKAgHlmd0p%gilles.buloz@kontron.com Fixes: 3434f3783580 ("hwmon: Driver for Nuvoton NCT7802Y") Signed-off-by: Guenter Roeck commit 7713e62c8623c54dac88d1fa724aa487a38c3efb Author: Gilles Buloz Date: Wed Nov 27 18:09:34 2019 +0100 hwmon: (nct7802) Fix voltage limits to wrong registers in0 thresholds are written to the in2 thresholds registers in2 thresholds to in3 thresholds in3 thresholds to in4 thresholds in4 thresholds to in0 thresholds Signed-off-by: Gilles Buloz Link: https://lore.kernel.org/r/5de0f509.rc0oEvPOMjbfPW1w%gilles.buloz@kontron.com Fixes: 3434f3783580 ("hwmon: Driver for Nuvoton NCT7802Y") Signed-off-by: Guenter Roeck commit 9715a43eea77e42678a1002623f2d9a78f5b81a1 Author: Johan Hovold Date: Fri Jan 17 15:35:26 2020 +0100 USB: serial: quatech2: handle unbound ports Check for NULL port data in the modem- and line-status handlers to avoid dereferencing a NULL pointer in the unlikely case where a port device isn't bound to a driver (e.g. after an allocation failure on port probe). Note that the other (stubbed) event handlers qt2_process_xmit_empty() and qt2_process_flush() would need similar sanity checks in case they are ever implemented. Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver") Cc: stable # 3.5 Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 3018dd3fa114b13261e9599ddb5656ef97a1fa17 Author: Johan Hovold Date: Fri Jan 17 10:50:25 2020 +0100 USB: serial: keyspan: handle unbound ports Check for NULL port data in the control URB completion handlers to avoid dereferencing a NULL pointer in the unlikely case where a port device isn't bound to a driver (e.g. after an allocation failure on port probe()). Fixes: 0ca1268e109a ("USB Serial Keyspan: add support for USA-49WG & USA-28XG") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 1568c58d11a7c851bd09341aeefd6a1c308ac40d Author: Johan Hovold Date: Fri Jan 17 10:50:24 2020 +0100 USB: serial: io_edgeport: add missing active-port sanity check The driver receives the active port number from the device, but never made sure that the port number was valid. This could lead to a NULL-pointer dereference or memory corruption in case a device sends data for an invalid port. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit e37d1aeda737a20b1846a91a3da3f8b0f00cf690 Author: Johan Hovold Date: Fri Jan 17 10:50:23 2020 +0100 USB: serial: io_edgeport: handle unbound ports on URB completion Check for NULL port data in the shared interrupt and bulk completion callbacks to avoid dereferencing a NULL pointer in case a device sends data for a port device which isn't bound to a driver (e.g. due to a malicious device having unexpected endpoints or after an allocation failure on port probe). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 4d5ef53f75c22d28f490bcc5c771fcc610a9afa4 Author: Johan Hovold Date: Fri Jan 17 10:50:22 2020 +0100 USB: serial: ch341: handle unbound port at reset_resume Check for NULL port data in reset_resume() to avoid dereferencing a NULL pointer in case the port device isn't bound to a driver (e.g. after a failed control request at port probe). Fixes: 1ded7ea47b88 ("USB: ch341 serial: fix port number changed after resume") Cc: stable # 2.6.30 Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit b35cf1f0bf1f2b0b193093338414b9bd63b29015 Author: Josef Bacik Date: Fri Jan 10 11:11:24 2020 -0500 btrfs: check rw_devices, not num_devices for balance The fstest btrfs/154 reports [ 8675.381709] BTRFS: Transaction aborted (error -28) [ 8675.383302] WARNING: CPU: 1 PID: 31900 at fs/btrfs/block-group.c:2038 btrfs_create_pending_block_groups+0x1e0/0x1f0 [btrfs] [ 8675.390925] CPU: 1 PID: 31900 Comm: btrfs Not tainted 5.5.0-rc6-default+ #935 [ 8675.392780] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 [ 8675.395452] RIP: 0010:btrfs_create_pending_block_groups+0x1e0/0x1f0 [btrfs] [ 8675.402672] RSP: 0018:ffffb2090888fb00 EFLAGS: 00010286 [ 8675.404413] RAX: 0000000000000000 RBX: ffff92026dfa91c8 RCX: 0000000000000001 [ 8675.406609] RDX: 0000000000000000 RSI: ffffffff8e100899 RDI: ffffffff8e100971 [ 8675.408775] RBP: ffff920247c61660 R08: 0000000000000000 R09: 0000000000000000 [ 8675.410978] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffe4 [ 8675.412647] R13: ffff92026db74000 R14: ffff920247c616b8 R15: ffff92026dfbc000 [ 8675.413994] FS: 00007fd5e57248c0(0000) GS:ffff92027d800000(0000) knlGS:0000000000000000 [ 8675.416146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8675.417833] CR2: 0000564aa51682d8 CR3: 000000006dcbc004 CR4: 0000000000160ee0 [ 8675.419801] Call Trace: [ 8675.420742] btrfs_start_dirty_block_groups+0x355/0x480 [btrfs] [ 8675.422600] btrfs_commit_transaction+0xc8/0xaf0 [btrfs] [ 8675.424335] reset_balance_state+0x14a/0x190 [btrfs] [ 8675.425824] btrfs_balance.cold+0xe7/0x154 [btrfs] [ 8675.427313] ? kmem_cache_alloc_trace+0x235/0x2c0 [ 8675.428663] btrfs_ioctl_balance+0x298/0x350 [btrfs] [ 8675.430285] btrfs_ioctl+0x466/0x2550 [btrfs] [ 8675.431788] ? mem_cgroup_charge_statistics+0x51/0xf0 [ 8675.433487] ? mem_cgroup_commit_charge+0x56/0x400 [ 8675.435122] ? do_raw_spin_unlock+0x4b/0xc0 [ 8675.436618] ? _raw_spin_unlock+0x1f/0x30 [ 8675.438093] ? __handle_mm_fault+0x499/0x740 [ 8675.439619] ? do_vfs_ioctl+0x56e/0x770 [ 8675.441034] do_vfs_ioctl+0x56e/0x770 [ 8675.442411] ksys_ioctl+0x3a/0x70 [ 8675.443718] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 8675.445333] __x64_sys_ioctl+0x16/0x20 [ 8675.446705] do_syscall_64+0x50/0x210 [ 8675.448059] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 8675.479187] BTRFS: error (device vdb) in btrfs_create_pending_block_groups:2038: errno=-28 No space left We now use btrfs_can_overcommit() to see if we can flip a block group read only. Before this would fail because we weren't taking into account the usable un-allocated space for allocating chunks. With my patches we were allowed to do the balance, which is technically correct. The test is trying to start balance on degraded mount. So now we're trying to allocate a chunk and cannot because we want to allocate a RAID1 chunk, but there's only 1 device that's available for usage. This results in an ENOSPC. But we shouldn't even be making it this far, we don't have enough devices to restripe. The problem is we're using btrfs_num_devices(), that also includes missing devices. That's not actually what we want, we need to use rw_devices. The chunk_mutex is not needed here, rw_devices changes only in device add, remove or replace, all are excluded by EXCL_OP mechanism. Fixes: e4d8ec0f65b9 ("Btrfs: implement online profile changing") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba [ add stacktrace, update changelog, drop chunk_mutex ] Signed-off-by: David Sterba commit 5afe6ce748c1ea99e0d648153c05075e1ab93afb Author: Filipe Manana Date: Thu Jan 16 11:29:20 2020 +0000 Btrfs: always copy scrub arguments back to user space If scrub returns an error we are not copying back the scrub arguments structure to user space. This prevents user space to know how much progress scrub has done if an error happened - this includes -ECANCELED which is returned when users ask for scrub to stop. A particular use case, which is used in btrfs-progs, is to resume scrub after it is canceled, in that case it relies on checking the progress from the scrub arguments structure and then use that progress in a call to resume scrub. So fix this by always copying the scrub arguments structure to user space, overwriting the value returned to user space with -EFAULT only if copying the structure failed to let user space know that either that copying did not happen, and therefore the structure is stale, or it happened partially and the structure is probably not valid and corrupt due to the partial copy. Reported-by: Graham Cobb Link: https://lore.kernel.org/linux-btrfs/d0a97688-78be-08de-ca7d-bcb4c7fb397e@cobb.uk.net/ Fixes: 06fe39ab15a6a4 ("Btrfs: do not overwrite scrub error with fault error in scrub ioctl") CC: stable@vger.kernel.org # 5.1+ Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Tested-by: Graham Cobb Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 21bdee92c6f8a1609012c616a582001e09b3416d Merge: 33328bfab892 205608749e1e Author: Kalle Valo Date: Fri Jan 17 16:13:47 2020 +0200 Merge tag 'iwlwifi-for-kalle-2020-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes First batch of fixes intended for v5.5 * Don't send the PPAG command when PPAG is disabled, since it can cause problems; * A few fixes for a HW bug; * A fix for RS offload; * A fix for 3168 devices where the NVM tables where the wrong tables were being read. * Fix a couple of potential memory leaks in TXQ code; * Disable L0S states in all hardware since our hardware doesn't officially support them anymore (and older versions of the hardware had instability in these states); * Remove lar_disable parameter since it has been causing issues for some people who erroneously disable it; * Force the debug monitor HW to stop also when debug is disabled, since it sometimes stays on and prevents low system power states; commit 13b2668d6fc95dcecd11e4f86f47be24fda7da1f Merge: 5ffdff81cff9 a564ac35d605 Author: Linus Torvalds Date: Fri Jan 17 06:03:11 2020 -0800 Merge tag 'gpio-v5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "This reverts the GPIOLIB_IRQCHIP in the ThunderX driver. ThunderX is a piece of Arm-based server chip. I converted the driver to hierarchical gpiochip without access to real silicon and failed miserably since I didn't take MSI's into account. Kevin Hao helpfully stepped in and fixed it properly, let's revert it for v5.5 and put the proper conversion into v5.6" * tag 'gpio-v5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: Revert "gpio: thunderx: Switch to GPIOLIB_IRQCHIP" commit 5ffdff81cff9ae697b1d57fea9a86b6c6ede6078 Merge: 575966e08027 ad6bf88a6c19 Author: Linus Torvalds Date: Fri Jan 17 05:54:18 2020 -0800 Merge tag 'block-5.5-2020-01-16' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Three fixes that should go into this release: - The 32-bit segment size fix that I mentioned last week (Ming) - Use uint for the block size (Mikulas) - A null_blk zone write handling fix (Damien)" * tag 'block-5.5-2020-01-16' of git://git.kernel.dk/linux-block: block: fix an integer overflow in logical block size null_blk: Fix zone write handling block: fix get_max_segment_size() overflow on 32bit arch commit 5a9ef19454cd5daec8041bc7c3c11deb7456d9a0 Author: Florian Fainelli Date: Thu Jan 16 13:08:58 2020 -0800 net: systemport: Fixed queue mapping in internal ring map We would not be transmitting using the correct SYSTEMPORT transmit queue during ndo_select_queue() which looks up the internal TX ring map because while establishing the mapping we would be off by 4, so for instance, when we populate switch port mappings we would be doing: switch port 0, queue 0 -> ring index #0 switch port 0, queue 1 -> ring index #1 ... switch port 0, queue 3 -> ring index #3 switch port 1, queue 0 -> ring index #8 (4 + 4 * 1) ... instead of using ring index #4. This would cause our ndo_select_queue() to use the fallback queue mechanism which would pick up an incorrect ring for that switch port. Fix this by using the correct switch queue number instead of SYSTEMPORT queue number. Fixes: 25c440704661 ("net: systemport: Simplify queue mapping logic") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 8f1880cbe8d0d49ebb7e9ae409b3b96676e5aa97 Author: Florian Fainelli Date: Thu Jan 16 12:55:48 2020 -0800 net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec With the implementation of the system reset controller we lost a setting that is currently applied by the bootloader and which configures the IMP port for 2Gb/sec, the default is 1Gb/sec. This is needed given the number of ports and applications we expect to run so bring back that setting. Fixes: 01b0ac07589e ("net: dsa: bcm_sf2: Add support for optional reset controller line") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 27afe0d34e9121a3d61cc0af9b17c2542dadde24 Author: Vladimir Oltean Date: Thu Jan 16 20:43:27 2020 +0200 net: dsa: sja1105: Don't error out on disabled ports with no phy-mode The sja1105_parse_ports_node function was tested only on device trees where all ports were enabled. Fix this check so that the driver continues to probe only with the ports where status is not "disabled", as expected. Fixes: 8aa9ebccae87 ("net: dsa: Introduce driver for NXP SJA1105 5-port L2 switch") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 86ffe920e669ec73035e84553e18edf17d16317c Author: Michael Grzeschik Date: Thu Jan 16 14:16:31 2020 +0100 net: phy: dp83867: Set FORCE_LINK_GOOD to default after reset According to the Datasheet this bit should be 0 (Normal operation) in default. With the FORCE_LINK_GOOD bit set, it is not possible to get a link. This patch sets FORCE_LINK_GOOD to the default value after resetting the phy. Signed-off-by: Michael Grzeschik Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 2167f1625c2f04a33145f325db0de285630f7bd1 Author: Kan Liang Date: Thu Jan 16 12:02:10 2020 -0800 perf/x86/intel/uncore: Remove PCIe3 unit for SNR The PCIe Root Port driver for CPU Complex PCIe Root Ports are not loaded on SNR. The device ID for SNR PCIe3 unit is used by both uncore driver and the PCIe Root Port driver. If uncore driver is loaded, the PCIe Root Port driver never be probed. Remove the PCIe3 unit for SNR for now. The support for PCIe3 unit will be added later separately. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20200116200210.18937-2-kan.liang@linux.intel.com commit fa694ae532836bd2f4cd659e9b4032abaf9fa9e5 Author: Kan Liang Date: Thu Jan 16 12:02:09 2020 -0800 perf/x86/intel/uncore: Fix missing marker for snr_uncore_imc_freerunning_events An Oops during the boot is found on some SNR machines. It turns out this is because the snr_uncore_imc_freerunning_events[] array was missing an end-marker. Fixes: ee49532b38dd ("perf/x86/intel/uncore: Add IMC uncore support for Snow Ridge") Reported-by: Like Xu Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Tested-by: Like Xu Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20200116200210.18937-1-kan.liang@linux.intel.com commit e74383045119fb8055cf31cb39e0fe951d67163a Author: Kan Liang Date: Fri Jan 10 12:15:11 2020 -0800 perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family The IMC uncore support is missed for E3-1585 v5 CPU. Intel Xeon E3 V5 Family has Sky Lake CPU. Add the PCI ID of IMC for Intel Xeon E3 V5 Family. Reported-by: Rosales-fernandez, Carlos Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Tested-by: Rosales-fernandez, Carlos Link: https://lkml.kernel.org/r/1578687311-158748-1-git-send-email-kan.liang@linux.intel.com commit da9ec3d3dd0f1240a48920be063448a2242dbd90 Author: Mark Rutland Date: Mon Jan 6 12:03:39 2020 +0000 perf: Correctly handle failed perf_get_aux_event() Vince reports a worrying issue: | so I was tracking down some odd behavior in the perf_fuzzer which turns | out to be because perf_even_open() sometimes returns 0 (indicating a file | descriptor of 0) even though as far as I can tell stdin is still open. ... and further the cause: | error is triggered if aux_sample_size has non-zero value. | | seems to be this line in kernel/events/core.c: | | if (perf_need_aux_event(event) && !perf_get_aux_event(event, group_leader)) | goto err_locked; | | (note, err is never set) This seems to be a thinko in commit: ab43762ef010967e ("perf: Allow normal events to output AUX data") ... and we should probably return -EINVAL here, as this should only happen when the new event is mis-configured or does not have a compatible aux_event group leader. Fixes: ab43762ef010967e ("perf: Allow normal events to output AUX data") Reported-by: Vince Weaver Signed-off-by: Mark Rutland Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Alexander Shishkin Tested-by: Vince Weaver commit 49edd6a2c456150870ddcef5b7ed11b21d849e13 Author: Yonglong Liu Date: Thu Jan 16 15:41:17 2020 +0800 net: hns: fix soft lockup when there is not enough memory When there is not enough memory and napi_alloc_skb() return NULL, the HNS driver will print error message, and than try again, if the memory is not enough for a while, huge error message and the retry operation will cause soft lockup. When napi_alloc_skb() return NULL because of no memory, we can get a warn_alloc() call trace, so this patch deletes the error message. We already use polling mode to handle irq, but the retry operation will render the polling weight inactive, this patch just return budget when the rx is not completed to avoid dead loop. Fixes: 36eedfde1a36 ("net: hns: Optimize hns_nic_common_poll for better performance") Fixes: b5996f11ea54 ("net: add Hisilicon Network Subsystem basic ethernet support") Signed-off-by: Yonglong Liu Signed-off-by: David S. Miller commit fdb838efa31e1ed9a13ae6ad0b64e30fdbd00570 Author: Johan Hovold Date: Thu Jan 16 17:07:05 2020 +0100 USB: serial: suppress driver bind attributes USB-serial drivers must not be unbound from their ports before the corresponding USB driver is unbound from the parent interface so suppress the bind and unbind attributes. Unbinding a serial driver while it's port is open is a sure way to trigger a crash as any driver state is released on unbind while port hangup is handled on the parent USB interface level. Drivers for multiport devices where ports share a resource such as an interrupt endpoint also generally cannot handle individual ports going away. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 53d374979ef147ab51f5d632dfe20b14aebeccd0 Author: Cong Wang Date: Wed Jan 15 13:02:38 2020 -0800 net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key() syzbot reported some bogus lockdep warnings, for example bad unlock balance in sch_direct_xmit(). They are due to a race condition between slow path and fast path, that is qdisc_xmit_lock_key gets re-registered in netdev_update_lockdep_key() on slow path, while we could still acquire the queue->_xmit_lock on fast path in this small window: CPU A CPU B __netif_tx_lock(); lockdep_unregister_key(qdisc_xmit_lock_key); __netif_tx_unlock(); lockdep_register_key(qdisc_xmit_lock_key); In fact, unlike the addr_list_lock which has to be reordered when the master/slave device relationship changes, queue->_xmit_lock is only acquired on fast path and only when NETIF_F_LLTX is not set, so there is likely no nested locking for it. Therefore, we can just get rid of re-registration of qdisc_xmit_lock_key. Reported-by: syzbot+4ec99438ed7450da6272@syzkaller.appspotmail.com Fixes: ab92d68fc22f ("net: core: add generic lockdep keys") Cc: Taehee Yoo Signed-off-by: Cong Wang Acked-by: Taehee Yoo Signed-off-by: David S. Miller commit 44c23d71599f81a1c7fe8389e0319822dd50c37c Author: Eric Dumazet Date: Wed Jan 15 08:20:39 2020 -0800 net/sched: act_ife: initalize ife->metalist earlier It seems better to init ife->metalist earlier in tcf_ife_init() to avoid the following crash : kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 10483 Comm: syz-executor216 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:_tcf_ife_cleanup net/sched/act_ife.c:412 [inline] RIP: 0010:tcf_ife_cleanup+0x6e/0x400 net/sched/act_ife.c:431 Code: 48 c1 ea 03 80 3c 02 00 0f 85 94 03 00 00 49 8b bd f8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8d 67 e8 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5c 03 00 00 48 bb 00 00 00 00 00 fc ff df 48 8b RSP: 0018:ffffc90001dc6d00 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffffff864619c0 RCX: ffffffff815bfa09 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 RBP: ffffc90001dc6d50 R08: 0000000000000004 R09: fffff520003b8d8e R10: fffff520003b8d8d R11: 0000000000000003 R12: ffffffffffffffe8 R13: ffff8880a79fc000 R14: ffff88809aba0e00 R15: 0000000000000000 FS: 0000000001b51880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000563f52cce140 CR3: 0000000093541000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcf_action_cleanup+0x62/0x1b0 net/sched/act_api.c:119 __tcf_action_put+0xfa/0x130 net/sched/act_api.c:135 __tcf_idr_release net/sched/act_api.c:165 [inline] __tcf_idr_release+0x59/0xf0 net/sched/act_api.c:145 tcf_idr_release include/net/act_api.h:171 [inline] tcf_ife_init+0x97c/0x1870 net/sched/act_ife.c:616 tcf_action_init_1+0x6b6/0xa40 net/sched/act_api.c:944 tcf_action_init+0x21a/0x330 net/sched/act_api.c:1000 tcf_action_add+0xf5/0x3b0 net/sched/act_api.c:1410 tc_ctl_action+0x390/0x488 net/sched/act_api.c:1465 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5424 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x58c/0x7d0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:659 ____sys_sendmsg+0x753/0x880 net/socket.c:2330 ___sys_sendmsg+0x100/0x170 net/socket.c:2384 __sys_sendmsg+0x105/0x1d0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg net/socket.c:2424 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2424 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 11a94d7fd80f ("net/sched: act_ife: validate the control action inside init()") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Davide Caratti Reviewed-by: Davide Caratti Acked-by: Cong Wang Signed-off-by: David S. Miller commit a72b6a1ee4d9fde48ad5c308f492ca60df654f19 Merge: 93ad0f969fc7 61177e911dad Author: David S. Miller Date: Fri Jan 17 10:36:07 2020 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter updates for net The following patchset contains Netfilter fixes for net: 1) Fix use-after-free in ipset bitmap destroy path, from Cong Wang. 2) Missing init netns in entry cleanup path of arp_tables, from Florian Westphal. 3) Fix WARN_ON in set destroy path due to missing cleanup on transaction error. 4) Incorrect netlink sanity check in tunnel, from Florian Westphal. 5) Missing sanity check for erspan version netlink attribute, also from Florian. 6) Remove WARN in nft_request_module() that can be triggered from userspace, from Florian Westphal. 7) Memleak in NFTA_HOOK_DEVS netlink parser, from Dan Carpenter. 8) List poison from commit path for flowtables that are added and deleted in the same batch, from Florian Westphal. 9) Fix NAT ICMP packet corruption, from Eyal Birger. ==================== Signed-off-by: David S. Miller commit 39e7234f00bc93613c086ae42d852d5f4147120a Author: Waiman Long Date: Wed Jan 15 10:43:36 2020 -0500 locking/rwsem: Fix kernel crash when spinning on RWSEM_OWNER_UNKNOWN The commit 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") will allow a recently woken up waiting writer to spin on the owner. Unfortunately, if the owner happens to be RWSEM_OWNER_UNKNOWN, the code will incorrectly spin on it leading to a kernel crash. This is fixed by passing the proper non-spinnable bits to rwsem_spin_on_owner() so that RWSEM_OWNER_UNKNOWN will be treated as a non-spinnable target. Fixes: 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") Reported-by: Christoph Hellwig Signed-off-by: Waiman Long Signed-off-by: Peter Zijlstra (Intel) Tested-by: Christoph Hellwig Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20200115154336.8679-1-longman@redhat.com commit 319d5cce728cd70897a1306591a252258fc1428d Merge: b3a987b0264d 9608ea6c6613 Author: Linus Walleij Date: Fri Jan 17 09:07:26 2020 +0100 Merge tag 'intel-pinctrl-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into fixes intel-pinctrl for v5.5-3 * Fix Interrupt Status register offset for Intel Sunrisepoint PCH-H. The following is an automated git shortlog grouped by driver: sunrisepoint: - Add missing Interrupt Status register offset commit 44d282796f81eb1debc1d7cb53245b4cb3214cb5 Author: Jens Axboe Date: Thu Jan 16 19:00:24 2020 -0700 io_uring: only allow submit from owning task If the credentials or the mm doesn't match, don't allow the task to submit anything on behalf of this ring. The task that owns the ring can pass the file descriptor to another task, but we don't want to allow that task to submit an SQE that then assumes the ring mm and creds if it needs to go async. Cc: stable@vger.kernel.org Suggested-by: Stefan Metzmacher Signed-off-by: Jens Axboe commit ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 Author: Johan Hovold Date: Mon Jan 13 10:38:57 2020 -0800 Input: keyspan-remote - fix control-message timeouts The driver was issuing synchronous uninterruptible control requests without using a timeout. This could lead to the driver hanging on probe due to a malfunctioning (or malicious) device until the device is physically disconnected. While sleeping in probe the driver prevents other devices connected to the same hub from being added to (or removed from) the bus. The USB upper limit of five seconds per request should be more than enough. Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote") Signed-off-by: Johan Hovold Reviewed-by: Greg Kroah-Hartman Cc: stable # 2.6.13 Link: https://lore.kernel.org/r/20200113171715.30621-1-johan@kernel.org Signed-off-by: Dmitry Torokhov commit ce535a2efb48d8d4c4e4b97e2764d7cee73d9b55 Author: Bartosz Golaszewski Date: Fri Jan 10 10:22:12 2020 -0800 Input: max77650-onkey - add of_match table We need the of_match table if we want to use the compatible string in the pmic's child node and get the onkey driver loaded automatically. Signed-off-by: Bartosz Golaszewski Signed-off-by: Dmitry Torokhov commit c15f8ba6dc1f6a8330cd89374a21388a5d91f92c Author: Hans Verkuil Date: Thu Jan 16 20:12:53 2020 -0800 Input: rmi_f54 - read from FIFO in 32 byte blocks The F54 Report Data is apparently read through a fifo and for the smbus protocol that means that between reading a block of 32 bytes the rmiaddr shouldn't be incremented. However, changing that causes other non-fifo reads to fail and so that change was reverted. This patch changes just the F54 function and it now reads 32 bytes at a time from the fifo, using the F54_FIFO_OFFSET to update the start address that is used when reading from the fifo. This has only been tested with smbus, not with i2c or spi. But I suspect that the same is needed there since I think similar problems will occur there when reading more than 256 bytes. Signed-off-by: Hans Verkuil Tested-by: Hans Verkuil Reported-by: Timo Kaufmann Link: https://lore.kernel.org/r/20200115124819.3191024-3-hverkuil-cisco@xs4all.nl Signed-off-by: Dmitry Torokhov commit 8ff771f8c8d55d95f102cf88a970e541a8bd6bcf Author: Hans Verkuil Date: Thu Jan 16 20:12:27 2020 -0800 Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers" This reverts commit a284e11c371e446371675668d8c8120a27227339. This causes problems (drifting cursor) with at least the F11 function that reads more than 32 bytes. The real issue is in the F54 driver, and so this should be fixed there, and not in rmi_smbus.c. So first revert this bad commit, then fix the real problem in F54 in another patch. Signed-off-by: Hans Verkuil Reported-by: Timo Kaufmann Fixes: a284e11c371e ("Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200115124819.3191024-2-hverkuil-cisco@xs4all.nl Signed-off-by: Dmitry Torokhov commit 575966e080270b7574175da35f7f7dd5ecd89ff4 Merge: ef64753c1922 70db729fe1b3 Author: Linus Torvalds Date: Thu Jan 16 19:42:08 2020 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Olof Johansson: "I've been sitting on these longer than I meant, so the patch count is a bit higher than ideal for this part of the release. There's also some reverts of double-applied patches that brings the diffstat up a bit. With that said, the biggest changes are: - Revert of duplicate i2c device addition on two Aspeed (BMC) Devicetrees. - Move of two device nodes that got applied to the wrong part of the tree on ASpeed G6. - Regulator fix for Beaglebone X15 (adding 12/5V supplies) - Use interrupts for keys on Amlogic SM1 to avoid missed polls In addition to that, there is a collection of smaller DT fixes: - Power supply assignment fixes for i.MX6 - Fix of interrupt line for magnetometer on i.MX8 Librem5 devkit - Build fixlets (selects) for davinci/omap2+ - More interrupt number fixes for Stratix10, Amlogic SM1, etc. - ... and more similar fixes across different platforms And some non-DT stuff: - optee fix to register multiple shared pages properly - Clock calculation fixes for MMP3 - Clock fixes for OMAP as well" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (42 commits) MAINTAINERS: Add myself as the co-maintainer for Actions Semi platforms ARM: dts: imx7: Fix Toradex Colibri iMX7S 256MB NAND flash support ARM: dts: imx6sll-evk: Remove incorrect power supply assignment ARM: dts: imx6sl-evk: Remove incorrect power supply assignment ARM: dts: imx6sx-sdb: Remove incorrect power supply assignment ARM: dts: imx6qdl-sabresd: Remove incorrect power supply assignment ARM: dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL ARM: omap2plus: select RESET_CONTROLLER ARM: davinci: select CONFIG_RESET_CONTROLLER ARM: dts: aspeed: rainier: Fix fan fault and presence ARM: dts: aspeed: rainier: Remove duplicate i2c busses ARM: dts: aspeed: tacoma: Remove duplicate flash nodes ARM: dts: aspeed: tacoma: Remove duplicate i2c busses ARM: dts: aspeed: tacoma: Fix fsi master node ARM: dts: aspeed-g6: Fix FSI master location ARM: dts: mmp3: Fix the TWSI ranges clk: mmp2: Fix the order of timer mux parents ARM: mmp: do not divide the clock rate arm64: dts: rockchip: Fix IR on Beelink A1 optee: Fix multi page dynamic shm pool alloc ... commit ef64753c1922511e7d81947a8d27e72925a05e2c Merge: f4353c3e2aaf a0af27424734 Author: Linus Torvalds Date: Thu Jan 16 19:25:11 2020 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Second collection of clk fixes for the next release. This one includes a fix for PM on TI SoCs with sysc devices and fixes a bunch of clks that are stuck always enabled on Qualcomm SDM845 SoCs. Allwinner SoCs get the usual set of fixes too, mostly correcting drivers to have the right bits that match the hardware. There's also a Samsung and Tegra fix in here to mark a clk critical and avoid a double free. And finally there's a fix for critical clks that silences a big warning splat about trying to enable a clk that couldn't even be prepared" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: ti: dra7-atl: Remove pm_runtime_irq_safe() clk: qcom: gcc-sdm845: Add missing flag to votable GDSCs clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order clk: sunxi-ng: h6-r: Simplify R_APB1 clock definition clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock clk: Don't try to enable critical clocks if prepare failed clk: tegra: Fix double-free in tegra_clk_init() clk: samsung: exynos5420: Keep top G3D clocks enabled clk: sunxi-ng: r40: Allow setting parent rate for external clock outputs clk: sunxi-ng: v3s: Fix incorrect number of hw_clks. commit f4353c3e2aaf7f7d3c5a18271b368bf5292854c3 Merge: 0c99ee44b892 57388a2ccb6c Author: Linus Torvalds Date: Thu Jan 16 15:55:30 2020 -0800 Merge tag 'pm-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a coding mistake in the teo cpuidle governor causing data to be written beyond the last array element (Ikjoon Jang)" * tag 'pm-5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle: teo: Fix intervals[] array indexing bug commit 70db729fe1b30af89e798d16c1045846753e5448 Author: Manivannan Sadhasivam Date: Tue Jan 14 14:13:47 2020 +0530 MAINTAINERS: Add myself as the co-maintainer for Actions Semi platforms Since I've been doing the maintainership work for couple of cycles, we've decided to add myself as the co-maintainer along with Andreas. Link: https://lore.kernel.org/r/20200114084348.25659-2-manivannan.sadhasivam@linaro.org Cc: "Andreas Färber" Signed-off-by: Manivannan Sadhasivam Acked-by: Andreas Färber Signed-off-by: Olof Johansson commit 18451f9f9e5810b8bd1245c5ae166f257e0e2b9d Author: Alexander Potapenko Date: Thu Jan 16 12:09:34 2020 +0100 PM: hibernate: fix crashes with init_on_free=1 Upon resuming from hibernation, free pages may contain stale data from the kernel that initiated the resume. This breaks the invariant inflicted by init_on_free=1 that freed pages must be zeroed. To deal with this problem, make clear_free_pages() also clear the free pages when init_on_free is enabled. Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") Reported-by: Johannes Stezenbach Signed-off-by: Alexander Potapenko Cc: 5.3+ # 5.3+ Signed-off-by: Rafael J. Wysocki commit a006483b2f97af685f0e60f3a547c9ad4c9b9e94 Author: Tom Lendacky Date: Wed Jan 15 16:05:16 2020 -0600 x86/CPU/AMD: Ensure clearing of SME/SEV features is maintained If the SME and SEV features are present via CPUID, but memory encryption support is not enabled (MSR 0xC001_0010[23]), the feature flags are cleared using clear_cpu_cap(). However, if get_cpu_cap() is later called, these feature flags will be reset back to present, which is not desired. Change from using clear_cpu_cap() to setup_clear_cpu_cap() so that the clearing of the flags is maintained. Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov Cc: # 4.16.x- Link: https://lkml.kernel.org/r/226de90a703c3c0be5a49565047905ac4e94e8f3.1579125915.git.thomas.lendacky@amd.com commit 0c99ee44b8921b872089a7374c733310d995fd92 Merge: f5ae2ea6347a dfb9a8857f4d Author: Linus Torvalds Date: Thu Jan 16 10:26:40 2020 -0800 Merge tag 'tag-chrome-platform-fixes-for-v5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform fix from Benson Leung: "One fix in the wilco_ec keyboard backlight driver to allow the EC driver to continue loading in the absence of a backlight module" * tag 'tag-chrome-platform-fixes-for-v5.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: wilco_ec: Fix keyboard backlight probing commit f3eaabbfd093c93d791eb930cc68d9b15246a65e Author: Reinhard Speyerer Date: Tue Jan 14 14:29:23 2020 +0100 USB: serial: option: add support for Quectel RM500Q in QDL mode Add support for Quectel RM500Q in QDL mode. T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 24 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0800 Rev= 0.00 S: Manufacturer=Qualcomm CDMA Technologies MSM S: Product=QUSB_BULK_SN:xxxxxxxx S: SerialNumber=xxxxxxxx C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr= 2mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=10 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms It is assumed that the ZLP flag required for other Qualcomm-based 5G devices also applies to Quectel RM500Q. Signed-off-by: Reinhard Speyerer Cc: stable Signed-off-by: Johan Hovold commit 394440d469413fa9b74f88a11f144d76017221f2 Author: Jeff Mahoney Date: Wed Jan 15 13:00:59 2020 -0500 reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr Commit 60e4cf67a58 (reiserfs: fix extended attributes on the root directory) introduced a regression open_xa_root started returning -EOPNOTSUPP but it was not handled properly in reiserfs_for_each_xattr. When the reiserfs module is built without CONFIG_REISERFS_FS_XATTR, deleting an inode would result in a warning and chowning an inode would also result in a warning and then fail to complete. With CONFIG_REISERFS_FS_XATTR enabled, the xattr root would always be present for read-write operations. This commit handles -EOPNOSUPP in the same way -ENODATA is handled. Fixes: 60e4cf67a582 ("reiserfs: fix extended attributes on the root directory") CC: stable@vger.kernel.org # Commit 60e4cf67a58 was picked up by stable Link: https://lore.kernel.org/r/20200115180059.6935-1-jeffm@suse.com Reported-by: Michael Brunnbauer Signed-off-by: Jeff Mahoney Signed-off-by: Jan Kara commit f571389c0b015e76f91c697c4c1700aba860d34f Author: Michał Mirosław Date: Tue Jan 7 10:47:34 2020 +0100 mmc: tegra: fix SDR50 tuning override Commit 7ad2ed1dfcbe inadvertently mixed up a quirk flag's name and broke SDR50 tuning override. Use correct NVQUIRK_ name. Fixes: 7ad2ed1dfcbe ("mmc: tegra: enable UHS-I modes") Cc: Acked-by: Adrian Hunter Reviewed-by: Thierry Reding Tested-by: Thierry Reding Signed-off-by: Michał Mirosław Link: https://lore.kernel.org/r/9aff1d859935e59edd81e4939e40d6c55e0b55f6.1578390388.git.mirq-linux@rere.qmqm.pl Signed-off-by: Ulf Hansson commit 61177e911dad660df86a4553eb01c95ece2f6a82 Author: Eyal Birger Date: Tue Jan 14 10:03:50 2020 +0200 netfilter: nat: fix ICMP header corruption on ICMP errors Commit 8303b7e8f018 ("netfilter: nat: fix spurious connection timeouts") made nf_nat_icmp_reply_translation() use icmp_manip_pkt() as the l4 manipulation function for the outer packet on ICMP errors. However, icmp_manip_pkt() assumes the packet has an 'id' field which is not correct for all types of ICMP messages. This is not correct for ICMP error packets, and leads to bogus bytes being written the ICMP header, which can be wrongfully regarded as 'length' bytes by RFC 4884 compliant receivers. Fix by assigning the 'id' field only for ICMP messages that have this semantic. Reported-by: Shmulik Ladkani Fixes: 8303b7e8f018 ("netfilter: nat: fix spurious connection timeouts") Signed-off-by: Eyal Birger Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 93ad0f969fc704959636846fc7f8d1aaf57f523e Author: Madhuparna Bhowmik Date: Wed Jan 15 17:11:01 2020 +0530 net: wan: lapbether.c: Use built-in RCU list checking The only callers of the function lapbeth_get_x25_dev() are lapbeth_rcv() and lapbeth_device_event(). lapbeth_rcv() uses rcu_read_lock() whereas lapbeth_device_event() is called with RTNL held (As mentioned in the comments). Therefore, pass lockdep_rtnl_is_held() as cond argument in list_for_each_entry_rcu(); Signed-off-by: Madhuparna Bhowmik Signed-off-by: David S. Miller commit 335178d5429c4cee61b58f4ac80688f556630818 Author: Florian Westphal Date: Thu Jan 16 12:03:01 2020 +0100 netfilter: nf_tables: fix flowtable list del corruption syzbot reported following crash: list_del corruption, ffff88808c9bb000->prev is LIST_POISON2 (dead000000000122) [..] Call Trace: __list_del_entry include/linux/list.h:131 [inline] list_del_rcu include/linux/rculist.h:148 [inline] nf_tables_commit+0x1068/0x3b30 net/netfilter/nf_tables_api.c:7183 [..] The commit transaction list has: NFT_MSG_NEWTABLE NFT_MSG_NEWFLOWTABLE NFT_MSG_DELFLOWTABLE NFT_MSG_DELTABLE A missing generation check during DELTABLE processing causes it to queue the DELFLOWTABLE operation a second time, so we corrupt the list here: case NFT_MSG_DELFLOWTABLE: list_del_rcu(&nft_trans_flowtable(trans)->list); nf_tables_flowtable_notify(&trans->ctx, because we have two different DELFLOWTABLE transactions for the same flowtable. We then call list_del_rcu() twice for the same flowtable->list. The object handling seems to suffer from the same bug so add a generation check too and only queue delete transactions for flowtables/objects that are still active in the next generation. Reported-by: syzbot+37a6804945a3a13b1572@syzkaller.appspotmail.com Fixes: 3b49e2e94e6eb ("netfilter: nf_tables: add flow table netlink frontend") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit cd77e75b5e4632d05d61fec5383052713c8ede2b Author: Dan Carpenter Date: Thu Jan 16 13:09:31 2020 +0300 netfilter: nf_tables: fix memory leak in nf_tables_parse_netdev_hooks() Syzbot detected a leak in nf_tables_parse_netdev_hooks(). If the hook already exists, then the error handling doesn't free the newest "hook". Reported-by: syzbot+f9d4095107fc8749c69c@syzkaller.appspotmail.com Fixes: b75a3e8371bc ("netfilter: nf_tables: allow netdevice to be used only once per flowtable") Signed-off-by: Dan Carpenter Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9332d27d7918182add34e8043f6a754530fdd022 Author: Florian Westphal Date: Thu Jan 16 09:06:50 2020 +0100 netfilter: nf_tables: remove WARN and add NLA_STRING upper limits This WARN can trigger because some of the names fed to the module autoload function can be of arbitrary length. Remove the WARN and add limits for all NLA_STRING attributes. Reported-by: syzbot+0e63ae76d117ae1c3a01@syzkaller.appspotmail.com Fixes: 452238e8d5ffd8 ("netfilter: nf_tables: add and use helper for module autoload") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9ec22d7c6c69146180577f3ad5fdf504beeaee62 Author: Florian Westphal Date: Thu Jan 16 08:58:05 2020 +0100 netfilter: nft_tunnel: ERSPAN_VERSION must not be null Fixes: af308b94a2a4a5 ("netfilter: nf_tables: add tunnel support") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 1c702bf902bd37349f6d91cd7f4b372b1e46d0ed Author: Florian Westphal Date: Thu Jan 16 08:44:11 2020 +0100 netfilter: nft_tunnel: fix null-attribute check else we get null deref when one of the attributes is missing, both must be non-null. Reported-by: syzbot+76d0b80493ac881ff77b@syzkaller.appspotmail.com Fixes: aaecfdb5c5dd8ba ("netfilter: nf_tables: match on tunnel metadata") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit ec7470b834fe7b5d7eff11b6677f5d7fdf5e9a91 Author: Pablo Neira Ayuso Date: Mon Jan 13 18:09:58 2020 +0100 netfilter: nf_tables: store transaction list locally while requesting module This patch fixes a WARN_ON in nft_set_destroy() due to missing set reference count drop from the preparation phase. This is triggered by the module autoload path. Do not exercise the abort path from nft_request_module() while preparation phase cleaning up is still pending. WARNING: CPU: 3 PID: 3456 at net/netfilter/nf_tables_api.c:3740 nft_set_destroy+0x45/0x50 [nf_tables] [...] CPU: 3 PID: 3456 Comm: nft Not tainted 5.4.6-arch3-1 #1 RIP: 0010:nft_set_destroy+0x45/0x50 [nf_tables] Code: e8 30 eb 83 c6 48 8b 85 80 00 00 00 48 8b b8 90 00 00 00 e8 dd 6b d7 c5 48 8b 7d 30 e8 24 dd eb c5 48 89 ef 5d e9 6b c6 e5 c5 <0f> 0b c3 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8b 7f 10 e9 52 RSP: 0018:ffffac4f43e53700 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff99d63a154d80 RCX: 0000000001f88e03 RDX: 0000000001f88c03 RSI: ffff99d6560ef0c0 RDI: ffff99d63a101200 RBP: ffff99d617721de0 R08: 0000000000000000 R09: 0000000000000318 R10: 00000000f0000000 R11: 0000000000000001 R12: ffffffff880fabf0 R13: dead000000000122 R14: dead000000000100 R15: ffff99d63a154d80 FS: 00007ff3dbd5b740(0000) GS:ffff99d6560c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00001cb5de6a9000 CR3: 000000016eb6a004 CR4: 00000000001606e0 Call Trace: __nf_tables_abort+0x3e3/0x6d0 [nf_tables] nft_request_module+0x6f/0x110 [nf_tables] nft_expr_type_request_module+0x28/0x50 [nf_tables] nf_tables_expr_parse+0x198/0x1f0 [nf_tables] nft_expr_init+0x3b/0xf0 [nf_tables] nft_dynset_init+0x1e2/0x410 [nf_tables] nf_tables_newrule+0x30a/0x930 [nf_tables] nfnetlink_rcv_batch+0x2a0/0x640 [nfnetlink] nfnetlink_rcv+0x125/0x171 [nfnetlink] netlink_unicast+0x179/0x210 netlink_sendmsg+0x208/0x3d0 sock_sendmsg+0x5e/0x60 ____sys_sendmsg+0x21b/0x290 Update comment on the code to describe the new behaviour. Reported-by: Marco Oliverio Fixes: 452238e8d5ff ("netfilter: nf_tables: add and use helper for module autoload") Signed-off-by: Pablo Neira Ayuso commit e5dbdcb31285a975d623d2bf2c9e7b2940489008 Merge: 60adcfde92fa 85578bbd642f Author: Takashi Iwai Date: Thu Jan 16 14:14:26 2020 +0100 Merge tag 'asoc-fix-v5.5-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.5 This is mostly driver specific fixes, plus an error handling fix in the core. There is a rather large diffstat for the stm32 SAI driver, this is a very large but mostly mechanical update which wraps every register access in the driver to allow a fix to the locking which avoids circular locks, the active change is much smaller and more reasonably sized. commit bd5874da57edd001b35cf28ae737779498c16a56 Author: Alexander Lobakin Date: Wed Jan 15 11:56:52 2020 +0300 net: dsa: tag_qca: fix doubled Tx statistics DSA subsystem takes care of netdev statistics since commit 4ed70ce9f01c ("net: dsa: Refactor transmit path to eliminate duplication"), so any accounting inside tagger callbacks is redundant and can lead to messing up the stats. This bug is present in Qualcomm tagger since day 0. Fixes: cafdc45c949b ("net-next: dsa: add Qualcomm tag RX/TX handler") Reviewed-by: Andrew Lunn Signed-off-by: Alexander Lobakin Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit ad32205470919c8e04cdd33e0613bdba50c2376d Author: Alexander Lobakin Date: Wed Jan 15 11:54:38 2020 +0300 net: dsa: tag_gswip: fix typo in tagger name The correct name is GSWIP (Gigabit Switch IP). Typo was introduced in 875138f81d71a ("dsa: Move tagger name into its ops structure") while moving tagger names to their structures. Fixes: 875138f81d71a ("dsa: Move tagger name into its ops structure") Reviewed-by: Andrew Lunn Signed-off-by: Alexander Lobakin Reviewed-by: Florian Fainelli Acked-by: Hauke Mehrtens Signed-off-by: David S. Miller commit 82d5d6a638cbd12b7dfe8acafd9efd87a656cc06 Author: Kunihiko Hayashi Date: Wed Jan 15 13:02:42 2020 +0900 net: ethernet: ave: Avoid lockdep warning When building with PROVE_LOCKING=y, lockdep shows the following dump message. INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. ... Calling device_set_wakeup_enable() directly occurs this issue, and it isn't necessary for initialization, so this patch creates internal function __ave_ethtool_set_wol() and replaces with this in ave_init() and ave_resume(). Fixes: 7200f2e3c9e2 ("net: ethernet: ave: Set initial wol state to disabled") Signed-off-by: Kunihiko Hayashi Signed-off-by: David S. Miller commit 36c67349a1a1c88b9cf11d7ca7762ababdb38867 Author: Yunsheng Lin Date: Wed Jan 15 10:46:45 2020 +0800 net: hns3: pad the short frame before sending to the hardware The hardware can not handle short frames below or equal to 32 bytes according to the hardware user manual, and it will trigger a RAS error when the frame's length is below 33 bytes. This patch pads the SKB when skb->len is below 33 bytes before sending it to hardware. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Yunsheng Lin Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 1712b2fff8c682d145c7889d2290696647d82dab Author: Eric Dumazet Date: Tue Jan 14 13:00:35 2020 -0800 macvlan: use skb_reset_mac_header() in macvlan_queue_xmit() I missed the fact that macvlan_broadcast() can be used both in RX and TX. skb_eth_hdr() makes only sense in TX paths, so we can not use it blindly in macvlan_broadcast() Fixes: 96cc4b69581d ("macvlan: do not assume mac_header is set in macvlan_broadcast()") Signed-off-by: Eric Dumazet Reported-by: Jurgen Van Ham Tested-by: Matteo Croce Signed-off-by: David S. Miller commit 27f4e1e9425e1e98d8e1b690edf06b56cd018bef Author: Faiz Abbas Date: Wed Jan 8 20:03:01 2020 +0530 mmc: sdhci_am654: Fix Command Queuing in AM65x Command Queuing was enabled completely for J721e controllers which lead to partial enablement even for Am65x. Complete CQ implementation for AM65x by adding the irq callback. Fixes: f545702b74f9 ("mmc: sdhci_am654: Add Support for Command Queuing Engine to J721E") Cc: stable@vger.kernel.org Signed-off-by: Faiz Abbas Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20200108143301.1929-4-faiz_abbas@ti.com Signed-off-by: Ulf Hansson commit de31f6ab68a3f548d88686d53514f252d78f61d5 Author: Faiz Abbas Date: Wed Jan 8 20:03:00 2020 +0530 mmc: sdhci_am654: Reset Command and Data line after tuning The tuning data is leftover in the buffer after tuning. This can cause issues in future data commands, especially with CQHCI. Reset the command and data lines after tuning to continue from a clean state. Fixes: 41fd4caeb00b ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver") Cc: stable@vger.kernel.org Signed-off-by: Faiz Abbas Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20200108143301.1929-3-faiz_abbas@ti.com Signed-off-by: Ulf Hansson commit 4d627c88546a697b07565dbb70d2f9f46a5ee76f Author: Faiz Abbas Date: Wed Jan 8 20:02:59 2020 +0530 mmc: sdhci_am654: Remove Inverted Write Protect flag The MMC/SD controllers on am65x and j721e don't in fact detect the write protect line as inverted. No issues were detected because of this because the sdwp line is not connected on any of the evms. Fix this by removing the flag. Fixes: 1accbced1c32 ("mmc: sdhci_am654: Add Support for 4 bit IP on J721E") Cc: stable@vger.kernel.org Signed-off-by: Faiz Abbas Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20200108143301.1929-2-faiz_abbas@ti.com Signed-off-by: Ulf Hansson commit 7df1e988c723a066754090b22d047c3225342152 Author: Miklos Szeredi Date: Thu Jan 16 11:09:36 2020 +0100 fuse: fix fuse_send_readpages() in the syncronous read case Buffered read in fuse normally goes via: -> generic_file_buffered_read() -> fuse_readpages() -> fuse_send_readpages() ->fuse_simple_request() [called since v5.4] In the case of a read request, fuse_simple_request() will return a non-negative bytecount on success or a negative error value. A positive bytecount was taken to be an error and the PG_error flag set on the page. This resulted in generic_file_buffered_read() falling back to ->readpage(), which would repeat the read request and succeed. Because of the repeated read succeeding the bug was not detected with regression tests or other use cases. The FTP module in GVFS however fails the second read due to the non-seekable nature of FTP downloads. Fix by checking and ignoring positive return value from fuse_simple_request(). Reported-by: Ondrej Holy Link: https://gitlab.gnome.org/GNOME/gvfs/issues/441 Fixes: 134831e36bbd ("fuse: convert readpages to simple api") Cc: # v5.4 Signed-off-by: Miklos Szeredi commit 3981f955eb27fd4f52b8cef198091530811229f2 Merge: 567110f147b3 85ddd9c31731 Author: David S. Miller Date: Thu Jan 16 10:04:40 2020 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2020-01-15 The following pull-request contains BPF updates for your *net* tree. We've added 12 non-merge commits during the last 9 day(s) which contain a total of 13 files changed, 95 insertions(+), 43 deletions(-). The main changes are: 1) Fix refcount leak for TCP time wait and request sockets for socket lookup related BPF helpers, from Lorenz Bauer. 2) Fix wrong verification of ARSH instruction under ALU32, from Daniel Borkmann. 3) Batch of several sockmap and related TLS fixes found while operating more complex BPF programs with Cilium and OpenSSL, from John Fastabend. 4) Fix sockmap to read psock's ingress_msg queue before regular sk_receive_queue() to avoid purging data upon teardown, from Lingpeng Chen. 5) Fix printing incorrect pointer in bpftool's btf_dump_ptr() in order to properly dump a BPF map's value with BTF, from Martin KaFai Lau. ==================== Signed-off-by: David S. Miller commit 11ba820bf163e224bf5dd44e545a66a44a5b1d7a Author: Jens Axboe Date: Wed Jan 15 21:51:17 2020 -0700 io_uring: ensure workqueue offload grabs ring mutex for poll list A previous commit moved the locking for the async sqthread, but didn't take into account that the io-wq workers still need it. We can't use req->in_async for this anymore as both the sqthread and io-wq workers set it, gate the need for locking on io_wq_current_is_worker() instead. Fixes: 8a4955ff1cca ("io_uring: sqthread should grab ctx->uring_lock for submissions") Reported-by: Bijan Mottahedeh Signed-off-by: Jens Axboe commit ad6bf88a6c19a39fb3b0045d78ea880325dfcf15 Author: Mikulas Patocka Date: Wed Jan 15 08:35:25 2020 -0500 block: fix an integer overflow in logical block size Logical block size has type unsigned short. That means that it can be at most 32768. However, there are architectures that can run with 64k pages (for example arm64) and on these architectures, it may be possible to create block devices with 64k block size. For exmaple (run this on an architecture with 64k pages): Mount will fail with this error because it tries to read the superblock using 2-sector access: device-mapper: writecache: I/O is not aligned, sector 2, size 1024, block size 65536 EXT4-fs (dm-0): unable to read superblock This patch changes the logical block size from unsigned short to unsigned int to avoid the overflow. Cc: stable@vger.kernel.org Reviewed-by: Martin K. Petersen Reviewed-by: Ming Lei Signed-off-by: Mikulas Patocka Signed-off-by: Jens Axboe commit 797f3f535d59f05ad12c629338beef6cb801d19e Author: Bijan Mottahedeh Date: Wed Jan 15 18:37:45 2020 -0800 io_uring: clear req->result always before issuing a read/write request req->result is cleared when io_issue_sqe() calls io_read/write_pre() routines. Those routines however are not called when the sqe argument is NULL, which is the case when io_issue_sqe() is called from io_wq_submit_work(). io_issue_sqe() may then examine a stale result if a polled request had previously failed with -EAGAIN: if (ctx->flags & IORING_SETUP_IOPOLL) { if (req->result == -EAGAIN) return -EAGAIN; io_iopoll_req_issued(req); } and in turn cause a subsequently completed request to be re-issued in io_wq_submit_work(). Signed-off-by: Bijan Mottahedeh Signed-off-by: Jens Axboe commit 28d76df18f0ad5bcf5fa48510b225f0ed262a99b Author: Dan Carpenter Date: Tue Jan 14 15:34:14 2020 +0300 scsi: mptfusion: Fix double fetch bug in ioctl Tom Hatskevich reported that we look up "iocp" then, in the called functions we do a second copy_from_user() and look it up again. The problem that could cause is: drivers/message/fusion/mptctl.c 674 /* All of these commands require an interrupt or 675 * are unknown/illegal. 676 */ 677 if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0) ^^^^ We take this lock. 678 return ret; 679 680 if (cmd == MPTFWDOWNLOAD) 681 ret = mptctl_fw_download(arg); ^^^ Then the user memory changes and we look up "iocp" again but a different one so now we are holding the incorrect lock and have a race condition. 682 else if (cmd == MPTCOMMAND) 683 ret = mptctl_mpt_command(arg); The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power. But it's still worth fixing. This patch passes the "iocp" pointer to the functions to avoid the second lookup. That deletes 100 lines of code from the driver so it's a nice clean up as well. Link: https://lore.kernel.org/r/20200114123414.GA7957@kadam Reported-by: Tom Hatskevich Reviewed-by: Greg Kroah-Hartman Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit 7b571c19d4c0b78d27dd3bf1f3c42e4032390af6 Author: Long Li Date: Mon Jan 13 16:08:36 2020 -0800 scsi: storvsc: Correctly set number of hardware queues for IDE disk Commit 0ed881027690 ("scsi: storvsc: setup 1:1 mapping between hardware queue and CPU queue") introduced a regression for disks attached to IDE. For these disks the host VSP only offers one VMBUS channel. Setting multiple queues can overload the VMBUS channel and result in performance drop for high queue depth workload on system with large number of CPUs. Fix it by leaving the number of hardware queues to 1 (default value) for IDE disks. Fixes: 0ed881027690 ("scsi: storvsc: setup 1:1 mapping between hardware queue and CPU queue") Link: https://lore.kernel.org/r/1578960516-108228-1-git-send-email-longli@linuxonhyperv.com Reviewed-by: Ming Lei Signed-off-by: Long Li Signed-off-by: Martin K. Petersen commit 42ec15ceaea74b5f7a621fc6686cbf69ca66c4cf Author: Arnd Bergmann Date: Tue Jan 7 21:15:49 2020 +0100 scsi: fnic: fix invalid stack access gcc -O3 warns that some local variables are not properly initialized: drivers/scsi/fnic/vnic_dev.c: In function 'fnic_dev_hang_notify': drivers/scsi/fnic/vnic_dev.c:511:16: error: 'a0' is used uninitialized in this function [-Werror=uninitialized] vdev->args[0] = *a0; ~~~~~~~~~~~~~~^~~~~ drivers/scsi/fnic/vnic_dev.c:691:6: note: 'a0' was declared here u64 a0, a1; ^~ drivers/scsi/fnic/vnic_dev.c:512:16: error: 'a1' is used uninitialized in this function [-Werror=uninitialized] vdev->args[1] = *a1; ~~~~~~~~~~~~~~^~~~~ drivers/scsi/fnic/vnic_dev.c:691:10: note: 'a1' was declared here u64 a0, a1; ^~ drivers/scsi/fnic/vnic_dev.c: In function 'fnic_dev_mac_addr': drivers/scsi/fnic/vnic_dev.c:512:16: error: 'a1' is used uninitialized in this function [-Werror=uninitialized] vdev->args[1] = *a1; ~~~~~~~~~~~~~~^~~~~ drivers/scsi/fnic/vnic_dev.c:698:10: note: 'a1' was declared here u64 a0, a1; ^~ Apparently the code relies on the local variables occupying adjacent memory locations in the same order, but this is of course not guaranteed. Use an array of two u64 variables where needed to make it work correctly. I suspect there is also an endianness bug here, but have not digged in deep enough to be sure. Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA") Fixes: mmtom ("init/Kconfig: enable -O3 for all arches") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200107201602.4096790-1-arnd@arndb.de Signed-off-by: Arnd Bergmann Signed-off-by: Martin K. Petersen commit 20d2292754e72e445abe62b7ac453eb945fc626c Author: Greentime Hu Date: Wed Jan 15 14:54:36 2020 +0800 riscv: make sure the cores stay looping in .Lsecondary_park The code in secondary_park is currently placed in the .init section. The kernel reclaims and clears this code when it finishes booting. That causes the cores parked in it to go to somewhere unpredictable, so we move this function out of init to make sure the cores stay looping there. The instruction bgeu a0, t0, .Lsecondary_park may have "a relocation truncated to fit" issue during linking time. It is because that sections are too far to jump. Let's use tail to jump to the .Lsecondary_park. Signed-off-by: Greentime Hu Reviewed-by: Anup Patel Cc: Andreas Schwab Cc: stable@vger.kernel.org Fixes: 76d2a0493a17d ("RISC-V: Init and Halt Code") Signed-off-by: Paul Walmsley commit 16a89856f0a5d9235961d8d31432c76d650f8c1d Merge: b3a987b0264d 3b7c59754cc2 Author: Dave Airlie Date: Thu Jan 16 11:25:44 2020 +1000 Merge tag 'amd-drm-fixes-5.5-2020-01-15' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.5-2020-01-15: - Update golden settings for renoir - eDP fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200115235141.4149-1-alexander.deucher@amd.com commit 3b7c59754cc22760760a84ebddb8e0b1e8dd871b Author: Mario Kleiner Date: Thu Jan 9 16:20:27 2020 +0100 drm/amd/display: Reorder detect_edp_sink_caps before link settings read. read_current_link_settings_on_detect() on eDP 1.4+ may use the edp_supported_link_rates table which is set up by detect_edp_sink_caps(), so that function needs to be called first. Reviewed-by: Harry Wentland Signed-off-by: Mario Kleiner Cc: Martin Leung Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit f2360e333b5a326747981e82e8e4a7a0584dfc9a Author: Aaron Liu Date: Thu Jan 9 19:37:10 2020 +0800 drm/amdgpu: update goldensetting for renoir Update mmSDMA0_UTCL1_WATERMK golden setting for renoir. Signed-off-by: Aaron Liu Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit 85ddd9c3173102930c16b0cfe8dbb771af434532 Merge: 0af2ffc93a4b 7361d44896ff Author: Daniel Borkmann Date: Wed Jan 15 23:26:14 2020 +0100 Merge branch 'bpf-sockmap-tls-fixes' John Fastabend says: ==================== To date our usage of sockmap/tls has been fairly simple, the BPF programs did only well-defined pop, push, pull and apply/cork operations. Now that we started to push more complex programs into sockmap we uncovered a series of issues addressed here. Further OpenSSL3.0 version should be released soon with kTLS support so its important to get any remaining issues on BPF and kTLS support resolved. Additionally, I have a patch under development to allow sockmap to be enabled/disabled at runtime for Cilium endpoints. This allows us to stress the map insert/delete with kTLS more than previously where Cilium only added the socket to the map when it entered ESTABLISHED state and never touched it from the control path side again relying on the sockets own close() hook to remove it. To test I have a set of test cases in test_sockmap.c that expose these issues. Once we get fixes here merged and in bpf-next I'll submit the tests to bpf-next tree to ensure we don't regress again. Also I've run these patches in the Cilium CI with OpenSSL (master branch) this will run tools such as netperf, ab, wrk2, curl, etc. to get a broad set of testing. I'm aware of two more issues that we are working to resolve in another couple (probably two) patches. First we see an auth tag corruption in kTLS when sending small 1byte chunks under stress. I've not pinned this down yet. But, guessing because its under 1B stress tests it must be some error path being triggered. And second we need to ensure BPF RX programs are not skipped when kTLS ULP is loaded. This breaks some of the sockmap selftests when running with kTLS. I'll send a follow up for this. v2: I dropped a patch that added !0 size check in tls_push_record this originated from a panic I caught awhile ago with a trace in the crypto stack. But I can not reproduce it anymore so will dig into that and send another patch later if needed. Anyways after a bit of thought it would be nicer if tls/crypto/bpf didn't require special case handling for the !0 size. ==================== Signed-off-by: Daniel Borkmann commit 7361d44896ff20d48bdd502d1a0cd66308055d45 Author: John Fastabend Date: Sat Jan 11 06:12:06 2020 +0000 bpf: Sockmap/tls, fix pop data with SK_DROP return code When user returns SK_DROP we need to reset the number of copied bytes to indicate to the user the bytes were dropped and not sent. If we don't reset the copied arg sendmsg will return as if those bytes were copied giving the user a positive return value. This works as expected today except in the case where the user also pops bytes. In the pop case the sg.size is reduced but we don't correctly account for this when copied bytes is reset. The popped bytes are not accounted for and we return a small positive value potentially confusing the user. The reason this happens is due to a typo where we do the wrong comparison when accounting for pop bytes. In this fix notice the if/else is not needed and that we have a similar problem if we push data except its not visible to the user because if delta is larger the sg.size we return a negative value so it appears as an error regardless. Fixes: 7246d8ed4dcce ("bpf: helper to pop data from messages") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Jonathan Lemon Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20200111061206.8028-9-john.fastabend@gmail.com commit 9aaaa56845a06aeabdd597cbe19492dc01f281ec Author: John Fastabend Date: Sat Jan 11 06:12:05 2020 +0000 bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining Its possible through a set of push, pop, apply helper calls to construct a skmsg, which is just a ring of scatterlist elements, with the start value larger than the end value. For example, end start |_0_|_1_| ... |_n_|_n+1_| Where end points at 1 and start points and n so that valid elements is the set {n, n+1, 0, 1}. Currently, because we don't build the correct chain only {n, n+1} will be sent. This adds a check and sg_chain call to correctly submit the above to the crypto and tls send path. Fixes: d3b18ad31f93d ("tls: add bpf support to sk_msg handling") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Jonathan Lemon Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20200111061206.8028-8-john.fastabend@gmail.com commit d468e4775c1c351616947ba0cccc43273963b9b5 Author: John Fastabend Date: Sat Jan 11 06:12:04 2020 +0000 bpf: Sockmap/tls, tls_sw can create a plaintext buf > encrypt buf It is possible to build a plaintext buffer using push helper that is larger than the allocated encrypt buffer. When this record is pushed to crypto layers this can result in a NULL pointer dereference because the crypto API expects the encrypt buffer is large enough to fit the plaintext buffer. Kernel splat below. To resolve catch the cases this can happen and split the buffer into two records to send individually. Unfortunately, there is still one case to handle where the split creates a zero sized buffer. In this case we merge the buffers and unmark the split. This happens when apply is zero and user pushed data beyond encrypt buffer. This fixes the original case as well because the split allocated an encrypt buffer larger than the plaintext buffer and the merge simply moves the pointers around so we now have a reference to the new (larger) encrypt buffer. Perhaps its not ideal but it seems the best solution for a fixes branch and avoids handling these two cases, (a) apply that needs split and (b) non apply case. The are edge cases anyways so optimizing them seems not necessary unless someone wants later in next branches. [ 306.719107] BUG: kernel NULL pointer dereference, address: 0000000000000008 [...] [ 306.747260] RIP: 0010:scatterwalk_copychunks+0x12f/0x1b0 [...] [ 306.770350] Call Trace: [ 306.770956] scatterwalk_map_and_copy+0x6c/0x80 [ 306.772026] gcm_enc_copy_hash+0x4b/0x50 [ 306.772925] gcm_hash_crypt_remain_continue+0xef/0x110 [ 306.774138] gcm_hash_crypt_continue+0xa1/0xb0 [ 306.775103] ? gcm_hash_crypt_continue+0xa1/0xb0 [ 306.776103] gcm_hash_assoc_remain_continue+0x94/0xa0 [ 306.777170] gcm_hash_assoc_continue+0x9d/0xb0 [ 306.778239] gcm_hash_init_continue+0x8f/0xa0 [ 306.779121] gcm_hash+0x73/0x80 [ 306.779762] gcm_encrypt_continue+0x6d/0x80 [ 306.780582] crypto_gcm_encrypt+0xcb/0xe0 [ 306.781474] crypto_aead_encrypt+0x1f/0x30 [ 306.782353] tls_push_record+0x3b9/0xb20 [tls] [ 306.783314] ? sk_psock_msg_verdict+0x199/0x300 [ 306.784287] bpf_exec_tx_verdict+0x3f2/0x680 [tls] [ 306.785357] tls_sw_sendmsg+0x4a3/0x6a0 [tls] test_sockmap test signature to trigger bug, [TEST]: (1, 1, 1, sendmsg, pass,redir,start 1,end 2,pop (1,2),ktls,): Fixes: d3b18ad31f93d ("tls: add bpf support to sk_msg handling") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Jonathan Lemon Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20200111061206.8028-7-john.fastabend@gmail.com commit cf21e9ba1eb86c9333ca5b05b2f1cc94021bcaef Author: John Fastabend Date: Sat Jan 11 06:12:03 2020 +0000 bpf: Sockmap/tls, msg_push_data may leave end mark in place Leaving an incorrect end mark in place when passing to crypto layer will cause crypto layer to stop processing data before all data is encrypted. To fix clear the end mark on push data instead of expecting users of the helper to clear the mark value after the fact. This happens when we push data into the middle of a skmsg and have room for it so we don't do a set of copies that already clear the end flag. Fixes: 6fff607e2f14b ("bpf: sk_msg program helper bpf_msg_push_data") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Song Liu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20200111061206.8028-6-john.fastabend@gmail.com commit 6562e29cf6f0ddd368657d97a8d484ffc30df5ef Author: John Fastabend Date: Sat Jan 11 06:12:02 2020 +0000 bpf: Sockmap, skmsg helper overestimates push, pull, and pop bounds In the push, pull, and pop helpers operating on skmsg objects to make data writable or insert/remove data we use this bounds check to ensure specified data is valid, /* Bounds checks: start and pop must be inside message */ if (start >= offset + l || last >= msg->sg.size) return -EINVAL; The problem here is offset has already included the length of the current element the 'l' above. So start could be past the end of the scatterlist element in the case where start also points into an offset on the last skmsg element. To fix do the accounting slightly different by adding the length of the previous entry to offset at the start of the iteration. And ensure its initialized to zero so that the first iteration does nothing. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Fixes: 6fff607e2f14b ("bpf: sk_msg program helper bpf_msg_push_data") Fixes: 7246d8ed4dcce ("bpf: helper to pop data from messages") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Song Liu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20200111061206.8028-5-john.fastabend@gmail.com commit 33bfe20dd7117dd81fd896a53f743a233e1ad64f Author: John Fastabend Date: Sat Jan 11 06:12:01 2020 +0000 bpf: Sockmap/tls, push write_space updates through ulp updates When sockmap sock with TLS enabled is removed we cleanup bpf/psock state and call tcp_update_ulp() to push updates to TLS ULP on top. However, we don't push the write_space callback up and instead simply overwrite the op with the psock stored previous op. This may or may not be correct so to ensure we don't overwrite the TLS write space hook pass this field to the ULP and have it fixup the ctx. This completes a previous fix that pushed the ops through to the ULP but at the time missed doing this for write_space, presumably because write_space TLS hook was added around the same time. Fixes: 95fa145479fbc ("bpf: sockmap/tls, close can race with map free") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Acked-by: Jonathan Lemon Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20200111061206.8028-4-john.fastabend@gmail.com commit 7e81a35302066c5a00b4c72d83e3ea4cad6eeb5b Author: John Fastabend Date: Sat Jan 11 06:12:00 2020 +0000 bpf: Sockmap, ensure sock lock held during tear down The sock_map_free() and sock_hash_free() paths used to delete sockmap and sockhash maps walk the maps and destroy psock and bpf state associated with the socks in the map. When done the socks no longer have BPF programs attached and will function normally. This can happen while the socks in the map are still "live" meaning data may be sent/received during the walk. Currently, though we don't take the sock_lock when the psock and bpf state is removed through this path. Specifically, this means we can be writing into the ops structure pointers such as sendmsg, sendpage, recvmsg, etc. while they are also being called from the networking side. This is not safe, we never used proper READ_ONCE/WRITE_ONCE semantics here if we believed it was safe. Further its not clear to me its even a good idea to try and do this on "live" sockets while networking side might also be using the socket. Instead of trying to reason about using the socks from both sides lets realize that every use case I'm aware of rarely deletes maps, in fact kubernetes/Cilium case builds map at init and never tears it down except on errors. So lets do the simple fix and grab sock lock. This patch wraps sock deletes from maps in sock lock and adds some annotations so we catch any other cases easier. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Song Liu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20200111061206.8028-3-john.fastabend@gmail.com commit 4da6a196f93b1af7612340e8c1ad8ce71e18f955 Author: John Fastabend Date: Sat Jan 11 06:11:59 2020 +0000 bpf: Sockmap/tls, during free we may call tcp_bpf_unhash() in loop When a sockmap is free'd and a socket in the map is enabled with tls we tear down the bpf context on the socket, the psock struct and state, and then call tcp_update_ulp(). The tcp_update_ulp() call is to inform the tls stack it needs to update its saved sock ops so that when the tls socket is later destroyed it doesn't try to call the now destroyed psock hooks. This is about keeping stacked ULPs in good shape so they always have the right set of stacked ops. However, recently unhash() hook was removed from TLS side. But, the sockmap/bpf side is not doing any extra work to update the unhash op when is torn down instead expecting TLS side to manage it. So both TLS and sockmap believe the other side is managing the op and instead no one updates the hook so it continues to point at tcp_bpf_unhash(). When unhash hook is called we call tcp_bpf_unhash() which detects the psock has already been destroyed and calls sk->sk_prot_unhash() which calls tcp_bpf_unhash() yet again and so on looping and hanging the core. To fix have sockmap tear down logic fixup the stale pointer. Fixes: 5d92e631b8be ("net/tls: partially revert fix transition through disconnect with close") Reported-by: syzbot+83979935eb6304f8cd46@syzkaller.appspotmail.com Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Acked-by: Song Liu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20200111061206.8028-2-john.fastabend@gmail.com commit 5e89cd303e3a4505752952259b9f1ba036632544 Author: Alex Deucher Date: Tue Jan 14 17:09:28 2020 -0600 PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken To account for parts of the chip that are "harvested" (disabled) due to silicon flaws, caches on some AMD GPUs must be initialized before ATS is enabled. ATS is normally enabled by the IOMMU driver before the GPU driver loads, so this cache initialization would have to be done in a quirk, but that's too complex to be practical. For Navi14 (device ID 0x7340), this initialization is done by the VBIOS, but apparently some boards went to production with an older VBIOS that doesn't do it. Disable ATS for those boards. Link: https://lore.kernel.org/r/20200114205523.1054271-3-alexander.deucher@amd.com Bug: https://gitlab.freedesktop.org/drm/amd/issues/1015 See-also: d28ca864c493 ("PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken") See-also: 9b44b0b09dec ("PCI: Mark AMD Stoney GPU ATS as broken") [bhelgaas: squash into one patch, simplify slightly, commit log] Signed-off-by: Alex Deucher Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org commit 567110f147b352020138573a90476a1522210f62 Merge: ddf420390526 4eee13f14dd8 Author: David S. Miller Date: Wed Jan 15 23:11:18 2020 +0100 Merge branch 'stmmac-Fix-selftests-in-Synopsys-AXS101-board' Jose Abreu says: ==================== net: stmmac: Fix selftests in Synopsys AXS101 board Set of fixes for sefltests so that they work in Synopsys AXS101 board. Final output: $ ethtool -t eth0 The test result is PASS The test extra info: 1. MAC Loopback 0 2. PHY Loopback -95 3. MMC Counters 0 4. EEE -95 5. Hash Filter MC 0 6. Perfect Filter UC 0 7. MC Filter 0 8. UC Filter 0 9. Flow Control -95 10. RSS -95 11. VLAN Filtering -95 12. VLAN Filtering (perf) -95 13. Double VLAN Filter -95 14. Double VLAN Filter (perf) -95 15. Flexible RX Parser -95 16. SA Insertion (desc) -95 17. SA Replacement (desc) -95 18. SA Insertion (reg) -95 19. SA Replacement (reg) -95 20. VLAN TX Insertion -95 21. SVLAN TX Insertion -95 22. L3 DA Filtering -95 23. L3 SA Filtering -95 24. L4 DA TCP Filtering -95 25. L4 SA TCP Filtering -95 26. L4 DA UDP Filtering -95 27. L4 SA UDP Filtering -95 28. ARP Offload -95 29. Jumbo Frame 0 30. Multichannel Jumbo -95 31. Split Header -95 Description: 1) Fixes the unaligned accesses that caused CPU halt in Synopsys AXS101 boards. 2) Fixes the VLAN tests when filtering failed to work. 3) Fixes the VLAN Perfect tests when filtering is not available in HW. ==================== Signed-off-by: David S. Miller commit 4eee13f14dd8989e6168e1d69b8804f44c016e04 Author: Jose Abreu Date: Tue Jan 14 17:09:23 2020 +0100 net: stmmac: selftests: Guard VLAN Perfect test against non supported HW When HW does not support perfect filtering the feature will not be enabled in the net_device. Add a check for this to prevent failures. Fixes: 1b2250a04c1f ("net: stmmac: selftests: Add tests for VLAN Perfect Filtering") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit d39b68e5a736afa67d2e9cfb158efdd237d99dbd Author: Jose Abreu Date: Tue Jan 14 17:09:22 2020 +0100 net: stmmac: selftests: Mark as fail when received VLAN ID != expected When the VLAN ID does not match the expected one it means filter failed in HW. Fix it. Fixes: 94e18382003c ("net: stmmac: selftests: Add selftest for VLAN TX Offload") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 0b9f932edc1a461933bfde08e620362e2190e0dd Author: Jose Abreu Date: Tue Jan 14 17:09:21 2020 +0100 net: stmmac: selftests: Make it work in Synopsys AXS101 boards Synopsys AXS101 boards do not support unaligned memory loads or stores. Change the selftests mechanism to explicity: - Not add extra alignment in TX SKB - Use the unaligned version of ether_addr_equal() Fixes: 091810dbded9 ("net: stmmac: Introduce selftests support") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit ddf420390526ede3b9ff559ac89f58cb59d9db2f Author: Colin Ian King Date: Tue Jan 14 14:54:48 2020 +0000 net/wan/fsl_ucc_hdlc: fix out of bounds write on array utdm_info Array utdm_info is declared as an array of MAX_HDLC_NUM (4) elements however up to UCC_MAX_NUM (8) elements are potentially being written to it. Currently we have an array out-of-bounds write error on the last 4 elements. Fix this by making utdm_info UCC_MAX_NUM elements in size. Addresses-Coverity: ("Out-of-bounds write") Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 5a64967a2f3bbc01cc708ee43c7b0893089c61c4 Author: Wayne Lin Date: Mon Jan 13 17:36:49 2020 +0800 drm/dp_mst: Have DP_Tx send one msg at a time [Why] Noticed this while testing MST with the 4 ports MST hub from StarTech.com. Sometimes can't light up monitors normally and get the error message as 'sideband msg build failed'. Look into aux transactions, found out that source sometimes will send out another down request before receiving the down reply of the previous down request. On the other hand, in drm_dp_get_one_sb_msg(), current code doesn't handle the interleaved replies case. Hence, source can't build up message completely and can't light up monitors. [How] For good compatibility, enforce source to send out one down request at a time. Add a flag, is_waiting_for_dwn_reply, to determine if the source can send out a down request immediately or not. - Check the flag before calling process_single_down_tx_qlock to send out a msg - Set the flag when successfully send out a down request - Clear the flag when successfully build up a down reply - Clear the flag when find erros during sending out a down request - Clear the flag when find errors during building up a down reply - Clear the flag when timeout occurs during waiting for a down reply - Use drm_dp_mst_kick_tx() to try to send another down request in queue at the end of drm_dp_mst_wait_tx_reply() (attempt to send out messages in queue when errors occur) Cc: Lyude Paul Signed-off-by: Wayne Lin Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20200113093649.11755-1-Wayne.Lin@amd.com commit 5a40420e04940c581f736ea3d7588da9b6e99741 Merge: 536dc5df2808 4cc4a1708903 Author: David S. Miller Date: Wed Jan 15 22:44:23 2020 +0100 Merge tag 'batadv-net-for-davem-20200114' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - Fix DAT candidate selection on little endian systems, by Sven Eckelmann ==================== Signed-off-by: David S. Miller commit 0af2ffc93a4b50948f9dad2786b7f1bd253bf0b9 Author: Daniel Borkmann Date: Wed Jan 15 21:47:33 2020 +0100 bpf: Fix incorrect verifier simulation of ARSH under ALU32 Anatoly has been fuzzing with kBdysch harness and reported a hang in one of the outcomes: 0: R1=ctx(id=0,off=0,imm=0) R10=fp0 0: (85) call bpf_get_socket_cookie#46 1: R0_w=invP(id=0) R10=fp0 1: (57) r0 &= 808464432 2: R0_w=invP(id=0,umax_value=808464432,var_off=(0x0; 0x30303030)) R10=fp0 2: (14) w0 -= 810299440 3: R0_w=invP(id=0,umax_value=4294967295,var_off=(0xcf800000; 0x3077fff0)) R10=fp0 3: (c4) w0 s>>= 1 4: R0_w=invP(id=0,umin_value=1740636160,umax_value=2147221496,var_off=(0x67c00000; 0x183bfff8)) R10=fp0 4: (76) if w0 s>= 0x30303030 goto pc+216 221: R0_w=invP(id=0,umin_value=1740636160,umax_value=2147221496,var_off=(0x67c00000; 0x183bfff8)) R10=fp0 221: (95) exit processed 6 insns (limit 1000000) [...] Taking a closer look, the program was xlated as follows: # ./bpftool p d x i 12 0: (85) call bpf_get_socket_cookie#7800896 1: (bf) r6 = r0 2: (57) r6 &= 808464432 3: (14) w6 -= 810299440 4: (c4) w6 s>>= 1 5: (76) if w6 s>= 0x30303030 goto pc+216 6: (05) goto pc-1 7: (05) goto pc-1 8: (05) goto pc-1 [...] 220: (05) goto pc-1 221: (05) goto pc-1 222: (95) exit Meaning, the visible effect is very similar to f54c7898ed1c ("bpf: Fix precision tracking for unbounded scalars"), that is, the fall-through branch in the instruction 5 is considered to be never taken given the conclusion from the min/max bounds tracking in w6, and therefore the dead-code sanitation rewrites it as goto pc-1. However, real-life input disagrees with verification analysis since a soft-lockup was observed. The bug sits in the analysis of the ARSH. The definition is that we shift the target register value right by K bits through shifting in copies of its sign bit. In adjust_scalar_min_max_vals(), we do first coerce the register into 32 bit mode, same happens after simulating the operation. However, for the case of simulating the actual ARSH, we don't take the mode into account and act as if it's always 64 bit, but location of sign bit is different: dst_reg->smin_value >>= umin_val; dst_reg->smax_value >>= umin_val; dst_reg->var_off = tnum_arshift(dst_reg->var_off, umin_val); Consider an unknown R0 where bpf_get_socket_cookie() (or others) would for example return 0xffff. With the above ARSH simulation, we'd see the following results: [...] 1: R1=ctx(id=0,off=0,imm=0) R2_w=invP65535 R10=fp0 1: (85) call bpf_get_socket_cookie#46 2: R0_w=invP(id=0) R10=fp0 2: (57) r0 &= 808464432 -> R0_runtime = 0x3030 3: R0_w=invP(id=0,umax_value=808464432,var_off=(0x0; 0x30303030)) R10=fp0 3: (14) w0 -= 810299440 -> R0_runtime = 0xcfb40000 4: R0_w=invP(id=0,umax_value=4294967295,var_off=(0xcf800000; 0x3077fff0)) R10=fp0 (0xffffffff) 4: (c4) w0 s>>= 1 -> R0_runtime = 0xe7da0000 5: R0_w=invP(id=0,umin_value=1740636160,umax_value=2147221496,var_off=(0x67c00000; 0x183bfff8)) R10=fp0 (0x67c00000) (0x7ffbfff8) [...] In insn 3, we have a runtime value of 0xcfb40000, which is '1100 1111 1011 0100 0000 0000 0000 0000', the result after the shift has 0xe7da0000 that is '1110 0111 1101 1010 0000 0000 0000 0000', where the sign bit is correctly retained in 32 bit mode. In insn4, the umax was 0xffffffff, and changed into 0x7ffbfff8 after the shift, that is, '0111 1111 1111 1011 1111 1111 1111 1000' and means here that the simulation didn't retain the sign bit. With above logic, the updates happen on the 64 bit min/max bounds and given we coerced the register, the sign bits of the bounds are cleared as well, meaning, we need to force the simulation into s32 space for 32 bit alu mode. Verification after the fix below. We're first analyzing the fall-through branch on 32 bit signed >= test eventually leading to rejection of the program in this specific case: 0: R1=ctx(id=0,off=0,imm=0) R10=fp0 0: (b7) r2 = 808464432 1: R1=ctx(id=0,off=0,imm=0) R2_w=invP808464432 R10=fp0 1: (85) call bpf_get_socket_cookie#46 2: R0_w=invP(id=0) R10=fp0 2: (bf) r6 = r0 3: R0_w=invP(id=0) R6_w=invP(id=0) R10=fp0 3: (57) r6 &= 808464432 4: R0_w=invP(id=0) R6_w=invP(id=0,umax_value=808464432,var_off=(0x0; 0x30303030)) R10=fp0 4: (14) w6 -= 810299440 5: R0_w=invP(id=0) R6_w=invP(id=0,umax_value=4294967295,var_off=(0xcf800000; 0x3077fff0)) R10=fp0 5: (c4) w6 s>>= 1 6: R0_w=invP(id=0) R6_w=invP(id=0,umin_value=3888119808,umax_value=4294705144,var_off=(0xe7c00000; 0x183bfff8)) R10=fp0 (0x67c00000) (0xfffbfff8) 6: (76) if w6 s>= 0x30303030 goto pc+216 7: R0_w=invP(id=0) R6_w=invP(id=0,umin_value=3888119808,umax_value=4294705144,var_off=(0xe7c00000; 0x183bfff8)) R10=fp0 7: (30) r0 = *(u8 *)skb[808464432] BPF_LD_[ABS|IND] uses reserved fields processed 8 insns (limit 1000000) [...] Fixes: 9cbe1f5a32dc ("bpf/verifier: improve register value range tracking with ARSH") Reported-by: Anatoly Trosinenko Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200115204733.16648-1-daniel@iogearbox.net commit 536dc5df2808efbefc5acee334d3c4f701790ec0 Author: Mohammed Gamal Date: Tue Jan 14 15:09:50 2020 +0200 hv_netvsc: Fix memory leak when removing rndis device kmemleak detects the following memory leak when hot removing a network device: unreferenced object 0xffff888083f63600 (size 256): comm "kworker/0:1", pid 12, jiffies 4294831717 (age 1113.676s) hex dump (first 32 bytes): 00 40 c7 33 80 88 ff ff 00 00 00 00 10 00 00 00 .@.3............ 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... backtrace: [<00000000d4a8f5be>] rndis_filter_device_add+0x117/0x11c0 [hv_netvsc] [<000000009c02d75b>] netvsc_probe+0x5e7/0xbf0 [hv_netvsc] [<00000000ddafce23>] vmbus_probe+0x74/0x170 [hv_vmbus] [<00000000046e64f1>] really_probe+0x22f/0xb50 [<000000005cc35eb7>] driver_probe_device+0x25e/0x370 [<0000000043c642b2>] bus_for_each_drv+0x11f/0x1b0 [<000000005e3d09f0>] __device_attach+0x1c6/0x2f0 [<00000000a72c362f>] bus_probe_device+0x1a6/0x260 [<0000000008478399>] device_add+0x10a3/0x18e0 [<00000000cf07b48c>] vmbus_device_register+0xe7/0x1e0 [hv_vmbus] [<00000000d46cf032>] vmbus_add_channel_work+0x8ab/0x1770 [hv_vmbus] [<000000002c94bb64>] process_one_work+0x919/0x17d0 [<0000000096de6781>] worker_thread+0x87/0xb40 [<00000000fbe7397e>] kthread+0x333/0x3f0 [<000000004f844269>] ret_from_fork+0x3a/0x50 rndis_filter_device_add() allocates an instance of struct rndis_device which never gets deallocated as rndis_filter_device_remove() sets net_device->extension which points to the rndis_device struct to NULL, leaving the rndis_device dangling. Since net_device->extension is eventually freed in free_netvsc_device(), we refrain from setting it to NULL inside rndis_filter_device_remove() Signed-off-by: Mohammed Gamal Reviewed-by: Haiyang Zhang Signed-off-by: David S. Miller commit e176b1ba476cf36f723cfcc7a9e57f3cb47dec70 Author: Pengcheng Yang Date: Tue Jan 14 17:23:40 2020 +0800 tcp: fix marked lost packets not being retransmitted When the packet pointed to by retransmit_skb_hint is unlinked by ACK, retransmit_skb_hint will be set to NULL in tcp_clean_rtx_queue(). If packet loss is detected at this time, retransmit_skb_hint will be set to point to the current packet loss in tcp_verify_retransmit_hint(), then the packets that were previously marked lost but not retransmitted due to the restriction of cwnd will be skipped and cannot be retransmitted. To fix this, when retransmit_skb_hint is NULL, retransmit_skb_hint can be reset only after all marked lost packets are retransmitted (retrans_out >= lost_out), otherwise we need to traverse from tcp_rtx_queue_head in tcp_xmit_retransmit_queue(). Packetdrill to demonstrate: // Disable RACK and set max_reordering to keep things simple 0 `sysctl -q net.ipv4.tcp_recovery=0` +0 `sysctl -q net.ipv4.tcp_max_reordering=3` // Establish a connection +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1) = 0 +.1 < S 0:0(0) win 32792 +0 > S. 0:0(0) ack 1 <...> +.01 < . 1:1(0) ack 1 win 257 +0 accept(3, ..., ...) = 4 // Send 8 data segments +0 write(4, ..., 8000) = 8000 +0 > P. 1:8001(8000) ack 1 // Enter recovery and 1:3001 is marked lost +.01 < . 1:1(0) ack 1 win 257 +0 < . 1:1(0) ack 1 win 257 +0 < . 1:1(0) ack 1 win 257 // Retransmit 1:1001, now retransmit_skb_hint points to 1001:2001 +0 > . 1:1001(1000) ack 1 // 1001:2001 was ACKed causing retransmit_skb_hint to be set to NULL +.01 < . 1:1(0) ack 2001 win 257 // Now retransmit_skb_hint points to 4001:5001 which is now marked lost // BUG: 2001:3001 was not retransmitted +0 > . 2001:3001(1000) ack 1 Signed-off-by: Pengcheng Yang Acked-by: Neal Cardwell Tested-by: Neal Cardwell Signed-off-by: David S. Miller commit 60adcfde92fa40fcb2dbf7cc52f9b096e0cd109a Author: Takashi Iwai Date: Wed Jan 15 21:37:33 2020 +0100 ALSA: seq: Fix racy access for queue timer in proc read snd_seq_info_timer_read() reads the information of the timer assigned for each queue, but it's done in a racy way which may lead to UAF as spotted by syzkaller. This patch applies the missing q->timer_mutex lock while accessing the timer object as well as a slight code change to adapt the standard coding style. Reported-by: syzbot+2b2ef983f973e5c40943@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/20200115203733.26530-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit f5ae2ea6347a308cfe91f53b53682ce635497d0d Author: Jari Ruusu Date: Sun Jan 12 15:00:53 2020 +0200 Fix built-in early-load Intel microcode alignment Intel Software Developer's Manual, volume 3, chapter 9.11.6 says: "Note that the microcode update must be aligned on a 16-byte boundary and the size of the microcode update must be 1-KByte granular" When early-load Intel microcode is loaded from initramfs, userspace tool 'iucode_tool' has already 16-byte aligned those microcode bits in that initramfs image. Image that was created something like this: iucode_tool --write-earlyfw=FOO.cpio microcode-files... However, when early-load Intel microcode is loaded from built-in firmware BLOB using CONFIG_EXTRA_FIRMWARE= kernel config option, that 16-byte alignment is not guaranteed. Fix this by forcing all built-in firmware BLOBs to 16-byte alignment. [ If we end up having other firmware with much bigger alignment requirements, we might need to introduce some method for the firmware to specify it, this is the minimal "just increase the alignment a bit to account for this one special case" patch - Linus ] Signed-off-by: Jari Ruusu Cc: Borislav Petkov Cc: Fenghua Yu Cc: Luis Chamberlain Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit a4feff2264dfc144060582df8ac461fa47679b91 Merge: 51d69817519f 051d75d3bb31 Author: Linus Torvalds Date: Wed Jan 15 11:33:53 2020 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2 Pull arch/nios2 fixlet from Ley Foon Tan: "Update my nios2 maintainer email" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2: MAINTAINERS: Update Ley Foon Tan's email address commit e64175776d06a8ceebbfd349d7e66a4a46ca39ef Author: Krzysztof Kozlowski Date: Mon Jan 13 18:29:54 2020 +0100 i2c: iop3xx: Fix memory leak in probe error path When handling devm_gpiod_get_optional() errors, free the memory already allocated. This fixes Smatch warnings: drivers/i2c/busses/i2c-iop3xx.c:437 iop3xx_i2c_probe() warn: possible memory leak of 'new_adapter' drivers/i2c/busses/i2c-iop3xx.c:442 iop3xx_i2c_probe() warn: possible memory leak of 'new_adapter' Fixes: fdb7e884ad61 ("i2c: iop: Use GPIO descriptors") Reported-by: kbuild test robot Reported-by: Dan Carpenter Signed-off-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 51d69817519f5f00041a1a039277f0367d76c82c Merge: 0174cb6ce944 f3efc406d67e Author: Linus Torvalds Date: Wed Jan 15 11:30:50 2020 -0800 Merge tag 'platform-drivers-x86-v5.5-3' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver fixes from Andy Shevchenko: - Fix keyboard brightness control for ASUS laptops - Better handling parameters of GPD pocket fan module to avoid thermal shock - Add IDs to PMC platform driver to support Intel Comet Lake - Fix potential dead lock in Mellanox TM FIFO driver and ABI documentation * tag 'platform-drivers-x86-v5.5-3' of git://git.infradead.org/linux-platform-drivers-x86: Documentation/ABI: Add missed attribute for mlxreg-io sysfs interfaces Documentation/ABI: Fix documentation inconsistency for mlxreg-io sysfs interfaces platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0 platform/x86: intel_pmc_core: update Comet Lake platform driver platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits platform/x86: GPD pocket fan: Use default values when wrong modparams are given platform/mellanox: fix potential deadlock in the tmfifo driver platform/x86: intel-ips: Use the correct style for SPDX License Identifier commit 0174cb6ce9449ce9b59cb9c6f4f64dc4df3de458 Merge: 84bf39461e61 cb1eeb75cf3d Author: Linus Torvalds Date: Wed Jan 15 10:21:34 2020 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a build problem for the hisilicon driver" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: hisilicon/sec2 - Use atomics instead of __sync commit 84bf39461e61f69ebfbfecf39cfda71bf78a7fc1 Merge: 95e20af9fb9c 508c8772760d Author: Linus Torvalds Date: Wed Jan 15 09:58:14 2020 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "Fixes for mountpoint_last() bugs (by converting to use of lookup_last()) and an autofs regression fix from this cycle (caused by follow_managed() breakage introduced in barrier fixes series)" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix autofs regression caused by follow_managed() changes reimplement path_mountpoint() with less magic commit 24a49678f5e20f18006e71b90ac1531876b27eb1 Author: Dmitry Osipenko Date: Tue Jan 14 04:34:36 2020 +0300 i2c: tegra: Properly disable runtime PM on driver's probe error One of the recent Tegra I2C commits made a change that resumes runtime PM during driver's probe, but it missed to put the RPM in a case of error. Note that it's not correct to use pm_runtime_status_suspended because it breaks RPM refcounting. Fixes: 8ebf15e9c869 ("i2c: tegra: Move suspend handling to NOIRQ phase") Cc: # v5.4+ Tested-by: Thierry Reding Signed-off-by: Dmitry Osipenko Signed-off-by: Wolfram Sang commit 9f42de8d4ec2304f10bbc51dc0484f3503d61196 Author: Dmitry Osipenko Date: Tue Jan 14 04:34:35 2020 +0300 i2c: tegra: Fix suspending in active runtime PM state I noticed that sometime I2C clock is kept enabled during suspend-resume. This happens because runtime PM defers dynamic suspension and thus it may happen that runtime PM is in active state when system enters into suspend. In particular I2C controller that is used for CPU's DVFS is often kept ON during suspend because CPU's voltage scaling happens quite often. Fixes: 8ebf15e9c869 ("i2c: tegra: Move suspend handling to NOIRQ phase") Cc: # v5.4+ Tested-by: Thierry Reding Signed-off-by: Dmitry Osipenko Signed-off-by: Wolfram Sang commit 16c731fed6d8e5615e23d2fd59cfe62eb10d9ff4 Author: Damien Le Moal Date: Thu Jan 9 14:03:55 2020 +0900 null_blk: Fix zone write handling null_zone_write() only allows writing empty and implicitly opened zones. Writing to closed and explicitly opened zones must also be allowed and the zone condition must be transitioned to implicit open if the zone is not explicitly opened already. Fixes: da644b2cc1a4 ("null_blk: add zone open, close, and finish support") Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 9fea3a40f6b07de977a2783270c8c3bc82544d45 Author: Ian Abbott Date: Tue Jan 14 18:25:32 2020 +0000 staging: comedi: ni_routes: allow partial routing information This patch fixes a regression on setting up asynchronous commands to use external trigger sources when board-specific routing information is missing. `ni_find_device_routes()` (called via `ni_assign_device_routes()`) finds the table of register values for the device family and the set of valid routes for the specific board. If both are found, `tables->route_values` is set to point to the table of register values for the device family and `tables->valid_routes` is set to point to the list of valid routes for the specific board. If either is not found, both `tables->route_values` and `tables->valid_routes` are left set at their initial null values (initialized by `ni_assign_device_routes()`) and the function returns `-ENODATA`. Returning an error results in some routing functionality being disabled. Unfortunately, leaving `table->route_values` set to `NULL` also breaks the setting up of asynchronous commands that are configured to use external trigger sources. Calls to `ni_check_trigger_arg()` or `ni_check_trigger_arg_roffs()` while checking the asynchronous command set-up would result in a null pointer dereference if `table->route_values` is `NULL`. The null pointer dereference is fixed in another patch, but it now results in failure to set up the asynchronous command. That is a regression from the behavior prior to commit 347e244884c3 ("staging: comedi: tio: implement global tio/ctr routing") and commit 56d0b826d39f ("staging: comedi: ni_mio_common: implement new routing for TRIG_EXT"). Change `ni_find_device_routes()` to set `tables->route_values` and/or `tables->valid_routes` to valid information even if the other one can only be set to `NULL` due to missing information. The function will still return an error in that case. This should result in `tables->valid_routes` being valid for all currently supported device families even if the board-specific routing information is missing. That should be enough to fix the regression on setting up asynchronous commands to use external triggers for boards with missing routing information. Fixes: 347e244884c3 ("staging: comedi: tio: implement global tio/ctr routing") Fixes: 56d0b826d39f ("staging: comedi: ni_mio_common: implement new routing for TRIG_EXT"). Cc: # 4.20+ Cc: Spencer E. Olson Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20200114182532.132058-3-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 01e20b664f808a4f3048ca3f930911fd257209bd Author: Ian Abbott Date: Tue Jan 14 18:25:31 2020 +0000 staging: comedi: ni_routes: fix null dereference in ni_find_route_source() In `ni_find_route_source()`, `tables->route_values` gets dereferenced. However it is possible that `tables->route_values` is `NULL`, leading to a null pointer dereference. `tables->route_values` will be `NULL` if the call to `ni_assign_device_routes()` during board initialization returned an error due to missing device family routing information or missing board-specific routing information. For example, there is currently no board-specific routing information provided for the PCIe-6251 board and several other boards, so those are affected by this bug. The bug is triggered when `ni_find_route_source()` is called via `ni_check_trigger_arg()` or `ni_check_trigger_arg_roffs()` when checking the arguments for setting up asynchronous commands. Fix it by returning `-EINVAL` if `tables->route_values` is `NULL`. Even with this fix, setting up asynchronous commands to use external trigger sources for boards with missing routing information will still fail gracefully. Since `ni_find_route_source()` only depends on the device family routing information, it would be better if that was made available even if the board-specific routing information is missing. That will be addressed by another patch. Fixes: 4bb90c87abbe ("staging: comedi: add interface to ni routing table information") Cc: # 4.20+ Cc: Spencer E. Olson Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20200114182532.132058-2-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 8b792f84c6377b27235fef16f5e78a59f890b3e1 Merge: eb507906feaa 85005b82e59f Author: David S. Miller Date: Wed Jan 15 04:16:30 2020 -0800 Merge branch 'mlxsw-Various-fixes' Ido Schimmel says: ==================== mlxsw: Various fixes This patch set contains various fixes for mlxsw. Patch #1 splits the init() callback between Spectrum-2 and Spectrum-3 in order to avoid enforcing the same firmware version for both ASICs, as this can't possibly work. Without this patch the driver cannot boot with the Spectrum-3 ASIC. Patches #2-#3 fix a long standing race condition that was recently exposed while testing the driver on an emulator, which is very slow compared to the actual hardware. The problem is explained in detail in the commit messages. Patch #4 fixes a selftest. Patch #5 prevents offloaded qdiscs from presenting a non-zero backlog to the user when the netdev is down. This is done by clearing the cached backlog in the driver when the netdev goes down. Patch #6 fixes qdisc statistics (backlog and tail drops) to also take into account the multicast traffic classes. v2: * Patches #2-#3: use skb_cow_head() instead of skb_unshare() as suggested by Jakub. Remove unnecessary check regarding headroom * Patches #5-#6: new ==================== Signed-off-by: David S. Miller commit 85005b82e59fa7bb7388b12594ab2067bf73d66c Author: Petr Machata Date: Wed Jan 15 13:53:49 2020 +0200 mlxsw: spectrum_qdisc: Include MC TCs in Qdisc counters mlxsw configures Spectrum in such a way that BUM traffic is passed not through its nominal traffic class TC, but through its MC counterpart TC+8. However, when collecting statistics, Qdiscs only look at the nominal TC and ignore the MC TC. Add two helpers to compute the value for logical TC from the constituents, one for backlog, the other for tail drops. Use them throughout instead of going through the xstats pointer directly. Counters for TX bytes and packets are deduced from packet priority counters, and therefore already include BUM traffic. wred_drop counter is irrelevant on MC TCs, because RED is not enabled on them. Fixes: 7b8195306694 ("mlxsw: spectrum: Configure MC-aware mode on mlxsw ports") Signed-off-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit ca7609ff3680c51d6c29897f3117aa2ad904f92a Author: Petr Machata Date: Wed Jan 15 13:53:48 2020 +0200 mlxsw: spectrum: Wipe xstats.backlog of down ports Per-port counter cache used by Qdiscs is updated periodically, unless the port is down. The fact that the cache is not updated for down ports is no problem for most counters, which are relative in nature. However, backlog is absolute in nature, and if there is a non-zero value in the cache around the time that the port goes down, that value just stays there. This value then leaks to offloaded Qdiscs that report non-zero backlog even if there (obviously) is no traffic. The HW does not keep backlog of a downed port, so do likewise: as the port goes down, wipe the backlog value from xstats. Fixes: 075ab8adaf4e ("mlxsw: spectrum: Collect tclass related stats periodically") Signed-off-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit fef6d6704944c7be72fd2b77c021f1aed3d5df0d Author: Petr Machata Date: Wed Jan 15 13:53:47 2020 +0200 selftests: mlxsw: qos_mc_aware: Fix mausezahn invocation Mausezahn does not recognize "own" as a keyword on source IP address. As a result, the MC stream is not running at all, and therefore no UC degradation can be observed even in principle. Fix the invocation, and tighten the test: due to the minimum shaper configured at the MC TCs, we always expect about 20% degradation. Fail the test if it is lower. Fixes: 573363a68f27 ("selftests: mlxsw: Add qos_lib.sh") Signed-off-by: Petr Machata Reported-by: Amit Cohen Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 63963d0f9d17be83d0e419e03282847ecc2c3715 Author: Ido Schimmel Date: Wed Jan 15 13:53:46 2020 +0200 mlxsw: switchx2: Do not modify cloned SKBs during xmit The driver needs to prepend a Tx header to each packet it is transmitting. The header includes information such as the egress port and traffic class. The addition of the header requires the driver to modify the SKB's header and therefore it must not be shared. Otherwise, we risk hitting various race conditions. For example, when a packet is flooded (cloned) by the bridge driver to two switch ports swp1 and swp2: t0 - mlxsw_sp_port_xmit() is called for swp1. Tx header is prepended with swp1's port number t1 - mlxsw_sp_port_xmit() is called for swp2. Tx header is prepended with swp2's port number, overwriting swp1's port number t2 - The device processes data buffer from t0. Packet is transmitted via swp2 t3 - The device processes data buffer from t1. Packet is transmitted via swp2 Usually, the device is fast enough and transmits the packet before its Tx header is overwritten, but this is not the case in emulated environments. Fix this by making sure the SKB's header is writable by calling skb_cow_head(). Since the function ensures we have headroom to push the Tx header, the check further in the function can be removed. v2: * Use skb_cow_head() instead of skb_unshare() as suggested by Jakub * Remove unnecessary check regarding headroom Fixes: 31557f0f9755 ("mlxsw: Introduce Mellanox SwitchX-2 ASIC support") Signed-off-by: Ido Schimmel Reported-by: Shalom Toledo Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 2da51ce75d86ab1f7770ac1391a9a1697ddaa60c Author: Ido Schimmel Date: Wed Jan 15 13:53:45 2020 +0200 mlxsw: spectrum: Do not modify cloned SKBs during xmit The driver needs to prepend a Tx header to each packet it is transmitting. The header includes information such as the egress port and traffic class. The addition of the header requires the driver to modify the SKB's header and therefore it must not be shared. Otherwise, we risk hitting various race conditions. For example, when a packet is flooded (cloned) by the bridge driver to two switch ports swp1 and swp2: t0 - mlxsw_sp_port_xmit() is called for swp1. Tx header is prepended with swp1's port number t1 - mlxsw_sp_port_xmit() is called for swp2. Tx header is prepended with swp2's port number, overwriting swp1's port number t2 - The device processes data buffer from t0. Packet is transmitted via swp2 t3 - The device processes data buffer from t1. Packet is transmitted via swp2 Usually, the device is fast enough and transmits the packet before its Tx header is overwritten, but this is not the case in emulated environments. Fix this by making sure the SKB's header is writable by calling skb_cow_head(). Since the function ensures we have headroom to push the Tx header, the check further in the function can be removed. v2: * Use skb_cow_head() instead of skb_unshare() as suggested by Jakub * Remove unnecessary check regarding headroom Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") Signed-off-by: Ido Schimmel Reported-by: Shalom Toledo Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit d58c35ca5202edea02d8201f4acd81e06c98f9b4 Author: Ido Schimmel Date: Wed Jan 15 13:53:44 2020 +0200 mlxsw: spectrum: Do not enforce same firmware version for multiple ASICs In commit a72afb6879bb ("mlxsw: Enforce firmware version for Spectrum-2") I added a required firmware version for Spectrum-2, but missed the fact that mlxsw_sp2_init() is used by both Spectrum-2 and Spectrum-3. This means that the same firmware version will be used for both, which is wrong. Fix this by creating a new init() callback for Spectrum-3. Fixes: a72afb6879bb ("mlxsw: Enforce firmware version for Spectrum-2") Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Tested-by: Shalom Toledo Signed-off-by: David S. Miller commit 9c06ac4c83df6d6fbdbf7488fbad822b4002ba19 Author: Keiya Nobuta Date: Thu Jan 9 14:14:48 2020 +0900 usb: core: hub: Improved device recognition on remote wakeup If hub_activate() is called before D+ has stabilized after remote wakeup, the following situation might occur: __ ___________________ / \ / D+ __/ \__/ Hub _______________________________ | ^ ^ ^ | | | | Host _____v__|___|___________|______ | | | | | | | \-- Interrupt Transfer (*3) | | \-- ClearPortFeature (*2) | \-- GetPortStatus (*1) \-- Host detects remote wakeup - D+ goes high, Host starts running by remote wakeup - D+ is not stable, goes low - Host requests GetPortStatus at (*1) and gets the following hub status: - Current Connect Status bit is 0 - Connect Status Change bit is 1 - D+ stabilizes, goes high - Host requests ClearPortFeature and thus Connect Status Change bit is cleared at (*2) - After waiting 100 ms, Host starts the Interrupt Transfer at (*3) - Since the Connect Status Change bit is 0, Hub returns NAK. In this case, port_event() is not called in hub_event() and Host cannot recognize device. To solve this issue, flag change_bits even if only Connect Status Change bit is 1 when got in the first GetPortStatus. This issue occurs rarely because it only if D+ changes during a very short time between GetPortStatus and ClearPortFeature. However, it is fatal if it occurs in embedded system. Signed-off-by: Keiya Nobuta Cc: stable Acked-by: Alan Stern Link: https://lore.kernel.org/r/20200109051448.28150-1-nobuta.keiya@fujitsu.com Signed-off-by: Greg Kroah-Hartman commit eb507906feaaf827395e5f96f2320e0c7731e4ff Merge: 8c4df83fbe60 81c044fc3bdc Author: David S. Miller Date: Wed Jan 15 04:12:00 2020 -0800 Merge tag 'mac80211-for-net-2020-01-15' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== A few fixes: * -O3 enablement fallout, thanks to Arnd who ran this * fixes for a few leaks, thanks to Felix * channel 12 regulatory fix for custom regdomains * check for a crash reported by syzbot (NULL function is called on drivers that don't have it) * fix TKIP replay protection after setup with some APs (from Jouni) * restrict obtaining some mesh data to avoid WARN_ONs * fix deadlocks with auto-disconnect (socket owner) * fix radar detection events with multiple devices ==================== Signed-off-by: David S. Miller commit 4e4362d2bf2a49ff44dbbc9585207977ca3d71d0 Author: Ulrich Weber Date: Wed Jan 15 12:11:29 2020 +0100 xfrm: support output_mark for offload ESP packets Commit 9b42c1f179a6 ("xfrm: Extend the output_mark") added output_mark support but missed ESP offload support. xfrm_smark_get() is not called within xfrm_input() for packets coming from esp4_gro_receive() or esp6_gro_receive(). Therefore call xfrm_smark_get() directly within these functions. Fixes: 9b42c1f179a6 ("xfrm: Extend the output_mark to support input direction and masking.") Signed-off-by: Ulrich Weber Signed-off-by: Steffen Klassert commit 978370956d2046b19313659ce65ed12d5b996626 Author: Chuansheng Liu Date: Tue Jan 7 00:41:16 2020 +0000 x86/mce/therm_throt: Do not access uninitialized therm_work It is relatively easy to trigger the following boot splat on an Ice Lake client platform. The call stack is like: kernel BUG at kernel/timer/timer.c:1152! Call Trace: __queue_delayed_work queue_delayed_work_on therm_throt_process intel_thermal_interrupt ... The reason is that a CPU's thermal interrupt is enabled prior to executing its hotplug onlining callback which will initialize the throttling workqueues. Such a race can lead to therm_throt_process() accessing an uninitialized therm_work, leading to the above BUG at a very early bootup stage. Therefore, unmask the thermal interrupt vector only after having setup the workqueues completely. [ bp: Heavily massage commit message and correct comment formatting. ] Fixes: f6656208f04e ("x86/mce/therm_throt: Optimize notifications of thermal throttle") Signed-off-by: Chuansheng Liu Signed-off-by: Borislav Petkov Acked-by: Tony Luck Link: https://lkml.kernel.org/r/20200107004116.59353-1-chuansheng.liu@intel.com commit a564ac35d60564dd5b509e32afdc04e7aafee40e Author: Kevin Hao Date: Tue Jan 14 16:28:18 2020 +0800 Revert "gpio: thunderx: Switch to GPIOLIB_IRQCHIP" This reverts commit a7fc89f9d5fcc10a5474cfe555f5a9e5df8b0f1f because there are some bugs in this commit, and we don't have a simple way to fix these bugs. So revert this commit to make the thunderx gpio work on the stable kernel at least. We will switch to GPIOLIB_IRQCHIP for thunderx gpio by following patches. Fixes: a7fc89f9d5fc ("gpio: thunderx: Switch to GPIOLIB_IRQCHIP") Signed-off-by: Kevin Hao Link: https://lore.kernel.org/r/20200114082821.14015-2-haokexin@gmail.com Signed-off-by: Linus Walleij commit de95a991bb72e009f47e0c4bbc90fc5f594588d5 Author: Eric Dumazet Date: Wed Dec 4 20:56:19 2019 -0800 tick/sched: Annotate lockless access to last_jiffies_update syzbot (KCSAN) reported a data-race in tick_do_update_jiffies64(): BUG: KCSAN: data-race in tick_do_update_jiffies64 / tick_do_update_jiffies64 write to 0xffffffff8603d008 of 8 bytes by interrupt on cpu 1: tick_do_update_jiffies64+0x100/0x250 kernel/time/tick-sched.c:73 tick_sched_do_timer+0xd4/0xe0 kernel/time/tick-sched.c:138 tick_sched_timer+0x43/0xe0 kernel/time/tick-sched.c:1292 __run_hrtimer kernel/time/hrtimer.c:1514 [inline] __hrtimer_run_queues+0x274/0x5f0 kernel/time/hrtimer.c:1576 hrtimer_interrupt+0x22a/0x480 kernel/time/hrtimer.c:1638 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline] smp_apic_timer_interrupt+0xdc/0x280 arch/x86/kernel/apic/apic.c:1135 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 arch_local_irq_restore arch/x86/include/asm/paravirt.h:756 [inline] kcsan_setup_watchpoint+0x1d4/0x460 kernel/kcsan/core.c:436 check_access kernel/kcsan/core.c:466 [inline] __tsan_read1 kernel/kcsan/core.c:593 [inline] __tsan_read1+0xc2/0x100 kernel/kcsan/core.c:593 kallsyms_expand_symbol.constprop.0+0x70/0x160 kernel/kallsyms.c:79 kallsyms_lookup_name+0x7f/0x120 kernel/kallsyms.c:170 insert_report_filterlist kernel/kcsan/debugfs.c:155 [inline] debugfs_write+0x14b/0x2d0 kernel/kcsan/debugfs.c:256 full_proxy_write+0xbd/0x100 fs/debugfs/file.c:225 __vfs_write+0x67/0xc0 fs/read_write.c:494 vfs_write fs/read_write.c:558 [inline] vfs_write+0x18a/0x390 fs/read_write.c:542 ksys_write+0xd5/0x1b0 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x4c/0x60 fs/read_write.c:620 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 read to 0xffffffff8603d008 of 8 bytes by task 0 on cpu 0: tick_do_update_jiffies64+0x2b/0x250 kernel/time/tick-sched.c:62 tick_nohz_update_jiffies kernel/time/tick-sched.c:505 [inline] tick_nohz_irq_enter kernel/time/tick-sched.c:1257 [inline] tick_irq_enter+0x139/0x1c0 kernel/time/tick-sched.c:1274 irq_enter+0x4f/0x60 kernel/softirq.c:354 entering_irq arch/x86/include/asm/apic.h:517 [inline] entering_ack_irq arch/x86/include/asm/apic.h:523 [inline] smp_apic_timer_interrupt+0x55/0x280 arch/x86/kernel/apic/apic.c:1133 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:571 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94 cpuidle_idle_call kernel/sched/idle.c:154 [inline] do_idle+0x1af/0x280 kernel/sched/idle.c:263 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355 rest_init+0xec/0xf6 init/main.c:452 arch_call_rest_init+0x17/0x37 start_kernel+0x838/0x85e init/main.c:786 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490 x86_64_start_kernel+0x72/0x76 arch/x86/kernel/head64.c:471 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc7+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Use READ_ONCE() and WRITE_ONCE() to annotate this expected race. Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20191205045619.204946-1-edumazet@google.com commit 81c044fc3bdc5b7be967cd3682528ea94b58c06a Author: Felix Fietkau Date: Mon Jan 13 19:21:07 2020 +0100 cfg80211: fix page refcount issue in A-MSDU decap The fragments attached to a skb can be part of a compound page. In that case, page_ref_inc will increment the refcount for the wrong page. Fix this by using get_page instead, which calls page_ref_inc on the compound head and also checks for overflow. Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.name Signed-off-by: Johannes Berg commit 24953de0a5e31dcca7e82c8a3c79abc2dfe8fb6e Author: Johannes Berg Date: Mon Jan 13 12:53:59 2020 +0100 cfg80211: check for set_wiphy_params Check if set_wiphy_params is assigned and return an error if not, some drivers (e.g. virt_wifi where syzbot reported it) don't have it. Reported-by: syzbot+e8a797964a4180eb57d5@syzkaller.appspotmail.com Reported-by: syzbot+34b582cf32c1db008f8e@syzkaller.appspotmail.com Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20200113125358.ac07f276efff.Ibd85ee1b12e47b9efb00a2adc5cd3fac50da791a@changeid Signed-off-by: Johannes Berg commit df16737d438f534d0cc9948c7c5158f1986c5c87 Author: Felix Fietkau Date: Wed Jan 8 18:06:30 2020 +0100 cfg80211: fix memory leak in cfg80211_cqm_rssi_update The per-tid statistics need to be released after the call to rdev_get_station Cc: stable@vger.kernel.org Fixes: 8689c051a201 ("cfg80211: dynamically allocate per-tid stats for station info") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20200108170630.33680-2-nbd@nbd.name Signed-off-by: Johannes Berg commit 2a279b34169e9bbf7c240691466420aba75b4175 Author: Felix Fietkau Date: Wed Jan 8 18:06:29 2020 +0100 cfg80211: fix memory leak in nl80211_probe_mesh_link The per-tid statistics need to be released after the call to rdev_get_station Cc: stable@vger.kernel.org Fixes: 5ab92e7fe49a ("cfg80211: add support to probe unexercised mesh link") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20200108170630.33680-1-nbd@nbd.name Signed-off-by: Johannes Berg commit 5a128a088a2ab0b5190eeb232b5aa0b1017a0317 Author: Markus Theil Date: Wed Jan 8 12:55:36 2020 +0100 cfg80211: fix deadlocks in autodisconnect work Use methods which do not try to acquire the wdev lock themselves. Cc: stable@vger.kernel.org Fixes: 37b1c004685a3 ("cfg80211: Support all iftypes in autodisconnect_wk") Signed-off-by: Markus Theil Link: https://lore.kernel.org/r/20200108115536.2262-1-markus.theil@tu-ilmenau.de Signed-off-by: Johannes Berg commit e16119655c9e6c4aa5767cd971baa9c491f41b13 Author: Arnd Bergmann Date: Tue Jan 7 21:07:35 2020 +0100 wireless: wext: avoid gcc -O3 warning After the introduction of CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3, the wext code produces a bogus warning: In function 'iw_handler_get_iwstats', inlined from 'ioctl_standard_call' at net/wireless/wext-core.c:1015:9, inlined from 'wireless_process_ioctl' at net/wireless/wext-core.c:935:10, inlined from 'wext_ioctl_dispatch.part.8' at net/wireless/wext-core.c:986:8, inlined from 'wext_handle_ioctl': net/wireless/wext-core.c:671:3: error: argument 1 null where non-null expected [-Werror=nonnull] memcpy(extra, stats, sizeof(struct iw_statistics)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from arch/x86/include/asm/string.h:5, net/wireless/wext-core.c: In function 'wext_handle_ioctl': arch/x86/include/asm/string_64.h:14:14: note: in a call to function 'memcpy' declared here The problem is that ioctl_standard_call() sometimes calls the handler with a NULL argument that would cause a problem for iw_handler_get_iwstats. However, iw_handler_get_iwstats never actually gets called that way. Marking that function as noinline avoids the warning and leads to slightly smaller object code as well. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20200107200741.3588770-1-arnd@arndb.de Signed-off-by: Johannes Berg commit 6f601265215a421f425ba3a4850a35861d024643 Author: Jouni Malinen Date: Tue Jan 7 17:35:45 2020 +0200 mac80211: Fix TKIP replay protection immediately after key setup TKIP replay protection was skipped for the very first frame received after a new key is configured. While this is potentially needed to avoid dropping a frame in some cases, this does leave a window for replay attacks with group-addressed frames at the station side. Any earlier frame sent by the AP using the same key would be accepted as a valid frame and the internal RSC would then be updated to the TSC from that frame. This would allow multiple previously transmitted group-addressed frames to be replayed until the next valid new group-addressed frame from the AP is received by the station. Fix this by limiting the no-replay-protection exception to apply only for the case where TSC=0, i.e., when this is for the very first frame protected using the new key, and the local RSC had not been set to a higher value when configuring the key (which may happen with GTK). Signed-off-by: Jouni Malinen Link: https://lore.kernel.org/r/20200107153545.10934-1-j@w1.fi Signed-off-by: Johannes Berg commit 26ec17a1dc5ecdd8d91aba63ead6f8b5ad5dea0d Author: Orr Mazor Date: Sun Dec 22 14:55:31 2019 +0000 cfg80211: Fix radar event during another phy CAC In case a radar event of CAC_FINISHED or RADAR_DETECTED happens during another phy is during CAC we might need to cancel that CAC. If we got a radar in a channel that another phy is now doing CAC on then the CAC should be canceled there. If, for example, 2 phys doing CAC on the same channels, or on comptable channels, once on of them will finish his CAC the other might need to cancel his CAC, since it is no longer relevant. To fix that the commit adds an callback and implement it in mac80211 to end CAC. This commit also adds a call to said callback if after a radar event we see the CAC is no longer relevant Signed-off-by: Orr Mazor Reviewed-by: Sergey Matyukevich Link: https://lore.kernel.org/r/20191222145449.15792-1-Orr.Mazor@tandemg.com [slightly reformat/reword commit message] Signed-off-by: Johannes Berg commit c4b9d655e445a8be0bff624aedea190606b5ebbc Author: Ganapathi Bhat Date: Fri Dec 20 10:14:32 2019 +0000 wireless: fix enabling channel 12 for custom regulatory domain Commit e33e2241e272 ("Revert "cfg80211: Use 5MHz bandwidth by default when checking usable channels"") fixed a broken regulatory (leaving channel 12 open for AP where not permitted). Apply a similar fix to custom regulatory domain processing. Signed-off-by: Cathy Luo Signed-off-by: Ganapathi Bhat Link: https://lore.kernel.org/r/1576836859-8945-1-git-send-email-ganapathi.bhat@nxp.com [reword commit message, fix coding style, add a comment] Signed-off-by: Johannes Berg commit 508c8772760d4ef9c1a044519b564710c3684fc5 Author: Al Viro Date: Tue Jan 14 22:09:57 2020 -0500 fix autofs regression caused by follow_managed() changes we need to reload ->d_flags after the call of ->d_manage() - the thing might've been called with dentry still negative and have the damn thing turned positive while we'd waited. Fixes: d41efb522e90 "fs/namei.c: pull positivity check into follow_managed()" Reported-by: Ian Kent Tested-by: Ian Kent Signed-off-by: Al Viro commit c64cd6e34ea340adbb2a0a2f99cc884b96dcdca5 Author: Al Viro Date: Fri Jan 10 17:17:19 2020 -0500 reimplement path_mountpoint() with less magic ... and get rid of a bunch of bugs in it. Background: the reason for path_mountpoint() is that umount() really doesn't want attempts to revalidate the root of what it's trying to umount. The thing we want to avoid actually happen from complete_walk(); solution was to do something parallel to normal path_lookupat() and it both went overboard and got the boilerplate subtly (and not so subtly) wrong. A better solution is to do pretty much what the normal path_lookupat() does, but instead of complete_walk() do unlazy_walk(). All it takes to avoid that ->d_weak_revalidate() call... mountpoint_last() goes away, along with everything it got wrong, and so does the magic around LOOKUP_NO_REVAL. Another source of bugs is that when we traverse mounts at the final location (and we need to do that - umount . expects to get whatever's overmounting ., if any, out of the lookup) we really ought to take care of ->d_manage() - as it is, manual umount of autofs automount in progress can lead to unpleasant surprises for the daemon. Easily solved by using handle_lookup_down() instead of follow_mount(). Tested-by: Ian Kent Signed-off-by: Al Viro commit 78912934f4f7dd7a424159c69bf9bdd46e823781 Author: Jens Axboe Date: Tue Jan 14 22:09:06 2020 -0700 io_uring: be consistent in assigning next work from handler If we pass back dependent work in case of links, we need to always ensure that we call the link setup and work prep handler. If not, we might be missing some setup for the next work item. Signed-off-by: Jens Axboe commit e0bbb3461ae000baec13e8ec5b5063202df228df Author: Jens Axboe Date: Tue Jan 14 22:06:11 2020 -0700 io-wq: cancel work if we fail getting a mm reference If we require mm and user context, mark the request for cancellation if we fail to acquire the desired mm. Signed-off-by: Jens Axboe commit 051d75d3bb31d456a41c7dc8cf2b8bd23a96774f Author: Ley Foon Tan Date: Wed Jan 15 09:33:06 2020 +0800 MAINTAINERS: Update Ley Foon Tan's email address @altera.com email is going to removed. Change to @intel.com email. Signed-off-by: Ley Foon Tan commit 8c4df83fbe60787033c89efbae7b5b9c76e7bb60 Author: Lorenzo Bianconi Date: Tue Jan 14 11:21:16 2020 +0100 net: mvneta: fix dma sync size in mvneta_run_xdp Page pool API will start syncing (if requested) starting from page->dma_addr + pool->p.offset. Fix dma sync length in mvneta_run_xdp since we do not need to account xdp headroom Fixes: 07e13edbb6a6 ("net: mvneta: get rid of huge dma sync in mvneta_rx_refill") Signed-off-by: Lorenzo Bianconi Acked-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit 86f3f4cd53707ceeec079b83205c8d3c756eca93 Author: Johan Hovold Date: Tue Jan 14 09:27:29 2020 +0100 r8152: add missing endpoint sanity check Add missing endpoint sanity check to probe in order to prevent a NULL-pointer dereference (or slab out-of-bounds access) when retrieving the interrupt-endpoint bInterval on ndo_open() in case a device lacks the expected endpoints. Fixes: 40a82917b1d3 ("net/usb/r8152: enable interrupt transfer") Cc: hayeswang Signed-off-by: Johan Hovold Signed-off-by: David S. Miller commit aeed8aa3874dc15b9d82a6fe796fd7cfbb684448 Author: Masami Hiramatsu Date: Fri Dec 20 11:31:43 2019 +0900 tracing: trigger: Replace unneeded RCU-list traversals With CONFIG_PROVE_RCU_LIST, I had many suspicious RCU warnings when I ran ftracetest trigger testcases. ----- # dmesg -c > /dev/null # ./ftracetest test.d/trigger ... # dmesg | grep "RCU-list traversed" | cut -f 2 -d ] | cut -f 2 -d " " kernel/trace/trace_events_hist.c:6070 kernel/trace/trace_events_hist.c:1760 kernel/trace/trace_events_hist.c:5911 kernel/trace/trace_events_trigger.c:504 kernel/trace/trace_events_hist.c:1810 kernel/trace/trace_events_hist.c:3158 kernel/trace/trace_events_hist.c:3105 kernel/trace/trace_events_hist.c:5518 kernel/trace/trace_events_hist.c:5998 kernel/trace/trace_events_hist.c:6019 kernel/trace/trace_events_hist.c:6044 kernel/trace/trace_events_trigger.c:1500 kernel/trace/trace_events_trigger.c:1540 kernel/trace/trace_events_trigger.c:539 kernel/trace/trace_events_trigger.c:584 ----- I investigated those warnings and found that the RCU-list traversals in event trigger and hist didn't need to use RCU version because those were called only under event_mutex. I also checked other RCU-list traversals related to event trigger list, and found that most of them were called from event_hist_trigger_func() or hist_unregister_trigger() or register/unregister functions except for a few cases. Replace these unneeded RCU-list traversals with normal list traversal macro and lockdep_assert_held() to check the event_mutex is held. Link: http://lkml.kernel.org/r/157680910305.11685.15110237954275915782.stgit@devnote2 Cc: stable@vger.kernel.org Fixes: 30350d65ac567 ("tracing: Add variable support to hist triggers") Reviewed-by: Tom Zanussi Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 95e20af9fb9ce572129b930967dcb762a318c588 Merge: 452424cdcbca 671c450b6fe0 Author: Linus Torvalds Date: Tue Jan 14 13:33:14 2020 -0800 Merge tag 'nfs-for-5.5-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client bugfixes from Anna Schumaker: "Three NFS over RDMA fixes for bugs Chuck found that can be hit during device removal: - Fix create_qp crash on device unload - Fix completion wait during device removal - Fix oops in receive handler after device removal" * tag 'nfs-for-5.5-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: xprtrdma: Fix oops in Receive handler after device removal xprtrdma: Fix completion wait during device removal xprtrdma: Fix create_qp crash on device unload commit 99c9a923e97a583a38050baa92c9377d73946330 Author: Masami Hiramatsu Date: Fri Jan 10 10:45:39 2020 +0900 tracing/uprobe: Fix double perf_event linking on multiprobe uprobe Fix double perf_event linking to trace_uprobe_filter on multiple uprobe event by moving trace_uprobe_filter under trace_probe_event. In uprobe perf event, trace_uprobe_filter data structure is managing target mm filters (in perf_event) related to each uprobe event. Since commit 60d53e2c3b75 ("tracing/probe: Split trace_event related data from trace_probe") left the trace_uprobe_filter data structure in trace_uprobe, if a trace_probe_event has multiple trace_uprobe (multi-probe event), a perf_event is added to different trace_uprobe_filter on each trace_uprobe. This leads a linked list corruption. To fix this issue, move trace_uprobe_filter to trace_probe_event and link it once on each event instead of each probe. Link: http://lkml.kernel.org/r/157862073931.1800.3800576241181489174.stgit@devnote2 Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Ingo Molnar Cc: "Naveen N . Rao" Cc: Anil S Keshavamurthy Cc: "David S . Miller" Cc: Namhyung Kim Cc: =?utf-8?q?Toke_H=C3=B8iland-J?= =?utf-8?b?w7hyZ2Vuc2Vu?= Cc: Jean-Tsung Hsiao Cc: Jesper Dangaard Brouer Cc: stable@vger.kernel.org Fixes: 60d53e2c3b75 ("tracing/probe: Split trace_event related data from trace_probe") Link: https://lkml.kernel.org/r/20200108171611.GA8472@kernel.org Reported-by: Arnaldo Carvalho de Melo Tested-by: Arnaldo Carvalho de Melo Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit d0695e2351102affd8efae83989056bc4b275917 Author: Changbin Du Date: Sun Jan 12 11:42:31 2020 +0800 tracing: xen: Ordered comparison of function pointers Just as commit 0566e40ce7 ("tracing: initcall: Ordered comparison of function pointers"), this patch fixes another remaining one in xen.h found by clang-9. In file included from arch/x86/xen/trace.c:21: In file included from ./include/trace/events/xen.h:475: In file included from ./include/trace/define_trace.h:102: In file included from ./include/trace/trace_events.h:473: ./include/trace/events/xen.h:69:7: warning: ordered comparison of function \ pointers ('xen_mc_callback_fn_t' (aka 'void (*)(void *)') and 'xen_mc_callback_fn_t') [-Wordered-compare-function-pointers] __field(xen_mc_callback_fn_t, fn) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ./include/trace/trace_events.h:421:29: note: expanded from macro '__field' ^ ./include/trace/trace_events.h:407:6: note: expanded from macro '__field_ext' is_signed_type(type), filter_type); \ ^ ./include/linux/trace_events.h:554:44: note: expanded from macro 'is_signed_type' ^ Fixes: c796f213a6934 ("xen/trace: add multicall tracing") Signed-off-by: Changbin Du Signed-off-by: Steven Rostedt (VMware) commit 4a2f704eb2d831a2d73d7f4cdd54f45c49c3c353 Author: Ming Lei Date: Sat Jan 11 20:57:43 2020 +0800 block: fix get_max_segment_size() overflow on 32bit arch Commit 429120f3df2d starts to take account of segment's start dma address when computing max segment size, and data type of 'unsigned long' is used to do that. However, the segment mask may be 0xffffffff, so the figured out segment size may be overflowed in case of zero physical address on 32bit arch. Fix the issue by returning queue_max_segment_size() directly when that happens. Fixes: 429120f3df2d ("block: fix splitting segments on boundary masks") Reported-by: Guenter Roeck Tested-by: Guenter Roeck Cc: Christoph Hellwig Tested-by: Steven Rostedt (VMware) Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit c742c59e1fbd022b64d91aa9a0092b3a699d653c Author: Sunil Muthuswamy Date: Tue Jan 14 00:52:14 2020 +0000 hv_sock: Remove the accept port restriction Currently, hv_sock restricts the port the guest socket can accept connections on. hv_sock divides the socket port namespace into two parts for server side (listening socket), 0-0x7FFFFFFF & 0x80000000-0xFFFFFFFF (there are no restrictions on client port namespace). The first part (0-0x7FFFFFFF) is reserved for sockets where connections can be accepted. The second part (0x80000000-0xFFFFFFFF) is reserved for allocating ports for the peer (host) socket, once a connection is accepted. This reservation of the port namespace is specific to hv_sock and not known by the generic vsock library (ex: af_vsock). This is problematic because auto-binds/ephemeral ports are handled by the generic vsock library and it has no knowledge of this port reservation and could allocate a port that is not compatible with hv_sock (and legitimately so). The issue hasn't surfaced so far because the auto-bind code of vsock (__vsock_bind_stream) prior to the change 'VSOCK: bind to random port for VMADDR_PORT_ANY' would start walking up from LAST_RESERVED_PORT (1023) and start assigning ports. That will take a large number of iterations to hit 0x7FFFFFFF. But, after the above change to randomize port selection, the issue has started coming up more frequently. There has really been no good reason to have this port reservation logic in hv_sock from the get go. Reserving a local port for peer ports is not how things are handled generally. Peer ports should reflect the peer port. This fixes the issue by lifting the port reservation, and also returns the right peer port. Since the code converts the GUID to the peer port (by using the first 4 bytes), there is a possibility of conflicts, but that seems like a reasonable risk to take, given this is limited to vsock and that only applies to all local sockets. Signed-off-by: Sunil Muthuswamy Signed-off-by: David S. Miller commit f8d7408a4d7f60f8b2df0f81decdc882dd9c20dc Author: Eric Dumazet Date: Mon Jan 13 09:27:11 2020 -0800 net: usb: lan78xx: limit size of local TSO packets lan78xx_tx_bh() makes sure to not exceed MAX_SINGLE_PACKET_SIZE bytes in the aggregated packets it builds, but does nothing to prevent large GSO packets being submitted. Pierre-Francois reported various hangs when/if TSO is enabled. For localy generated packets, we can use netif_set_gso_max_size() to limit the size of TSO packets. Note that forwarded packets could still hit the issue, so a complete fix might require implementing .ndo_features_check for this driver, forcing a software segmentation if the size of the TSO packet exceeds MAX_SINGLE_PACKET_SIZE. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Signed-off-by: Eric Dumazet Reported-by: RENARD Pierre-Francois Tested-by: RENARD Pierre-Francois Cc: Stefan Wahren Cc: Woojung Huh Cc: Microchip Linux Driver Support Signed-off-by: David S. Miller commit 75718584cb3c64e6269109d4d54f888ac5a5fd15 Author: Vladis Dronov Date: Mon Jan 13 14:00:09 2020 +0100 ptp: free ptp device pin descriptors properly There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups() first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs them to destroy a related sysfs device. These functions can not be just swapped, as posix_clock_unregister() frees ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed. This makes this patch fix an UAF bug in a patch which fixes an UAF bug. Reported-by: Antti Laakso Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev") Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/ Signed-off-by: Vladis Dronov Acked-by: Richard Cochran Signed-off-by: David S. Miller commit 7617e9621bf2ca3bb58d5f216cc35c86b029105d Author: Wayne Lin Date: Mon Jan 6 18:21:58 2020 +0800 drm/dp_mst: clear time slots for ports invalid [Why] When change the connection status in a MST topology, mst device which detect the event will send out CONNECTION_STATUS_NOTIFY messgae. e.g. src-mst-mst-sst => src-mst (unplug) mst-sst Currently, under the above case of unplugging device, ports which have been allocated payloads and are no longer in the topology still occupy time slots and recorded in proposed_vcpi[] of topology manager. If we don't clean up the proposed_vcpi[], when code flow goes to try to update payload table by calling drm_dp_update_payload_part1(), we will fail at checking port validation due to there are ports with proposed time slots but no longer in the mst topology. As the result of that, we will also stop updating the DPCD payload table of down stream port. [How] While handling the CONNECTION_STATUS_NOTIFY message, add a detection to see if the event indicates that a device is unplugged to an output port. If the detection is true, then iterrate over all proposed_vcpi[] to see whether a port of the proposed_vcpi[] is still in the topology or not. If the port is invalid, set its num_slots to 0. Thereafter, when try to update payload table by calling drm_dp_update_payload_part1(), we can successfully update the DPCD payload table of down stream port and clear the proposed_vcpi[] to NULL. Changes since v1:(https://patchwork.kernel.org/patch/11275801/) * Invert the conditional to reduce the indenting Reviewed-by: Lyude Paul Signed-off-by: Wayne Lin Signed-off-by: Lyude Paul [removed cc for stable - there's too many patches this depends on for this to backport cleanly] Link: https://patchwork.freedesktop.org/patch/msgid/20200106102158.28261-1-Wayne.Lin@amd.com commit 671c450b6fe0680ea1cb1cf1526d764fdd5a3d3f Author: Chuck Lever Date: Fri Jan 3 11:52:22 2020 -0500 xprtrdma: Fix oops in Receive handler after device removal Since v5.4, a device removal occasionally triggered this oops: Dec 2 17:13:53 manet kernel: BUG: unable to handle page fault for address: 0000000c00000219 Dec 2 17:13:53 manet kernel: #PF: supervisor read access in kernel mode Dec 2 17:13:53 manet kernel: #PF: error_code(0x0000) - not-present page Dec 2 17:13:53 manet kernel: PGD 0 P4D 0 Dec 2 17:13:53 manet kernel: Oops: 0000 [#1] SMP Dec 2 17:13:53 manet kernel: CPU: 2 PID: 468 Comm: kworker/2:1H Tainted: G W 5.4.0-00050-g53717e43af61 #883 Dec 2 17:13:53 manet kernel: Hardware name: Supermicro SYS-6028R-T/X10DRi, BIOS 1.1a 10/16/2015 Dec 2 17:13:53 manet kernel: Workqueue: ib-comp-wq ib_cq_poll_work [ib_core] Dec 2 17:13:53 manet kernel: RIP: 0010:rpcrdma_wc_receive+0x7c/0xf6 [rpcrdma] Dec 2 17:13:53 manet kernel: Code: 6d 8b 43 14 89 c1 89 45 78 48 89 4d 40 8b 43 2c 89 45 14 8b 43 20 89 45 18 48 8b 45 20 8b 53 14 48 8b 30 48 8b 40 10 48 8b 38 <48> 8b 87 18 02 00 00 48 85 c0 75 18 48 8b 05 1e 24 c4 e1 48 85 c0 Dec 2 17:13:53 manet kernel: RSP: 0018:ffffc900035dfe00 EFLAGS: 00010246 Dec 2 17:13:53 manet kernel: RAX: ffff888467290000 RBX: ffff88846c638400 RCX: 0000000000000048 Dec 2 17:13:53 manet kernel: RDX: 0000000000000048 RSI: 00000000f942e000 RDI: 0000000c00000001 Dec 2 17:13:53 manet kernel: RBP: ffff888467611b00 R08: ffff888464e4a3c4 R09: 0000000000000000 Dec 2 17:13:53 manet kernel: R10: ffffc900035dfc88 R11: fefefefefefefeff R12: ffff888865af4428 Dec 2 17:13:53 manet kernel: R13: ffff888466023000 R14: ffff88846c63f000 R15: 0000000000000010 Dec 2 17:13:53 manet kernel: FS: 0000000000000000(0000) GS:ffff88846fa80000(0000) knlGS:0000000000000000 Dec 2 17:13:53 manet kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Dec 2 17:13:53 manet kernel: CR2: 0000000c00000219 CR3: 0000000002009002 CR4: 00000000001606e0 Dec 2 17:13:53 manet kernel: Call Trace: Dec 2 17:13:53 manet kernel: __ib_process_cq+0x5c/0x14e [ib_core] Dec 2 17:13:53 manet kernel: ib_cq_poll_work+0x26/0x70 [ib_core] Dec 2 17:13:53 manet kernel: process_one_work+0x19d/0x2cd Dec 2 17:13:53 manet kernel: ? cancel_delayed_work_sync+0xf/0xf Dec 2 17:13:53 manet kernel: worker_thread+0x1a6/0x25a Dec 2 17:13:53 manet kernel: ? cancel_delayed_work_sync+0xf/0xf Dec 2 17:13:53 manet kernel: kthread+0xf4/0xf9 Dec 2 17:13:53 manet kernel: ? kthread_queue_delayed_work+0x74/0x74 Dec 2 17:13:53 manet kernel: ret_from_fork+0x24/0x30 The proximal cause is that this rpcrdma_rep has a rr_rdmabuf that is still pointing to the old ib_device, which has been freed. The only way that is possible is if this rpcrdma_rep was not destroyed by rpcrdma_ia_remove. Debugging showed that was indeed the case: this rpcrdma_rep was still in use by a completing RPC at the time of the device removal, and thus wasn't on the rep free list. So, it was not found by rpcrdma_reps_destroy(). The fix is to introduce a list of all rpcrdma_reps so that they all can be found when a device is removed. That list is used to perform only regbuf DMA unmapping, replacing that call to rpcrdma_reps_destroy(). Meanwhile, to prevent corruption of this list, I've moved the destruction of temp rpcrdma_rep objects to rpcrdma_post_recvs(). rpcrdma_xprt_drain() ensures that post_recvs (and thus rep_destroy) is not invoked while rpcrdma_reps_unmap is walking rb_all_reps, thus protecting the rb_all_reps list. Fixes: b0b227f071a0 ("xprtrdma: Use an llist to manage free rpcrdma_reps") Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 13cb886c591f341a8759f175292ddf978ef903a1 Author: Chuck Lever Date: Fri Jan 3 11:52:17 2020 -0500 xprtrdma: Fix completion wait during device removal I've found that on occasion, "rmmod " will hang while if an NFS is under load. Ensure that ri_remove_done is initialized only just before the transport is woken up to force a close. This avoids the completion possibly getting initialized again while the CM event handler is waiting for a wake-up. Fixes: bebd031866ca ("xprtrdma: Support unplugging an HCA from under an NFS mount") Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit b32b9ed493f938e191f790a0991d20b18b38c35b Author: Chuck Lever Date: Fri Jan 3 11:52:12 2020 -0500 xprtrdma: Fix create_qp crash on device unload On device re-insertion, the RDMA device driver crashes trying to set up a new QP: Nov 27 16:32:06 manet kernel: BUG: kernel NULL pointer dereference, address: 00000000000001c0 Nov 27 16:32:06 manet kernel: #PF: supervisor write access in kernel mode Nov 27 16:32:06 manet kernel: #PF: error_code(0x0002) - not-present page Nov 27 16:32:06 manet kernel: PGD 0 P4D 0 Nov 27 16:32:06 manet kernel: Oops: 0002 [#1] SMP Nov 27 16:32:06 manet kernel: CPU: 1 PID: 345 Comm: kworker/u28:0 Tainted: G W 5.4.0 #852 Nov 27 16:32:06 manet kernel: Hardware name: Supermicro SYS-6028R-T/X10DRi, BIOS 1.1a 10/16/2015 Nov 27 16:32:06 manet kernel: Workqueue: xprtiod xprt_rdma_connect_worker [rpcrdma] Nov 27 16:32:06 manet kernel: RIP: 0010:atomic_try_cmpxchg+0x2/0x12 Nov 27 16:32:06 manet kernel: Code: ff ff 48 8b 04 24 5a c3 c6 07 00 0f 1f 40 00 c3 31 c0 48 81 ff 08 09 68 81 72 0c 31 c0 48 81 ff 83 0c 68 81 0f 92 c0 c3 8b 06 0f b1 17 0f 94 c2 84 d2 75 02 89 06 88 d0 c3 53 ba 01 00 00 00 Nov 27 16:32:06 manet kernel: RSP: 0018:ffffc900035abbf0 EFLAGS: 00010046 Nov 27 16:32:06 manet kernel: RAX: 0000000000000000 RBX: 00000000000001c0 RCX: 0000000000000000 Nov 27 16:32:06 manet kernel: RDX: 0000000000000001 RSI: ffffc900035abbfc RDI: 00000000000001c0 Nov 27 16:32:06 manet kernel: RBP: ffffc900035abde0 R08: 000000000000000e R09: ffffffffffffc000 Nov 27 16:32:06 manet kernel: R10: 0000000000000000 R11: 000000000002e800 R12: ffff88886169d9f8 Nov 27 16:32:06 manet kernel: R13: ffff88886169d9f4 R14: 0000000000000246 R15: 0000000000000000 Nov 27 16:32:06 manet kernel: FS: 0000000000000000(0000) GS:ffff88846fa40000(0000) knlGS:0000000000000000 Nov 27 16:32:06 manet kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Nov 27 16:32:06 manet kernel: CR2: 00000000000001c0 CR3: 0000000002009006 CR4: 00000000001606e0 Nov 27 16:32:06 manet kernel: Call Trace: Nov 27 16:32:06 manet kernel: do_raw_spin_lock+0x2f/0x5a Nov 27 16:32:06 manet kernel: create_qp_common.isra.47+0x856/0xadf [mlx4_ib] Nov 27 16:32:06 manet kernel: ? slab_post_alloc_hook.isra.60+0xa/0x1a Nov 27 16:32:06 manet kernel: ? __kmalloc+0x125/0x139 Nov 27 16:32:06 manet kernel: mlx4_ib_create_qp+0x57f/0x972 [mlx4_ib] The fix is to copy the qp_init_attr struct that was just created by rpcrdma_ep_create() instead of using the one from the previous connection instance. Fixes: 98ef77d1aaa7 ("xprtrdma: Send Queue size grows after a reconnect") Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 452424cdcbcaf6a2ebaae4301da5a4e1850a941a Merge: 67373994d275 8b7f938e0a03 Author: Linus Torvalds Date: Tue Jan 14 10:22:10 2020 -0800 Merge branch 'parisc-5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: "A boot crash fix by Mike Rapoport and a printk fix by Krzysztof Kozlowski" * 'parisc-5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: fix map_pages() to actually populate upper directory parisc: Use proper printk format for resource_size_t commit 67373994d275c78043d7e9256ad31d8ebb9b065d Merge: c21ed4d9a636 060dc911501f Author: Linus Torvalds Date: Tue Jan 14 10:17:15 2020 -0800 Merge tag 'asm-generic-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground Pull asm-generic fixes from Arnd Bergmann: "Here are two bugfixes from Mike Rapoport, both fixing compile-time errors for the nds32 architecture that were recently introduced" * tag 'asm-generic-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground: nds32: fix build failure caused by page table folding updates asm-generic/nds32: don't redefine cacheflush primitives commit c21ed4d9a636500e66642221d3880c3f9569964f Merge: e033e7d4a808 529244bd1afc Author: Linus Torvalds Date: Tue Jan 14 10:14:06 2020 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two simple fixes in the upper drivers (so both fairly core), one in enclosures, which fixes replugging a device into an enclosure slot and one in the disk driver which fixes revalidating a drive with protection information (PI) to make it a non-PI drive ... previously we were still remembering the old PI state. Both fixed issues are quite rare in the field" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: enclosure: Fix stale device oops with hot replug scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI commit e033e7d4a8081852b2cca53e530e2c0f4e6769c0 Merge: 3f1f9a9b715c f52b83b0b1c4 Author: Linus Torvalds Date: Tue Jan 14 09:56:31 2020 -0800 Merge branch 'dhowells' (patches from DavidH) Merge misc fixes from David Howells. Two afs fixes and a key refcounting fix. * dhowells: afs: Fix afs_lookup() to not clobber the version on a new dentry afs: Fix use-after-loss-of-ref keys: Fix request_key() cache commit f52b83b0b1c40ada38df917973ab719a4a753951 Author: David Howells Date: Tue Jan 14 16:16:54 2020 +0000 afs: Fix afs_lookup() to not clobber the version on a new dentry Fix afs_lookup() to not clobber the version set on a new dentry by afs_do_lookup() - especially as it's using the wrong version of the version (we need to use the one given to us by whatever op the dir contents correspond to rather than what's in the afs_vnode). Fixes: 9dd0b82ef530 ("afs: Fix missing dentry data version updating") Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 40a708bd622b78582ae3d280de29b09b50bd04c0 Author: David Howells Date: Tue Jan 14 16:16:25 2020 +0000 afs: Fix use-after-loss-of-ref afs_lookup() has a tracepoint to indicate the outcome of d_splice_alias(), passing it the inode to retrieve the fid from. However, the function gave up its ref on that inode when it called d_splice_alias(), which may have failed and dropped the inode. Fix this by caching the fid. Fixes: 80548b03991f ("afs: Add more tracepoints") Reported-by: Al Viro Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 8379bb84be757d5df2d818509faec5d66adb861d Author: David Howells Date: Tue Jan 14 16:06:14 2020 +0000 keys: Fix request_key() cache When the key cached by request_key() and co. is cleaned up on exit(), the code looks in the wrong task_struct, and so clears the wrong cache. This leads to anomalies in key refcounting when doing, say, a kernel build on an afs volume, that then trigger kasan to report a use-after-free when the key is viewed in /proc/keys. Fix this by making exit_creds() look in the passed-in task_struct rather than in current (the task_struct cleanup code is deferred by RCU and potentially run in another task). Fixes: 7743c48e54ee ("keys: Cache result of request_key*() temporarily in task_struct") Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 3f1f9a9b715cfa5d9933a024807e32b206775f83 Merge: 63d264fe0868 554913f600b4 Author: Linus Torvalds Date: Tue Jan 14 09:22:51 2020 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "11 mm fixes" * emailed patches from Andrew Morton : mm: khugepaged: add trace status description for SCAN_PAGE_HAS_PRIVATE mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is valid mm/page-writeback.c: improve arithmetic divisions mm/page-writeback.c: use div64_ul() for u64-by-unsigned-long divide mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio() mm, debug_pagealloc: don't rely on static keys too early mm: memcg/slab: fix percpu slab vmstats flushing mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD alignment mm/memory_hotplug: don't free usage map when removing a re-added early section mm, thp: tweak reclaim/compaction effort of local-only and all-node allocations commit fb85145c04447035c07cd609302d6996eb217a1d Author: David Woodhouse Date: Thu Nov 21 14:53:11 2019 +0000 Documentation/process: Add Amazon contact for embargoed hardware issues Signed-off-by: David Woodhouse Link: https://lore.kernel.org/r/da6467d2649339b42339124fd19a8a2f91cc00dd.camel@infradead.org Signed-off-by: Greg Kroah-Hartman commit 0e31e3573f0cd94d7b821117db854187ffc85765 Author: Brendan Higgins Date: Thu Dec 12 16:35:22 2019 -0800 lkdtm/bugs: fix build error in lkdtm_UNSET_SMEP When building ARCH=um with CONFIG_UML_X86=y and CONFIG_64BIT=y we get the build errors: drivers/misc/lkdtm/bugs.c: In function ‘lkdtm_UNSET_SMEP’: drivers/misc/lkdtm/bugs.c:288:8: error: implicit declaration of function ‘native_read_cr4’ [-Werror=implicit-function-declaration] cr4 = native_read_cr4(); ^~~~~~~~~~~~~~~ drivers/misc/lkdtm/bugs.c:290:13: error: ‘X86_CR4_SMEP’ undeclared (first use in this function); did you mean ‘X86_FEATURE_SMEP’? if ((cr4 & X86_CR4_SMEP) != X86_CR4_SMEP) { ^~~~~~~~~~~~ X86_FEATURE_SMEP drivers/misc/lkdtm/bugs.c:290:13: note: each undeclared identifier is reported only once for each function it appears in drivers/misc/lkdtm/bugs.c:297:2: error: implicit declaration of function ‘native_write_cr4’; did you mean ‘direct_write_cr4’? [-Werror=implicit-function-declaration] native_write_cr4(cr4); ^~~~~~~~~~~~~~~~ direct_write_cr4 So specify that this block of code should only build when CONFIG_X86_64=y *AND* CONFIG_UML is unset. Signed-off-by: Brendan Higgins Acked-by: Kees Cook Link: https://lore.kernel.org/r/20191213003522.66450-1-brendanhiggins@google.com Signed-off-by: Greg Kroah-Hartman commit cea23efb4de2d31e72a576026b213e15d6792976 Author: Kees Cook Date: Thu Jan 2 12:29:17 2020 -0800 lkdtm/bugs: Make double-fault test always available Adjust the DOUBLE_FAULT test to always be available (so test harnesses don't have to make exceptions more missing tests), and for the arch-specific tests to "XFAIL" so that test harnesses can reason about expected vs unexpected failures. Fixes: b09511c253e5 ("lkdtm: Add a DOUBLE_FAULT crash type on x86") Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/202001021226.751D3F869D@keescook Signed-off-by: Greg Kroah-Hartman commit 500589d8bd73cc4c1fc8dc433b675cea5fe79e86 Author: Arnd Bergmann Date: Fri Dec 13 15:31:07 2019 -0700 coresight: etm4x: Fix unused function warning Some of the newly added code in the etm4x driver is inside of an #ifdef, and some other code is outside of it, leading to a harmless warning when CONFIG_CPU_PM is disabled: drivers/hwtracing/coresight/coresight-etm4x.c:68:13: error: 'etm4_os_lock' defined but not used [-Werror=unused-function] static void etm4_os_lock(struct etmv4_drvdata *drvdata) ^~~~~~~~~~~~ To avoid the warning and simplify the the #ifdef checks, use IS_ENABLED() instead, so the compiler can drop the unused functions without complaining. Fixes: f188b5e76aae ("coresight: etm4x: Save/restore state across CPU low power states") Signed-off-by: Arnd Bergmann [Fixed capital 'f' in title] Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20191213223107.1484-2-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 5e28055f340275a8616eee88ef19186631b4d136 Author: Johan Hovold Date: Mon Jan 13 18:22:13 2020 +0100 USB: serial: opticon: fix control-message timeouts The driver was issuing synchronous uninterruptible control requests without using a timeout. This could lead to the driver hanging on open() or tiocmset() due to a malfunctioning (or malicious) device until the device is physically disconnected. The USB upper limit of five seconds per request should be more than enough. Fixes: 309a057932ab ("USB: opticon: add rts and cts support") Cc: stable # 2.6.39 Cc: Martin Jansen Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 5d1b71226dc4d44b4b65766fa9d74492f9d4587b Author: Johan Hovold Date: Tue Jan 14 09:39:53 2020 +0100 ALSA: usb-audio: fix sync-ep altsetting sanity check The altsetting sanity check in set_sync_ep_implicit_fb_quirk() was checking for there to be at least one altsetting but then went on to access the second one, which may not exist. This could lead to random slab data being used to initialise the sync endpoint in snd_usb_add_endpoint(). Fixes: c75a8a7ae565 ("ALSA: snd-usb: add support for implicit feedback") Fixes: ca10a7ebdff1 ("ALSA: usb-audio: FT C400 sync playback EP to capture EP") Fixes: 5e35dc0338d8 ("ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204") Fixes: 17f08b0d9aaf ("ALSA: usb-audio: add implicit fb quirk for Axe-Fx II") Fixes: 103e9625647a ("ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk") Cc: stable # 3.5 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20200114083953.1106-1-johan@kernel.org Signed-off-by: Takashi Iwai commit 8b7f938e0a03776124781f19fb22443dfb519cff Author: Mike Rapoport Date: Wed Jan 8 14:58:52 2020 +0200 parisc: fix map_pages() to actually populate upper directory The commit d96885e277b5 ("parisc: use pgtable-nopXd instead of 4level-fixup") converted PA-RISC to use folded page tables, but it missed the conversion of pgd_populate() to pud_populate() in maps_pages() function. This caused the upper page table directory to remain empty and the system would crash as a result. Using pud_populate() that actually populates the page table instead of dummy pgd_populate() fixes the issue. Fixes: d96885e277b5 ("parisc: use pgtable-nopXd instead of 4level-fixup") Reported-by: Meelis Roos Reported-by: Jeroen Roovers Reported-by: Mikulas Patocka Tested-by: Jeroen Roovers Tested-by: Mikulas Patocka Signed-off-by: Mike Rapoport Signed-off-by: Helge Deller commit 4f80b70e1953cb846dbdd1ce72cb17333d4c8d11 Author: Krzysztof Kozlowski Date: Fri Jan 3 17:39:25 2020 +0100 parisc: Use proper printk format for resource_size_t resource_size_t should be printed with its own size-independent format to fix warnings when compiling on 64-bit platform (e.g. with COMPILE_TEST): arch/parisc/kernel/drivers.c: In function 'print_parisc_device': arch/parisc/kernel/drivers.c:892:9: warning: format '%p' expects argument of type 'void *', but argument 4 has type 'resource_size_t {aka unsigned int}' [-Wformat=] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Helge Deller commit 8aaea2b0428b6aad7c7e22d3fddc31a78bb1d724 Author: Xu Wang Date: Mon Jan 13 09:00:36 2020 +0000 xfrm: interface: do not confirm neighbor when do pmtu update When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end, we should not call dst_confirm_neigh() as there is no two-way communication. Signed-off-by: Xu Wang Signed-off-by: Steffen Klassert commit f042365dbffea98fb8148c98c700402e8d099f02 Author: Nicolas Dichtel Date: Mon Jan 13 09:32:47 2020 +0100 xfrm interface: fix packet tx through bpf_redirect() With an ebpf program that redirects packets through a xfrm interface, packets are dropped because no dst is attached to skb. This could also be reproduced with an AF_PACKET socket, with the following python script (xfrm1 is a xfrm interface): import socket send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0) # scapy # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request') # raw(p) req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00' send_s.sendto(req, ('xfrm1', 0x800, 0, 0)) It was also not possible to send an ip packet through an AF_PACKET socket because a LL header was expected. Let's remove those LL header constraints. Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert commit 95224166a9032ff5d08fca633d37113078ce7d01 Author: Nicolas Dichtel Date: Mon Jan 13 09:32:46 2020 +0100 vti[6]: fix packet tx through bpf_redirect() With an ebpf program that redirects packets through a vti[6] interface, the packets are dropped because no dst is attached. This could also be reproduced with an AF_PACKET socket, with the following python script (vti1 is an ip_vti interface): import socket send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0) # scapy # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request') # raw(p) req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00' send_s.sendto(req, ('vti1', 0x800, 0, 0)) Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert commit 88550e1c345c6d3f70292fa60d481eb320e11953 Author: Tvrtko Ursulin Date: Fri Jan 10 11:32:53 2020 +0000 drm/i915/pmu: Do not use colons or dashes in PMU names We use PCI device path in the registered PMU name in order to distinguish between multiple GPUs. But since tools/perf reserves a special meaning to dash and colon characters we need to transliterate them to something else. We choose an underscore. v2: * Use strreplace. (Chris) * Dashes are not good either. (Chris) Signed-off-by: Tvrtko Ursulin Reported-by: Dmitry Rogozhkin Fixes: 05488673a4d4 ("drm/i915/pmu: Support multiple GPUs") Cc: Chris Wilson Cc: Michal Wajdeczko Cc: Andi Kleen Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200110113253.12535-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit aebf3b521b34ca49f6e81c667f92364334ca27cf) Signed-off-by: Joonas Lahtinen commit a112adafcb47760feff959ee1ecd10b74d2c5467 Author: Johan Hovold Date: Mon Jan 13 18:23:58 2020 +0100 NFC: pn533: fix bulk-message timeout The driver was doing a synchronous uninterruptible bulk-transfer without using a timeout. This could lead to the driver hanging on probe due to a malfunctioning (or malicious) device until the device is physically disconnected. While sleeping in probe the driver prevents other devices connected to the same hub from being added to (or removed from) the bus. An arbitrary limit of five seconds should be more than enough. Fixes: dbafc28955fa ("NFC: pn533: don't send USB data off of the stack") Signed-off-by: Johan Hovold Reviewed-by: Greg Kroah-Hartman Signed-off-by: Jakub Kicinski commit a9ff44f0e61d074f29770413fef6a5452be7b83e Author: Kristian Evensen Date: Mon Jan 13 14:57:40 2020 +0100 qmi_wwan: Add support for Quectel RM500Q RM500Q is a 5G module from Quectel, supporting both standalone and non-standalone modes. The normal Quectel quirks apply (DTR and dynamic interface numbers). Signed-off-by: Kristian Evensen Acked-by: Bjørn Mork Signed-off-by: Jakub Kicinski commit 63d264fe0868cb755a3a887ee7b7b6e3da786804 Merge: b3a987b0264d bc8a76a152c5 Author: Linus Torvalds Date: Mon Jan 13 18:40:57 2020 -0800 Merge tag 'Intel-CVE-2019-14615' from bundle by Akeem Abodunrin. Merge Intel Gen9 graphics fix from Akeem Abodunrin: "Insufficient control flow in certain data structures for some Intel Processors with Intel Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access This provides mitigation for Gen9 hardware. Note that Gen8 is not impacted due to a previously implemented workaround. The mitigation involves using an existing hardware feature to forcibly clear down all EU state at each context switch" * tag 'Intel-CVE-2019-14615' of emailed bundle from Akeem G Abodunrin : drm/i915/gen9: Clear residual context state on context switch commit fd2a89146ae57068e8f86b2fcb91d23a8db6a3c2 Author: Milind Parab Date: Mon Jan 13 03:30:43 2020 +0000 net: macb: fix for fixed-link mode This patch fix the issue with fixed link. With fixed-link device opening fails due to macb_phylink_connect not handling fixed-link mode, in which case no MAC-PHY connection is needed and phylink_connect return success (0), however in current driver attempt is made to search and connect to PHY even for fixed-link. Fixes: 7897b071ac3b ("net: macb: convert to phylink") Signed-off-by: Milind Parab Reviewed-by: Claudiu Beznea Signed-off-by: Jakub Kicinski commit 74566df3a71c1b92da608868cca787557d8be7b2 Author: Jens Axboe Date: Mon Jan 13 19:23:24 2020 -0700 io_uring: don't setup async context for read/write fixed We don't need it, and if we have it, then the retry handler will attempt to copy the non-existent iovec with the inline iovec, with a segment count that doesn't make sense. Fixes: f67676d160c6 ("io_uring: ensure async punted read/write requests copy iovec") Reported-by: Jonathan Lemon Signed-off-by: Jens Axboe commit 554913f600b45d73de12ad58c1ac7baa0f22a703 Author: Yang Shi Date: Mon Jan 13 16:29:36 2020 -0800 mm: khugepaged: add trace status description for SCAN_PAGE_HAS_PRIVATE Commit 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") introduced a new khugepaged scan result: SCAN_PAGE_HAS_PRIVATE, but the corresponding description for trace events were not added. Link: http://lkml.kernel.org/r/1574793844-2914-1-git-send-email-yang.shi@linux.alibaba.com Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") Signed-off-by: Yang Shi Cc: Song Liu Cc: Kirill A. Shutemov Cc: Anshuman Khandual Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2fe20210fc5f5e62644678b8f927c49f2c6f42a7 Author: Adrian Huang Date: Mon Jan 13 16:29:32 2020 -0800 mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is valid When booting with amd_iommu=off, the following WARNING message appears: AMD-Vi: AMD IOMMU disabled on kernel command-line ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at kernel/workqueue.c:2772 flush_workqueue+0x42e/0x450 Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.5.0-rc3-amd-iommu #6 Hardware name: Lenovo ThinkSystem SR655-2S/7D2WRCZ000, BIOS D8E101L-1.00 12/05/2019 RIP: 0010:flush_workqueue+0x42e/0x450 Code: ff 0f 0b e9 7a fd ff ff 4d 89 ef e9 33 fe ff ff 0f 0b e9 7f fd ff ff 0f 0b e9 bc fd ff ff 0f 0b e9 a8 fd ff ff e8 52 2c fe ff <0f> 0b 31 d2 48 c7 c6 e0 88 c5 95 48 c7 c7 d8 ad f0 95 e8 19 f5 04 Call Trace: kmem_cache_destroy+0x69/0x260 iommu_go_to_state+0x40c/0x5ab amd_iommu_prepare+0x16/0x2a irq_remapping_prepare+0x36/0x5f enable_IR_x2apic+0x21/0x172 default_setup_apic_routing+0x12/0x6f apic_intr_mode_init+0x1a1/0x1f1 x86_late_time_init+0x17/0x1c start_kernel+0x480/0x53f secondary_startup_64+0xb6/0xc0 ---[ end trace 30894107c3749449 ]--- x2apic: IRQ remapping doesn't support X2APIC mode x2apic disabled The warning is caused by the calling of 'kmem_cache_destroy()' in free_iommu_resources(). Here is the call path: free_iommu_resources kmem_cache_destroy flush_memcg_workqueue flush_workqueue The root cause is that the IOMMU subsystem runs before the workqueue subsystem, which the variable 'wq_online' is still 'false'. This leads to the statement 'if (WARN_ON(!wq_online))' in flush_workqueue() is 'true'. Since the variable 'memcg_kmem_cache_wq' is not allocated during the time, it is unnecessary to call flush_memcg_workqueue(). This prevents the WARNING message triggered by flush_workqueue(). Link: http://lkml.kernel.org/r/20200103085503.1665-1-ahuang12@lenovo.com Fixes: 92ee383f6daab ("mm: fix race between kmem_cache destroy, create and deactivate") Signed-off-by: Adrian Huang Reported-by: Xiaochun Lee Reviewed-by: Shakeel Butt Cc: Joerg Roedel Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Michal Hocko Cc: Johannes Weiner Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0a5d1a7f64702c351d1f47ef159a0df8c71be0b0 Author: Wen Yang Date: Mon Jan 13 16:29:29 2020 -0800 mm/page-writeback.c: improve arithmetic divisions Use div64_ul() instead of do_div() if the divisor is unsigned long, to avoid truncation to 32-bit on 64-bit platforms. Link: http://lkml.kernel.org/r/20200102081442.8273-4-wenyang@linux.alibaba.com Signed-off-by: Wen Yang Reviewed-by: Andrew Morton Cc: Qian Cai Cc: Tejun Heo Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d3ac946ec9de10ec4b9718ad30703c5e077916a1 Author: Wen Yang Date: Mon Jan 13 16:29:26 2020 -0800 mm/page-writeback.c: use div64_ul() for u64-by-unsigned-long divide The two variables 'numerator' and 'denominator', though they are declared as long, they should actually be unsigned long (according to the implementation of the fprop_fraction_percpu() function) And do_div() does a 64-by-32 division, while the divisor 'denominator' is unsigned long, thus 64-bit on 64-bit platforms. Hence the proper function to call is div64_ul(). Link: http://lkml.kernel.org/r/20200102081442.8273-3-wenyang@linux.alibaba.com Signed-off-by: Wen Yang Reviewed-by: Andrew Morton Cc: Qian Cai Cc: Tejun Heo Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6d9e8c651dd979aa666bee15f086745f3ea9c4b3 Author: Wen Yang Date: Mon Jan 13 16:29:23 2020 -0800 mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio() Patch series "use div64_ul() instead of div_u64() if the divisor is unsigned long". We were first inspired by commit b0ab99e7736a ("sched: Fix possible divide by zero in avg_atom () calculation"), then refer to the recently analyzed mm code, we found this suspicious place. 201 if (min) { 202 min *= this_bw; 203 do_div(min, tot_bw); 204 } And we also disassembled and confirmed it: /usr/src/debug/kernel-4.9.168-016.ali3000/linux-4.9.168-016.ali3000.alios7.x86_64/mm/page-writeback.c: 201 0xffffffff811c37da <__wb_calc_thresh+234>: xor %r10d,%r10d 0xffffffff811c37dd <__wb_calc_thresh+237>: test %rax,%rax 0xffffffff811c37e0 <__wb_calc_thresh+240>: je 0xffffffff811c3800 <__wb_calc_thresh+272> /usr/src/debug/kernel-4.9.168-016.ali3000/linux-4.9.168-016.ali3000.alios7.x86_64/mm/page-writeback.c: 202 0xffffffff811c37e2 <__wb_calc_thresh+242>: imul %r8,%rax /usr/src/debug/kernel-4.9.168-016.ali3000/linux-4.9.168-016.ali3000.alios7.x86_64/mm/page-writeback.c: 203 0xffffffff811c37e6 <__wb_calc_thresh+246>: mov %r9d,%r10d ---> truncates it to 32 bits here 0xffffffff811c37e9 <__wb_calc_thresh+249>: xor %edx,%edx 0xffffffff811c37eb <__wb_calc_thresh+251>: div %r10 0xffffffff811c37ee <__wb_calc_thresh+254>: imul %rbx,%rax 0xffffffff811c37f2 <__wb_calc_thresh+258>: shr $0x2,%rax 0xffffffff811c37f6 <__wb_calc_thresh+262>: mul %rcx 0xffffffff811c37f9 <__wb_calc_thresh+265>: shr $0x2,%rdx 0xffffffff811c37fd <__wb_calc_thresh+269>: mov %rdx,%r10 This series uses div64_ul() instead of div_u64() if the divisor is unsigned long, to avoid truncation to 32-bit on 64-bit platforms. This patch (of 3): The variables 'min' and 'max' are unsigned long and do_div truncates them to 32 bits, which means it can test non-zero and be truncated to zero for division. Fix this issue by using div64_ul() instead. Link: http://lkml.kernel.org/r/20200102081442.8273-2-wenyang@linux.alibaba.com Fixes: 693108a8a667 ("writeback: make bdi->min/max_ratio handling cgroup writeback aware") Signed-off-by: Wen Yang Reviewed-by: Andrew Morton Cc: Qian Cai Cc: Tejun Heo Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8e57f8acbbd121ecfb0c9dc13b8b030f86c6bd3b Author: Vlastimil Babka Date: Mon Jan 13 16:29:20 2020 -0800 mm, debug_pagealloc: don't rely on static keys too early Commit 96a2b03f281d ("mm, debug_pagelloc: use static keys to enable debugging") has introduced a static key to reduce overhead when debug_pagealloc is compiled in but not enabled. It relied on the assumption that jump_label_init() is called before parse_early_param() as in start_kernel(), so when the "debug_pagealloc=on" option is parsed, it is safe to enable the static key. However, it turns out multiple architectures call parse_early_param() earlier from their setup_arch(). x86 also calls jump_label_init() even earlier, so no issue was found while testing the commit, but same is not true for e.g. ppc64 and s390 where the kernel would not boot with debug_pagealloc=on as found by our QA. To fix this without tricky changes to init code of multiple architectures, this patch partially reverts the static key conversion from 96a2b03f281d. Init-time and non-fastpath calls (such as in arch code) of debug_pagealloc_enabled() will again test a simple bool variable. Fastpath mm code is converted to a new debug_pagealloc_enabled_static() variant that relies on the static key, which is enabled in a well-defined point in mm_init() where it's guaranteed that jump_label_init() has been called, regardless of architecture. [sfr@canb.auug.org.au: export _debug_pagealloc_enabled_early] Link: http://lkml.kernel.org/r/20200106164944.063ac07b@canb.auug.org.au Link: http://lkml.kernel.org/r/20191219130612.23171-1-vbabka@suse.cz Fixes: 96a2b03f281d ("mm, debug_pagelloc: use static keys to enable debugging") Signed-off-by: Vlastimil Babka Signed-off-by: Stephen Rothwell Cc: Joonsoo Kim Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: Vlastimil Babka Cc: Matthew Wilcox Cc: Mel Gorman Cc: Peter Zijlstra Cc: Borislav Petkov Cc: Qian Cai Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4a87e2a25dc27131c3cce5e94421622193305638 Author: Roman Gushchin Date: Mon Jan 13 16:29:16 2020 -0800 mm: memcg/slab: fix percpu slab vmstats flushing Currently slab percpu vmstats are flushed twice: during the memcg offlining and just before freeing the memcg structure. Each time percpu counters are summed, added to the atomic counterparts and propagated up by the cgroup tree. The second flushing is required due to how recursive vmstats are implemented: counters are batched in percpu variables on a local level, and once a percpu value is crossing some predefined threshold, it spills over to atomic values on the local and each ascendant levels. It means that without flushing some numbers cached in percpu variables will be dropped on floor each time a cgroup is destroyed. And with uptime the error on upper levels might become noticeable. The first flushing aims to make counters on ancestor levels more precise. Dying cgroups may resume in the dying state for a long time. After kmem_cache reparenting which is performed during the offlining slab counters of the dying cgroup don't have any chances to be updated, because any slab operations will be performed on the parent level. It means that the inaccuracy caused by percpu batching will not decrease up to the final destruction of the cgroup. By the original idea flushing slab counters during the offlining should minimize the visible inaccuracy of slab counters on the parent level. The problem is that percpu counters are not zeroed after the first flushing. So every cached percpu value is summed twice. It creates a small error (up to 32 pages per cpu, but usually less) which accumulates on parent cgroup level. After creating and destroying of thousands of child cgroups, slab counter on parent level can be way off the real value. For now, let's just stop flushing slab counters on memcg offlining. It can't be done correctly without scheduling a work on each cpu: reading and zeroing it during css offlining can race with an asynchronous update, which doesn't expect values to be changed underneath. With this change, slab counters on parent level will become eventually consistent. Once all dying children are gone, values are correct. And if not, the error is capped by 32 * NR_CPUS pages per dying cgroup. It's not perfect, as slab are reparented, so any updates after the reparenting will happen on the parent level. It means that if a slab page was allocated, a counter on child level was bumped, then the page was reparented and freed, the annihilation of positive and negative counter values will not happen until the child cgroup is released. It makes slab counters different from others, and it might want us to implement flushing in a correct form again. But it's also a question of performance: scheduling a work on each cpu isn't free, and it's an open question if the benefit of having more accurate counters is worth it. We might also consider flushing all counters on offlining, not only slab counters. So let's fix the main problem now: make the slab counters eventually consistent, so at least the error won't grow with uptime (or more precisely the number of created and destroyed cgroups). And think about the accuracy of counters separately. Link: http://lkml.kernel.org/r/20191220042728.1045881-1-guro@fb.com Fixes: bee07b33db78 ("mm: memcontrol: flush percpu slab vmstats on kmem offlining") Signed-off-by: Roman Gushchin Acked-by: Johannes Weiner Acked-by: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 991589974d9c9ecb24ee3799ec8c415c730598a2 Author: Kirill A. Shutemov Date: Mon Jan 13 16:29:13 2020 -0800 mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment Shmem/tmpfs tries to provide THP-friendly mappings if huge pages are enabled. But it doesn't work well with above-47bit hint address. Normally, the kernel doesn't create userspace mappings above 47-bit, even if the machine allows this (such as with 5-level paging on x86-64). Not all user space is ready to handle wide addresses. It's known that at least some JIT compilers use higher bits in pointers to encode their information. Userspace can ask for allocation from full address space by specifying hint address (with or without MAP_FIXED) above 47-bits. If the application doesn't need a particular address, but wants to allocate from whole address space it can specify -1 as a hint address. Unfortunately, this trick breaks THP alignment in shmem/tmp: shmem_get_unmapped_area() would not try to allocate PMD-aligned area if *any* hint address specified. This can be fixed by requesting the aligned area if the we failed to allocated at user-specified hint address. The request with inflated length will also take the user-specified hint address. This way we will not lose an allocation request from the full address space. [kirill@shutemov.name: fold in a fixup] Link: http://lkml.kernel.org/r/20191223231309.t6bh5hkbmokihpfu@box Link: http://lkml.kernel.org/r/20191220142548.7118-3-kirill.shutemov@linux.intel.com Fixes: b569bab78d8d ("x86/mm: Prepare to expose larger address space to userspace") Signed-off-by: Kirill A. Shutemov Cc: "Willhalm, Thomas" Cc: Dan Williams Cc: "Bruggeman, Otto G" Cc: "Aneesh Kumar K . V" Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 97d3d0f9a1cf132c63c0b8b8bd497b8a56283dd9 Author: Kirill A. Shutemov Date: Mon Jan 13 16:29:10 2020 -0800 mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD alignment Patch series "Fix two above-47bit hint address vs. THP bugs". The two get_unmapped_area() implementations have to be fixed to provide THP-friendly mappings if above-47bit hint address is specified. This patch (of 2): Filesystems use thp_get_unmapped_area() to provide THP-friendly mappings. For DAX in particular. Normally, the kernel doesn't create userspace mappings above 47-bit, even if the machine allows this (such as with 5-level paging on x86-64). Not all user space is ready to handle wide addresses. It's known that at least some JIT compilers use higher bits in pointers to encode their information. Userspace can ask for allocation from full address space by specifying hint address (with or without MAP_FIXED) above 47-bits. If the application doesn't need a particular address, but wants to allocate from whole address space it can specify -1 as a hint address. Unfortunately, this trick breaks thp_get_unmapped_area(): the function would not try to allocate PMD-aligned area if *any* hint address specified. Modify the routine to handle it correctly: - Try to allocate the space at the specified hint address with length padding required for PMD alignment. - If failed, retry without length padding (but with the same hint address); - If the returned address matches the hint address return it. - Otherwise, align the address as required for THP and return. The user specified hint address is passed down to get_unmapped_area() so above-47bit hint address will be taken into account without breaking alignment requirements. Link: http://lkml.kernel.org/r/20191220142548.7118-2-kirill.shutemov@linux.intel.com Fixes: b569bab78d8d ("x86/mm: Prepare to expose larger address space to userspace") Signed-off-by: Kirill A. Shutemov Reported-by: Thomas Willhalm Tested-by: Dan Williams Cc: "Aneesh Kumar K . V" Cc: "Bruggeman, Otto G" Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8068df3b60373c390198f660574ea14c8098de57 Author: David Hildenbrand Date: Mon Jan 13 16:29:07 2020 -0800 mm/memory_hotplug: don't free usage map when removing a re-added early section When we remove an early section, we don't free the usage map, as the usage maps of other sections are placed into the same page. Once the section is removed, it is no longer an early section (especially, the memmap is freed). When we re-add that section, the usage map is reused, however, it is no longer an early section. When removing that section again, we try to kfree() a usage map that was allocated during early boot - bad. Let's check against PageReserved() to see if we are dealing with an usage map that was allocated during boot. We could also check against !(PageSlab(usage_page) || PageCompound(usage_page)), but PageReserved() is cleaner. Can be triggered using memtrace under ppc64/powernv: $ mount -t debugfs none /sys/kernel/debug/ $ echo 0x20000000 > /sys/kernel/debug/powerpc/memtrace/enable $ echo 0x20000000 > /sys/kernel/debug/powerpc/memtrace/enable ------------[ cut here ]------------ kernel BUG at mm/slub.c:3969! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=3D64K MMU=3DHash SMP NR_CPUS=3D2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 154 Comm: sh Not tainted 5.5.0-rc2-next-20191216-00005-g0be1dba7b7c0 #61 NIP kfree+0x338/0x3b0 LR section_deactivate+0x138/0x200 Call Trace: section_deactivate+0x138/0x200 __remove_pages+0x114/0x150 arch_remove_memory+0x3c/0x160 try_remove_memory+0x114/0x1a0 __remove_memory+0x20/0x40 memtrace_enable_set+0x254/0x850 simple_attr_write+0x138/0x160 full_proxy_write+0x8c/0x110 __vfs_write+0x38/0x70 vfs_write+0x11c/0x2a0 ksys_write+0x84/0x140 system_call+0x5c/0x68 ---[ end trace 4b053cbd84e0db62 ]--- The first invocation will offline+remove memory blocks. The second invocation will first add+online them again, in order to offline+remove them again (usually we are lucky and the exact same memory blocks will get "reallocated"). Tested on powernv with boot memory: The usage map will not get freed. Tested on x86-64 with DIMMs: The usage map will get freed. Using Dynamic Memory under a Power DLAPR can trigger it easily. Triggering removal (I assume after previously removed+re-added) of memory from the HMC GUI can crash the kernel with the same call trace and is fixed by this patch. Link: http://lkml.kernel.org/r/20191217104637.5509-1-david@redhat.com Fixes: 326e1b8f83a4 ("mm/sparsemem: introduce a SECTION_IS_EARLY flag") Signed-off-by: David Hildenbrand Tested-by: Pingfan Liu Cc: Dan Williams Cc: Oscar Salvador Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cc638f329ef605f5c2a57b87dd8e584e9d5f4c2f Author: Vlastimil Babka Date: Mon Jan 13 16:29:04 2020 -0800 mm, thp: tweak reclaim/compaction effort of local-only and all-node allocations THP page faults now attempt a __GFP_THISNODE allocation first, which should only compact existing free memory, followed by another attempt that can allocate from any node using reclaim/compaction effort specified by global defrag setting and madvise. This patch makes the following changes to the scheme: - Before the patch, the first allocation relies on a check for pageblock order and __GFP_IO to prevent excessive reclaim. This however affects also the second attempt, which is not limited to single node. Instead of that, reuse the existing check for costly order __GFP_NORETRY allocations, and make sure the first THP attempt uses __GFP_NORETRY. As a side-effect, all costly order __GFP_NORETRY allocations will bail out if compaction needs reclaim, while previously they only bailed out when compaction was deferred due to previous failures. This should be still acceptable within the __GFP_NORETRY semantics. - Before the patch, the second allocation attempt (on all nodes) was passing __GFP_NORETRY. This is redundant as the check for pageblock order (discussed above) was stronger. It's also contrary to madvise(MADV_HUGEPAGE) which means some effort to allocate THP is requested. After this patch, the second attempt doesn't pass __GFP_THISNODE nor __GFP_NORETRY. To sum up, THP page faults now try the following attempts: 1. local node only THP allocation with no reclaim, just compaction. 2. for madvised VMA's or when synchronous compaction is enabled always - THP allocation from any node with effort determined by global defrag setting and VMA madvise 3. fallback to base pages on any node Link: http://lkml.kernel.org/r/08a3f4dd-c3ce-0009-86c5-9ee51aba8557@suse.cz Fixes: b39d0ee2632d ("mm, page_alloc: avoid expensive reclaim when compaction may not succeed") Signed-off-by: Vlastimil Babka Acked-by: Michal Hocko Cc: Linus Torvalds Cc: Andrea Arcangeli Cc: Mel Gorman Cc: "Kirill A. Shutemov" Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6282675e6708ec78518cc0e9ad1f1f73d7c5c53d Author: Qu Wenruo Date: Wed Jan 8 13:12:00 2020 +0800 btrfs: relocation: fix reloc_root lifespan and access [BUG] There are several different KASAN reports for balance + snapshot workloads. Involved call paths include: should_ignore_root+0x54/0xb0 [btrfs] build_backref_tree+0x11af/0x2280 [btrfs] relocate_tree_blocks+0x391/0xb80 [btrfs] relocate_block_group+0x3e5/0xa00 [btrfs] btrfs_relocate_block_group+0x240/0x4d0 [btrfs] btrfs_relocate_chunk+0x53/0xf0 [btrfs] btrfs_balance+0xc91/0x1840 [btrfs] btrfs_ioctl_balance+0x416/0x4e0 [btrfs] btrfs_ioctl+0x8af/0x3e60 [btrfs] do_vfs_ioctl+0x831/0xb10 create_reloc_root+0x9f/0x460 [btrfs] btrfs_reloc_post_snapshot+0xff/0x6c0 [btrfs] create_pending_snapshot+0xa9b/0x15f0 [btrfs] create_pending_snapshots+0x111/0x140 [btrfs] btrfs_commit_transaction+0x7a6/0x1360 [btrfs] btrfs_mksubvol+0x915/0x960 [btrfs] btrfs_ioctl_snap_create_transid+0x1d5/0x1e0 [btrfs] btrfs_ioctl_snap_create_v2+0x1d3/0x270 [btrfs] btrfs_ioctl+0x241b/0x3e60 [btrfs] do_vfs_ioctl+0x831/0xb10 btrfs_reloc_pre_snapshot+0x85/0xc0 [btrfs] create_pending_snapshot+0x209/0x15f0 [btrfs] create_pending_snapshots+0x111/0x140 [btrfs] btrfs_commit_transaction+0x7a6/0x1360 [btrfs] btrfs_mksubvol+0x915/0x960 [btrfs] btrfs_ioctl_snap_create_transid+0x1d5/0x1e0 [btrfs] btrfs_ioctl_snap_create_v2+0x1d3/0x270 [btrfs] btrfs_ioctl+0x241b/0x3e60 [btrfs] do_vfs_ioctl+0x831/0xb10 [CAUSE] All these call sites are only relying on root->reloc_root, which can undergo btrfs_drop_snapshot(), and since we don't have real refcount based protection to reloc roots, we can reach already dropped reloc root, triggering KASAN. [FIX] To avoid such access to unstable root->reloc_root, we should check BTRFS_ROOT_DEAD_RELOC_TREE bit first. This patch introduces wrappers that provide the correct way to check the bit with memory barriers protection. Most callers don't distinguish merged reloc tree and no reloc tree. The only exception is should_ignore_root(), as merged reloc tree can be ignored, while no reloc tree shouldn't. [CRITICAL SECTION ANALYSIS] Although test_bit()/set_bit()/clear_bit() doesn't imply a barrier, the DEAD_RELOC_TREE bit has extra help from transaction as a higher level barrier, the lifespan of root::reloc_root and DEAD_RELOC_TREE bit are: NULL: reloc_root is NULL PTR: reloc_root is not NULL 0: DEAD_RELOC_ROOT bit not set DEAD: DEAD_RELOC_ROOT bit set (NULL, 0) Initial state __ | /\ Section A btrfs_init_reloc_root() \/ | __ (PTR, 0) reloc_root initialized /\ | | btrfs_update_reloc_root() | Section B | | (PTR, DEAD) reloc_root has been merged \/ | __ === btrfs_commit_transaction() ==================== | /\ clean_dirty_subvols() | | | Section C (NULL, DEAD) reloc_root cleanup starts \/ | __ btrfs_drop_snapshot() /\ | | Section D (NULL, 0) Back to initial state \/ Every have_reloc_root() or test_bit(DEAD_RELOC_ROOT) caller holds transaction handle, so none of such caller can cross transaction boundary. In Section A, every caller just found no DEAD bit, and grab reloc_root. In the cross section A-B, caller may get no DEAD bit, but since reloc_root is still completely valid thus accessing reloc_root is completely safe. No test_bit() caller can cross the boundary of Section B and Section C. In Section C, every caller found the DEAD bit, so no one will access reloc_root. In the cross section C-D, either caller gets the DEAD bit set, avoiding access reloc_root no matter if it's safe or not. Or caller get the DEAD bit cleared, then access reloc_root, which is already NULL, nothing will be wrong. The memory write barriers are between the reloc_root updates and bit set/clear, the pairing read side is before test_bit. Reported-by: Zygo Blaxell Fixes: d2311e698578 ("btrfs: relocation: Delay reloc tree deletion after merge_reloc_roots") CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo Reviewed-by: David Sterba [ barriers ] Signed-off-by: David Sterba commit f3efc406d67e6236b513c4302133b0c9be74fd99 Author: Vadim Pasternak Date: Mon Jan 13 16:28:31 2020 +0000 Documentation/ABI: Add missed attribute for mlxreg-io sysfs interfaces Add missed "cpld4_version" attribute. Fixes: 52675da1d087 ("Documentation/ABI: Add new attribute for mlxreg-io sysfs interfaces") Signed-off-by: Vadim Pasternak Signed-off-by: Andy Shevchenko commit f4094826779dcafe7087e80850513b923eeefdeb Author: Vadim Pasternak Date: Mon Jan 13 16:28:30 2020 +0000 Documentation/ABI: Fix documentation inconsistency for mlxreg-io sysfs interfaces Fix attribute name from "jtag_enable", which described twice to "cpld3_version", which is expected to be instead of second appearance of "jtag_enable". Fixes: 2752e34442b5 ("Documentation/ABI: Add new attribute for mlxreg-io sysfs interfaces") Signed-off-by: Vadim Pasternak Signed-off-by: Andy Shevchenko commit 212e7f56605ef9688d0846db60c6c6ec06544095 Author: Florian Westphal Date: Sat Jan 11 23:19:53 2020 +0100 netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct An earlier commit (1b789577f655060d98d20e, "netfilter: arp_tables: init netns pointer in xt_tgchk_param struct") fixed missing net initialization for arptables, but turns out it was incomplete. We can get a very similar struct net NULL deref during error unwinding: general protection fault: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77 xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175 cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline] translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587 do_replace net/ipv4/netfilter/arp_tables.c:981 [inline] do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461 Also init the netns pointer in xt_tgdtor_param struct. Fixes: add67461240c1d ("netfilter: add struct net * to target parameters") Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit a0af2742473425322cc24c79dc4033d74aaf3d81 Merge: ad931a2d56e3 0c545240aebc Author: Stephen Boyd Date: Mon Jan 13 09:55:41 2020 -0800 Merge tag 'sunxi-clk-fixes-for-5.5' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull Allwinner clk fixes from Maxime Ripard: Our usual set of fixes for Allwinner, to fix the number of reported clocks on the v3s, fixing the external clock on the R40, and some fixes for the AR100 co-processor clocks. * tag 'sunxi-clk-fixes-for-5.5' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order clk: sunxi-ng: h6-r: Simplify R_APB1 clock definition clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock clk: sunxi-ng: r40: Allow setting parent rate for external clock outputs clk: sunxi-ng: v3s: Fix incorrect number of hw_clks. commit c120959387efa51479056fd01dc90adfba7a590c Author: Cong Wang Date: Fri Jan 10 11:53:08 2020 -0800 netfilter: fix a use-after-free in mtype_destroy() map->members is freed by ip_set_free() right before using it in mtype_ext_cleanup() again. So we just have to move it down. Reported-by: syzbot+4c3cc6dbe7259dbf9054@syzkaller.appspotmail.com Fixes: 40cd63bf33b2 ("netfilter: ipset: Support extensions which need a per data destroy function") Acked-by: Jozsef Kadlecsik Signed-off-by: Cong Wang Signed-off-by: Pablo Neira Ayuso commit 5abd45ea0fc3060f7805e131753fdcbafd6c6618 Author: Matwey V. Kornilov Date: Mon Jan 6 16:09:08 2020 +0300 ARM: dts: am335x-boneblack-common: fix memory size BeagleBone Black series is equipped with 512MB RAM whereas only 256MB is included from am335x-bone-common.dtsi This leads to an issue with unusual setups when devicetree is loaded by GRUB2 directly. Signed-off-by: Matwey V. Kornilov Signed-off-by: Tony Lindgren commit 1fd224e35c1493e9f5d4d932c175616cccce8df9 Author: Paul Cercueil Date: Mon Jan 13 13:33:29 2020 -0300 irqchip/ingenic: Get rid of the legacy IRQ domain Get rid of the legacy IRQ domain and hardcoded IRQ base, since all the Ingenic drivers and platform code have been updated to use devicetree. This also fixes the kernel being flooded with messages like: irq: interrupt-controller@10001000 didn't like hwirq-0x0 to VIRQ8 mapping (rc=-19) Fixes: 8bc7464b5140 ("irqchip: ingenic: Alloc generic chips from IRQ domain"). Signed-off-by: Paul Cercueil Signed-off-by: Thomas Gleixner Tested-by: H. Nikolaus Schaller Tested-by: 周琰杰 (Zhou Yanjie) Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20200113163329.34282-2-paul@crapouillou.net commit accf227de4d211b52c830a58b2df00d5739f2389 Author: Kristian Evensen Date: Mon Jan 13 15:14:05 2020 +0100 USB: serial: option: Add support for Quectel RM500Q RM500Q is a 5G module from Quectel, supporting both standalone and non-standalone modes. Unlike other recent Quectel modems, it is possible to identify the diagnostic interface (bInterfaceProtocol is unique). Thus, there is no need to check for the number of endpoints or reserve interfaces. The interface number is still dynamic though, so matching on interface number is not possible and two entries have to be added to the table. Output from usb-devices with all interfaces enabled (order is diag, nmea, at_port, modem, rmnet and adb): Bus 004 Device 007: ID 2c7c:0800 Quectel Wireless Solutions Co., Ltd. Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 3.20 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 9 idVendor 0x2c7c Quectel Wireless Solutions Co., Ltd. idProduct 0x0800 bcdDevice 4.14 iManufacturer 1 Quectel iProduct 2 LTE-A Module iSerial 3 40046d60 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 328 bNumInterfaces 6 bConfigurationValue 1 iConfiguration 4 DIAG_SER_RMNET bmAttributes 0xa0 (Bus Powered) Remote Wakeup MaxPower 224mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 255 Vendor Specific Subclass bInterfaceProtocol 48 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x01 EP 1 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 3 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 ** UNRECOGNIZED: 05 24 00 10 01 ** UNRECOGNIZED: 05 24 01 00 00 ** UNRECOGNIZED: 04 24 02 02 ** UNRECOGNIZED: 05 24 06 00 00 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x000a 1x 10 bytes bInterval 9 bMaxBurst 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 2 bAlternateSetting 0 bNumEndpoints 3 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 ** UNRECOGNIZED: 05 24 00 10 01 ** UNRECOGNIZED: 05 24 01 00 00 ** UNRECOGNIZED: 04 24 02 02 ** UNRECOGNIZED: 05 24 06 00 00 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x85 EP 5 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x000a 1x 10 bytes bInterval 9 bMaxBurst 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x03 EP 3 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 0 bNumEndpoints 3 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 ** UNRECOGNIZED: 05 24 00 10 01 ** UNRECOGNIZED: 05 24 01 00 00 ** UNRECOGNIZED: 04 24 02 02 ** UNRECOGNIZED: 05 24 06 00 00 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x87 EP 7 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x000a 1x 10 bytes bInterval 9 bMaxBurst 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x86 EP 6 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x04 EP 4 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 4 bAlternateSetting 0 bNumEndpoints 3 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 255 Vendor Specific Subclass bInterfaceProtocol 255 Vendor Specific Protocol iInterface 5 CDEV Serial Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x88 EP 8 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0008 1x 8 bytes bInterval 9 bMaxBurst 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x8e EP 14 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 6 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x0f EP 15 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 2 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 5 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 66 bInterfaceProtocol 1 iInterface 6 ADB Interface Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x05 EP 5 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x89 EP 9 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0400 1x 1024 bytes bInterval 0 bMaxBurst 0 Binary Object Store Descriptor: bLength 5 bDescriptorType 15 wTotalLength 42 bNumDeviceCaps 3 USB 2.0 Extension Device Capability: bLength 7 bDescriptorType 16 bDevCapabilityType 2 bmAttributes 0x00000006 Link Power Management (LPM) Supported SuperSpeed USB Device Capability: bLength 10 bDescriptorType 16 bDevCapabilityType 3 bmAttributes 0x00 wSpeedsSupported 0x000f Device can operate at Low Speed (1Mbps) Device can operate at Full Speed (12Mbps) Device can operate at High Speed (480Mbps) Device can operate at SuperSpeed (5Gbps) bFunctionalitySupport 1 Lowest fully-functional device speed is Full Speed (12Mbps) bU1DevExitLat 1 micro seconds bU2DevExitLat 500 micro seconds ** UNRECOGNIZED: 14 10 0a 00 01 00 00 00 00 11 00 00 30 40 0a 00 b0 40 0a 00 Device Status: 0x0000 (Bus Powered) Signed-off-by: Kristian Evensen Cc: stable Signed-off-by: Johan Hovold commit 85578bbd642f65065039b1765ebe1a867d5435b0 Author: Stephan Gerhold Date: Sun Jan 5 11:27:53 2020 +0100 ASoC: msm8916-wcd-digital: Reset RX interpolation path after use For some reason, attempting to route audio through QDSP6 on MSM8916 causes the RX interpolation path to get "stuck" after playing audio a few times. In this situation, the analog codec part is still working, but the RX path in the digital codec stops working, so you only hear the analog parts powering up. After a reboot everything works again. So far I was not able to reproduce the problem when using lpass-cpu. The downstream kernel driver avoids this by resetting the RX interpolation path after use. In mainline we do something similar for the TX decimator (LPASS_CDC_CLK_TX_RESET_B1_CTL), but the interpolator reset (LPASS_CDC_CLK_RX_RESET_CTL) got lost when the msm8916-wcd driver was split into analog and digital. Fix this problem by adding the reset to msm8916_wcd_digital_enable_interpolator(). Fixes: 150db8c5afa1 ("ASoC: codecs: Add msm8916-wcd digital codec") Cc: Srinivas Kandagatla Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20200105102753.83108-1-stephan@gerhold.net Signed-off-by: Mark Brown commit 057efcf9faea4769cf1020677d93d040db9b23f3 Author: Stephan Gerhold Date: Sat Jan 11 17:40:04 2020 +0100 ASoC: msm8916-wcd-analog: Fix MIC BIAS Internal1 MIC BIAS Internal1 is broken at the moment because we always enable the internal rbias resistor to the TX2 line (connected to the headset microphone), rather than enabling the resistor connected to TX1. Move the RBIAS code to pm8916_wcd_analog_enable_micbias_int1/2() to fix this. Fixes: 585e881e5b9e ("ASoC: codecs: Add msm8916-wcd analog codec") Cc: Srinivas Kandagatla Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20200111164006.43074-3-stephan@gerhold.net Signed-off-by: Mark Brown commit 877167ef343de2a9be3d31cdd5c41122e61190dd Author: Yu-Hsuan Hsu Date: Sun Jan 12 13:49:00 2020 +0800 ASoC: cros_ec_codec: Make the device acpi compatible Add ACPI entry for cros_ec_codec. Signed-off-by: Yu-Hsuan Hsu Link: https://lore.kernel.org/r/20200112054900.236576-1-yuhsuan@chromium.org Signed-off-by: Mark Brown commit ce780a47c3c01e1e179d0792df6b853a913928f1 Author: Arnaud Pouliquen Date: Mon Jan 13 11:04:00 2020 +0100 ASoC: sti: fix possible sleep-in-atomic Change mutex and spinlock management to avoid sleep in atomic issue. Signed-off-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20200113100400.30472-1-arnaud.pouliquen@st.com Signed-off-by: Mark Brown commit e0beec88397b163c7c4ea6fcfb67e8e07a2671dc Author: Stephan Gerhold Date: Sat Jan 11 17:40:03 2020 +0100 ASoC: msm8916-wcd-analog: Fix selected events for MIC BIAS External1 MIC BIAS External1 sets pm8916_wcd_analog_enable_micbias_ext1() as event handler, which ends up in pm8916_wcd_analog_enable_micbias_ext(). But pm8916_wcd_analog_enable_micbias_ext() only handles the POST_PMU event, which is not specified in the event flags for MIC BIAS External1. This means that the code in the event handler is never actually run. Set SND_SOC_DAPM_POST_PMU as the only event for the handler to fix this. Fixes: 585e881e5b9e ("ASoC: codecs: Add msm8916-wcd analog codec") Cc: Srinivas Kandagatla Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20200111164006.43074-2-stephan@gerhold.net Signed-off-by: Mark Brown commit 552b1a85da9f63856e7e341b81c16e0e078204f1 Author: Kai Vehmanen Date: Fri Jan 10 17:57:51 2020 -0600 ASoC: hdac_hda: Fix error in driver removal after failed probe In case system has multiple HDA codecs, and codec probe fails for at least one but not all codecs, driver will end up cancelling a non-initialized timer context upon driver removal. Call trace of typical case: [ 60.593646] WARNING: CPU: 1 PID: 1147 at kernel/workqueue.c:3032 __flush_work+0x18b/0x1a0 [...] [ 60.593670] __cancel_work_timer+0x11f/0x1a0 [ 60.593673] hdac_hda_dev_remove+0x25/0x30 [snd_soc_hdac_hda] [ 60.593674] device_release_driver_internal+0xe0/0x1c0 [ 60.593675] bus_remove_device+0xd6/0x140 [ 60.593677] device_del+0x175/0x3e0 [ 60.593679] ? widget_tree_free.isra.7+0x90/0xb0 [snd_hda_core] [ 60.593680] snd_hdac_device_unregister+0x34/0x50 [snd_hda_core] [ 60.593682] snd_hdac_ext_bus_device_remove+0x2a/0x60 [snd_hda_ext_core] [ 60.593684] hda_dsp_remove+0x26/0x100 [snd_sof_intel_hda_common] [ 60.593686] snd_sof_device_remove+0x84/0xa0 [snd_sof] [ 60.593687] sof_pci_remove+0x10/0x30 [snd_sof_pci] [ 60.593689] pci_device_remove+0x36/0xb0 Signed-off-by: Kai Vehmanen Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200110235751.3404-9-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 2c63bea714780f8e1fc9cb7bc10deda26fada25b Author: Kai Vehmanen Date: Fri Jan 10 17:57:50 2020 -0600 ASoC: SOF: Intel: fix HDA codec driver probe with multiple controllers In case system has multiple HDA controllers, it can happen that same HDA codec driver is used for codecs of multiple controllers. In this case, SOF may fail to probe the HDA driver and SOF initialization fails. SOF HDA code currently relies that a call to request_module() will also run device matching logic to attach driver to the codec instance. However if driver for another HDA controller was already loaded and it already loaded the HDA codec driver, this breaks current logic in SOF. In this case the request_module() SOF does becomes a no-op and HDA Codec driver is not attached to the codec instance sitting on the HDA bus SOF is controlling. Typical scenario would be a system with both external and internal GPUs, with driver of the external GPU loaded first. Fix this by adding similar logic as is used in legacy HDA driver where an explicit device_attach() call is done after request_module(). Also add logic to propagate errors reported by device_attach() back to caller. This also works in the case where drivers are not built as modules. Signed-off-by: Kai Vehmanen Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200110235751.3404-8-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit ceca2197b2f1af4cb6e3f32bb7bd2879943406ef Author: Bard liao Date: Fri Jan 10 17:57:48 2020 -0600 ASoC: SOF: Intel: lower print level to dbg if we will reinit DSP We will reinit DSP in a loop when it fails to initialize the first time, as recommended. So, it is not an error before we finally give up. And reorder the trace to make it more readable. Signed-off-by: Bard liao Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200110235751.3404-6-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 260e41ac4dd3e5acb90be624c03ba7f019615b75 Author: Jerónimo Borque Date: Thu Jan 9 12:23:34 2020 -0300 USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx Add device-ids for the Motorola Solutions TETRA radios MTP3xxx series and MTP85xx series $ lsusb -vd 0cad: Bus 001 Device 009: ID 0cad:9015 Motorola CGISS TETRA PEI interface Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0cad Motorola CGISS idProduct 0x9015 bcdDevice 24.16 iManufacturer 1 iProduct 2 iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x0037 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 3 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x01 EP 1 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Bus 001 Device 010: ID 0cad:9013 Motorola CGISS TETRA PEI interface Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0cad Motorola CGISS idProduct 0x9013 bcdDevice 24.16 iManufacturer 1 iProduct 2 iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x0037 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 3 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x01 EP 1 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Signed-off-by: Jerónimo Borque Cc: stable Signed-off-by: Johan Hovold commit c3b040b5c58f9a2de8f672f9e7cb1a8d411b9f23 Author: Tobias Schramm Date: Thu Jan 9 08:31:29 2020 +0100 drm/rockchip: fix integer type used for storing dp data rate commit 2589c4025f13 ("drm/rockchip: Avoid drm_dp_link helpers") changes the type of variables used to store the display port data rate and number of lanes to u8. However u8 is not sufficient to store the link data rate of the display port. This commit reverts the type of data rate to unsigned int. Fixes: 2589c4025f13 ("drm/rockchip: Avoid drm_dp_link helpers") Signed-off-by: Tobias Schramm Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20200109073129.378507-2-t.schramm@manjaro.org commit dce54e861ec74d05cf0b737322700691e81be91b Author: Chris Wilson Date: Fri Jan 10 11:04:02 2020 +0000 drm/i915/gt: Mark ring->vma as active while pinned As we use the active state to keep the vma alive while we are reading its contents during GPU error capture, we need to mark the ring->vma as active during execution if we want to include the rinbuffer in the error state. Reported-by: Lionel Landwerlin Fixes: b1e3177bd1d8 ("drm/i915: Coordinate i915_active with its own mutex") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Lionel Landwerlin Acked-by: Lionel Landwerlin Link: https://patchwork.freedesktop.org/patch/msgid/20200110110402.1231745-3-chris@chris-wilson.co.uk (cherry picked from commit 8ccfc20a7d56d7e16510e6e068ffb7b43c3ac100) Signed-off-by: Joonas Lahtinen commit e2c56d897315c7ddc78f05fae83f2b8df006e0a3 Author: Chris Wilson Date: Fri Jan 10 11:04:01 2020 +0000 drm/i915/gt: Mark context->state vma as active while pinned As we use the active state to keep the vma alive while we are reading its contents during GPU error capture, we need to mark the context->state vma as active during execution if we want to include it in the error state. Reported-by: Lionel Landwerlin Fixes: b1e3177bd1d8 ("drm/i915: Coordinate i915_active with its own mutex") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Lionel Landwerlin Acked-by: Lionel Landwerlin Link: https://patchwork.freedesktop.org/patch/msgid/20200110110402.1231745-2-chris@chris-wilson.co.uk (cherry picked from commit 1b8bfc57267213ddf7f0b03cbd4c40aa65b530d6) Signed-off-by: Joonas Lahtinen commit c3866f54106d4a9175eb3a0c008e73c7d63e8464 Author: Chris Wilson Date: Fri Jan 10 11:04:00 2020 +0000 drm/i915/gt: Skip trying to unbind in restore_ggtt_mappings Currently we first to try to unbind the VMA (and lazily rebind on next use) as an optimisation during restore_ggtt_mappings. Ideally, the only objects in the GGTT upon resume are the pinned kernel objects which can't be unbound and need to be restored. As the unbind interferes with the plan to mark those objects as active for error capture, forgo the optimisation. Signed-off-by: Chris Wilson Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20200110110402.1231745-1-chris@chris-wilson.co.uk (cherry picked from commit 80e5351df13a5c4e9ecc14a58fa60c84d356ee87) Signed-off-by: Joonas Lahtinen commit ea38aa2ea5b0969776f0a47f174ce928a22be803 Author: YueHaibing Date: Tue Jan 7 21:50:14 2020 +0800 drm/i915: Add missing include file Fix build error: ./drivers/gpu/drm/i915/selftests/i915_random.h: In function i915_prandom_u32_max_state: ./drivers/gpu/drm/i915/selftests/i915_random.h:48:23: error: implicit declaration of function mul_u32_u32; did you mean mul_u64_u32_div? [-Werror=implicit-function-declaration] return upper_32_bits(mul_u32_u32(prandom_u32_state(state), ep_ro)); Reported-by: Hulk Robot Fixes: 7ce5b6850b47 ("drm/i915/selftests: Use mul_u32_u32() for 32b x 32b -> 64b result") Signed-off-by: YueHaibing Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20200107135014.36472-1-yuehaibing@huawei.com (cherry picked from commit 62bf5465b26d1f502430b9c654be7d16bf2e242d) Signed-off-by: Joonas Lahtinen commit bc80573ea25bb033a58da81b3ce27205b97c088e Author: Guido Günther Date: Fri Dec 27 11:22:54 2019 +0100 iio: light: vcnl4000: Fix scale for vcnl4040 According to the data sheet the ambient sensor's scale is 0.12 lux/step (not 0.024 lux/step as used by vcnl4200) when the integration time is 80ms. The integration time is currently hardcoded in the driver to that value. See p. 8 in https://www.vishay.com/docs/84307/designingvcnl4040.pdf Fixes: 5a441aade5b3 ("iio: light: vcnl4000 add support for the VCNL4040 proximity and light sensor") Signed-off-by: Guido Günther Reviewed-by: Marco Felsch Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 883f616530692d81cb70f8a32d85c0d2afc05f69 Author: Lars Möllendorf Date: Fri Dec 13 14:50:55 2019 +0100 iio: buffer: align the size of scan bytes to size of the largest element Previous versions of `iio_compute_scan_bytes` only aligned each element to its own length (i.e. its own natural alignment). Because multiple consecutive sets of scan elements are buffered this does not work in case the computed scan bytes do not align with the natural alignment of the first scan element in the set. This commit fixes this by aligning the scan bytes to the natural alignment of the largest scan element in the set. Fixes: 959d2952d124 ("staging:iio: make iio_sw_buffer_preenable much more general.") Signed-off-by: Lars Möllendorf Reviewed-by: Lars-Peter Clausen Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 217afe63ccf445fc220e5ef480683607b05c0aa5 Author: Tomasz Duszynski Date: Fri Dec 13 22:38:08 2019 +0100 iio: chemical: pms7003: fix unmet triggered buffer dependency IIO triggered buffer depends on IIO buffer which is missing from Kconfig file. This should go unnoticed most of the time because there's a chance something else has already enabled buffers. In some rare cases though one might experience kbuild warnings about unmet direct dependencies and build failures due to missing symbols. Fix this by selecting IIO_BUFFER explicitly. Signed-off-by: Tomasz Duszynski Fixes: a1d642266c14 ("iio: chemical: add support for Plantower PMS7003 sensor") Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit fb4fbc8904e786537e29329d791147389e1465a2 Author: Stephan Gerhold Date: Mon Dec 16 13:41:20 2019 +0100 iio: imu: st_lsm6dsx: Fix selection of ST_LSM6DS3_ID At the moment, attempting to probe a device with ST_LSM6DS3_ID (e.g. using the st,lsm6ds3 compatible) fails with: st_lsm6dsx_i2c 1-006b: unsupported whoami [69] ... even though 0x69 is the whoami listed for ST_LSM6DS3_ID. This happens because st_lsm6dsx_check_whoami() also attempts to match unspecified (zero-initialized) entries in the "id" array. ST_LSM6DS3_ID = 0 will therefore match any entry in st_lsm6dsx_sensor_settings (here: the first), because none of them actually have all 12 entries listed in the "id" array. Avoid this by additionally checking if "name" is set, which is only set for valid entries in the "id" array. Note: Although the problem was introduced earlier it did not surface until commit 52f4b1f19679 ("iio: imu: st_lsm6dsx: add support for accel/gyro unit of lsm9ds1") because ST_LSM6DS3_ID was the first entry in st_lsm6dsx_sensor_settings. Fixes: d068e4a0f921 ("iio: imu: st_lsm6dsx: add support to multiple devices with the same settings") Cc: # 5.4 Acked-by: Lorenzo Bianconi Signed-off-by: Stephan Gerhold Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit d7857e4ee1ba69732b16c73b2f2dde83ecd78ee4 Author: Alexandru Tachici Date: Fri Dec 20 12:07:19 2019 +0200 iio: adc: ad7124: Fix DT channel configuration This patch fixes device tree channel configuration. ad7124 driver reads channels configuration from the device tree. It expects to find channel specifications as child nodes. Before this patch ad7124 driver assumed that the child nodes are parsed by for_each_available_child_of_node in the order 0,1,2,3... This is wrong and the real order of the children can be seen by running: dtc -I fs /sys/firmware/devicetree/base on the machine. For example, running this on an rpi 3B+ yields the real children order: 4,2,0,7,5,3,1,6 Before this patch the driver assigned the channel configuration like this: - 0 <- 4 - 1 <- 2 - 2 <- 0 ........ For example, the symptoms can be observed by connecting the 4th channel to a 1V tension and then reading the in_voltage0-voltage19_raw sysfs (multiplied of course by the scale) one would see that channel 0 measures 1V and channel 4 measures only noise. Now the driver uses the reg property of each child in order to correctly identify to which channel the parsed configuration belongs to. Fixes b3af341bbd966: ("iio: adc: Add ad7124 support") Signed-off-by: Alexandru Tachici Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 57388a2ccb6c2f554fee39772886c69b796dde53 Author: Ikjoon Jang Date: Sat Jan 11 01:47:12 2020 +0800 cpuidle: teo: Fix intervals[] array indexing bug Fix a simple bug in rotating array index. Fixes: b26bf6ab716f ("cpuidle: New timer events oriented governor for tickless systems") Signed-off-by: Ikjoon Jang Cc: 5.1+ # 5.1+ Signed-off-by: Rafael J. Wysocki commit 176a7fca81c5090a7240664e3002c106d296bf31 Author: Jian-Hong Pan Date: Mon Dec 30 16:30:45 2019 +0800 platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0 Some of ASUS laptops like UX431FL keyboard backlight cannot be set to brightness 0. According to ASUS' information, the brightness should be 0x80 ~ 0x83. This patch fixes it by following the logic. Fixes: e9809c0b9670 ("asus-wmi: add keyboard backlight support") Signed-off-by: Jian-Hong Pan Reviewed-by: Daniel Drake Signed-off-by: Andy Shevchenko commit 3e2dc6bdb56893bc28257e482e1dbe5d39f313df Author: Takashi Sakamoto Date: Mon Jan 13 17:46:28 2020 +0900 ALSA: dice: fix fallback from protocol extension into limited functionality At failure of attempt to detect protocol extension, ALSA dice driver should be fallback to limited functionality. However it's not. This commit fixes it. Cc: # v4.18+ Fixes: 58579c056c1c9 ("ALSA: dice: use extended protocol to detect available stream formats") Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20200113084630.14305-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit 747d1f076de5a60770011f6e512de43298ec64cb Author: Takashi Sakamoto Date: Mon Jan 13 17:57:19 2020 +0900 ALSA: firewire-tascam: fix corruption due to spin lock without restoration in SoftIRQ context ALSA firewire-tascam driver can bring corruption due to spin lock without restoration of IRQ flag in SoftIRQ context. This commit fixes the bug. Cc: Scott Bahling Cc: # v4.21 Fixes: d7167422433c ("ALSA: firewire-tascam: queue events for change of control surface") Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20200113085719.26788-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit 515ff674bb9bf06186052e352c4587dab8defaf0 Author: Harry Pan Date: Mon Jan 6 17:57:00 2020 +0800 platform/x86: intel_pmc_core: update Comet Lake platform driver Adding new CML CPU model ID into platform driver support list. Signed-off-by: Harry Pan Signed-off-by: Andy Shevchenko commit 1f27dbd8265dbb379926c8f6a4453fe7fe26d7a3 Author: Hans de Goede Date: Mon Jan 6 15:42:19 2020 +0100 platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits Allow the user to configure the fan to turn on / speed-up at lower thresholds then before (20 degrees Celcius as minimum instead of 40) and likewise also allow the user to delay the fan speeding-up till the temperature hits 90 degrees Celcius (was 70). Cc: Jason Anderson Reported-by: Jason Anderson Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit 6ae01050e49f0080ae30575d9b45a6d4a3d7ee23 Author: Hans de Goede Date: Mon Jan 6 15:42:18 2020 +0100 platform/x86: GPD pocket fan: Use default values when wrong modparams are given Use our default values when wrong module-parameters are given, instead of refusing to load. Refusing to load leaves the fan at the BIOS default setting, which is "Off". The CPU's thermal throttling should protect the system from damage, but not-loading is really not the best fallback in this case. This commit fixes this by re-setting module-parameter values to their defaults if they are out of range, instead of failing the probe with -EINVAL. Cc: stable@vger.kernel.org Cc: Jason Anderson Reported-by: Jason Anderson Fixes: 594ce6db326e ("platform/x86: GPD pocket fan: Use a min-speed of 2 while charging") Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit 638bc4ca3d28c25986cce4cbad69d9b8abf1e434 Author: Liming Sun Date: Fri Dec 20 12:04:33 2019 -0500 platform/mellanox: fix potential deadlock in the tmfifo driver This commit fixes the potential deadlock caused by the console Rx and Tx processing at the same time. Rx and Tx both take the console and tmfifo spinlock but in different order which causes potential deadlock. The fix is to use different tmfifo spinlock for Rx and Tx since they protect different resources and it's safe to split the lock. Below is the reported call trace when copying/pasting large string in the console. Rx: _raw_spin_lock_irqsave (hvc lock) __hvc_poll hvc_poll in_intr vring_interrupt mlxbf_tmfifo_rxtx_one_desc (tmfifo lock) mlxbf_tmfifo_rxtx mlxbf_tmfifo_work_rxtx Tx: _raw_spin_lock_irqsave (tmfifo lock) mlxbf_tmfifo_virtio_notify virtqueue_notify virtqueue_kick put_chars hvc_push hvc_write (hvc lock) ... do_tty_write tty_write Fixes: 1357dfd7261f ("platform/mellanox: Add TmFifo driver for Mellanox BlueField Soc") Cc: # 5.4+ Reviewed-by: David Woods Signed-off-by: Liming Sun Signed-off-by: Andy Shevchenko commit dbff1e07b02d11fae04dd4b1954600baee9e94cc Author: Nishad Kamdar Date: Thu Dec 19 20:00:01 2019 +0530 platform/x86: intel-ips: Use the correct style for SPDX License Identifier This patch corrects the SPDX License Identifier style in header files related to x86 Platform Specific Drivers. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used). Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by: Joe Perches Signed-off-by: Nishad Kamdar Signed-off-by: Andy Shevchenko commit 3b675b15571c5342499dec6a0b77d730f1101b62 Author: Gerd Hoffmann Date: Fri Jan 10 10:45:35 2020 +0100 drm/virtio: add missing virtio_gpu_array_lock_resv call When submitting a fenced command we must lock the object reservations because virtio_gpu_queue_fenced_ctrl_buffer() unlocks after adding the fence. Reported-by: Jann Horn Signed-off-by: Gerd Hoffmann Reviewed-by: Chia-I Wu Tested-by: Jann Horn Link: http://patchwork.freedesktop.org/patch/msgid/20200110094535.23472-1-kraxel@redhat.com commit b3a987b0264d3ddbb24293ebff10eddfc472f653 Author: Linus Torvalds Date: Sun Jan 12 16:55:08 2020 -0800 Linux 5.5-rc6 commit 373adb7313b233d64e21f3f6329fb41a5e6ae180 Merge: 040a3c33623b dc6fcba72f04 Author: Linus Torvalds Date: Sun Jan 12 16:48:39 2020 -0800 Merge tag 'riscv/for-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "Two fixes for RISC-V: - Clear FP registers during boot when FP support is present, rather than when they aren't present - Move the header files associated with the SiFive L2 cache controller to drivers/soc (where the code was recently moved)" * tag 'riscv/for-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fixup obvious bug for fp-regs reset riscv: move sifive_l2_cache.h to include/soc commit dc6fcba72f0435b7884f2e92fd634bb9f78a2c60 Author: Guo Ren Date: Sun Jan 5 10:52:14 2020 +0800 riscv: Fixup obvious bug for fp-regs reset CSR_MISA is defined in Privileged Architectures' spec: 3.1.1 Machine ISA Register misa. Every bit:1 indicate a feature, so we should beqz reset_done when there is no F/D bit in csr_misa register. Signed-off-by: Guo Ren [paul.walmsley@sifive.com: fix typo in commit message] Fixes: 9e80635619b51 ("riscv: clear the instruction cache and all registers when booting") Signed-off-by: Paul Walmsley commit 13cf4cf030183dd9a8731f3fe32456e83b6c7b68 Author: Yash Shah Date: Tue Jan 7 22:09:06 2020 -0800 riscv: move sifive_l2_cache.h to include/soc The commit 9209fb51896f ("riscv: move sifive_l2_cache.c to drivers/soc") moves the sifive L2 cache driver to driver/soc. It did not move the header file along with the driver. Therefore this patch moves the header file to driver/soc Signed-off-by: Yash Shah Reviewed-by: Anup Patel [paul.walmsley@sifive.com: updated to fix the include guard] Fixes: 9209fb51896f ("riscv: move sifive_l2_cache.c to drivers/soc") Signed-off-by: Paul Walmsley commit 040a3c33623ba4bd11588ab0820281b854a3ffaf Merge: 6327edceb62b 55817b340a31 Author: Linus Torvalds Date: Sun Jan 12 09:35:42 2020 -0800 Merge tag 'iommu-fixes-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Two fixes for VT-d and generic IOMMU code to fix teardown on error handling code paths. - Patch for the Intel VT-d driver to fix handling of non-PCI devices - Fix W=1 compile warning in dma-iommu code * tag 'iommu-fixes-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/dma: fix variable 'cookie' set but not used iommu/vt-d: Unlink device if failed to add to group iommu: Remove device link to group on failure iommu/vt-d: Fix adding non-PCI devices to Intel IOMMU commit 555089fdfc37ad65e0ee9b42ca40c238ff546f83 Author: Martin KaFai Lau Date: Fri Jan 10 15:16:44 2020 -0800 bpftool: Fix printing incorrect pointer in btf_dump_ptr For plain text output, it incorrectly prints the pointer value "void *data". The "void *data" is actually pointing to memory that contains a bpf-map's value. The intention is to print the content of the bpf-map's value instead of printing the pointer pointing to the bpf-map's value. In this case, a member of the bpf-map's value is a pointer type. Thus, it should print the "*(void **)data". Fixes: 22c349e8db89 ("tools: bpftool: fix format strings and arguments for jsonw_printf()") Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20200110231644.3484151-1-kafai@fb.com commit 6327edceb62bc4c91195e2dc6d5574a53005cb5a Merge: 606e9ad20094 cf8ce8b80f8b Author: Linus Torvalds Date: Sat Jan 11 15:40:43 2020 -0800 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Two driver bugfixes, a documentation fix, and a removal of a spec violation for the bus recovery algorithm in the core" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: fix bus recovery stop mode timing i2c: bcm2835: Store pointer to bus clock dt-bindings: i2c: at91: fix i2c-sda-hold-time-ns documentation for sam9x60 i2c: at91: fix clk_offset for sam9x60 commit 606e9ad20094f6d500166881d301f31a51bc8aa7 Merge: ac61145a725a 457677c70c76 Author: Linus Torvalds Date: Sat Jan 11 15:33:48 2020 -0800 Merge tag 'clone3-tls-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull thread fixes from Christian Brauner: "This contains a series of patches to fix CLONE_SETTLS when used with clone3(). The clone3() syscall passes the tls argument through struct clone_args instead of a register. This means, all architectures that do not implement copy_thread_tls() but still support CLONE_SETTLS via copy_thread() expecting the tls to be located in a register argument based on clone() are currently unfortunately broken. Their tls value will be garbage. The patch series fixes this on all architectures that currently define __ARCH_WANT_SYS_CLONE3. It also adds a compile-time check to ensure that any architecture that enables clone3() in the future is forced to also implement copy_thread_tls(). My ultimate goal is to get rid of the copy_thread()/copy_thread_tls() split and just have copy_thread_tls() at some point in the not too distant future (Maybe even renaming copy_thread_tls() back to simply copy_thread() once the old function is ripped from all arches). This is dependent now on all arches supporting clone3(). While all relevant arches do that now there are still four missing: ia64, m68k, sh and sparc. They have the system call reserved, but not implemented. Once they all implement clone3() we can get rid of ARCH_WANT_SYS_CLONE3 and HAVE_COPY_THREAD_TLS. This series also includes a minor fix for the arm64 uapi headers which caused __NR_clone3 to be missing from the exported user headers. Unfortunately the series came in a little late especially given that it touches a range of architectures. Due to the holidays not all arch maintainers responded in time probably due to their backlog. Will and Arnd have thankfully acked the arm specific changes. Given that the changes are straightforward and rather minimal combined with the fact the that clone3() with CLONE_SETTLS is broken I decided to send them post rc3 nonetheless" * tag 'clone3-tls-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: um: Implement copy_thread_tls clone3: ensure copy_thread_tls is implemented xtensa: Implement copy_thread_tls riscv: Implement copy_thread_tls parisc: Implement copy_thread_tls arm: Implement copy_thread_tls arm64: Implement copy_thread_tls arm64: Move __ARCH_WANT_SYS_CLONE3 definition to uapi headers commit c9f53049d4a842db6bcd76f597759a0ef5f65c86 Author: Jakub Kicinski Date: Sat Jan 11 06:07:52 2020 -0800 MAINTAINERS: update my email address My Netronome email address may become inactive soon. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit fb0c90ab92cac104576303386421bd90e505e505 Author: Jacob Keller Date: Thu Jan 9 11:08:21 2020 -0800 doc: fix typo of snapshot in documentation A couple of locations accidentally misspelled snapshot as shapshot. Signed-off-by: Jacob Keller Signed-off-by: David S. Miller commit b0efcae5e12b341e569f971ccd193e31f1d0ffa8 Author: Jacob Keller Date: Thu Jan 9 11:08:20 2020 -0800 devlink: correct misspelling of snapshot The function to obtain a unique snapshot id was mistakenly typo'd as devlink_region_shapshot_id_get. Fix this typo by renaming the function and all of its users. Signed-off-by: Jacob Keller Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 7fba6aea4472f01a404d81a12237ae9a1ff418ce Author: Takashi Iwai Date: Thu Jan 9 09:20:00 2020 +0100 ALSA: hda: Rename back to dmic_detect option We've got quite a few bug reports showing the SOF driver being loaded unintentionally recently, and the reason seems to be that users didn't know the module option change: with the recent kernel, a new option dsp_driver=1 has to be passed to a new module snd-intel-dspcfg instead of snd_hda_intel.dmic_detect=0 option. That is, actually there are two tricky things here: - We changed the whole detection in another module and another option semantics. - The existing option for skipping the DSP probe was also renamed. For avoiding the confusion and giving user more hint, this patch reverts the renamed option dsp_driver back to dmic_detect for snd-hda-intel module, and show the warning about the module option change when the non-default value is passed. Fixes: 82d9d54a6c0e ("ALSA: hda: add Intel DSP configuration / probe code") Link: https://lore.kernel.org/r/20200109082000.26729-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a5c3a7c0ce1a1cfab15404018933775d7222a517 Merge: 4c582234ab39 a26ad4d5676f Author: David S. Miller Date: Fri Jan 10 23:32:54 2020 -0800 Merge branch 'DP83822-and-DP83TC811-Fixes' Dan Murphy says: ==================== DP83822 and DP83TC811 Fixes Two fixes on net/phy/Kconfig for the TI ethernet PHYs. First fixed the typo in the Kconfig for the DP83TC811 where it incorretly stated that the support was for a DP83TC822 which does not exist. Second fix was to update the DP83822 Kconfig entry to indicate support for the DP83825 devices in the description and the prompt. ==================== Signed-off-by: David S. Miller commit a26ad4d5676f5e28216bea57851ddc4cccaf8861 Author: Dan Murphy Date: Fri Jan 10 14:03:57 2020 -0600 net: phy: DP83822: Update Kconfig with DP83825I support Update the Kconfig description to indicate support for the DP83825I device as well. Fixes: 32b12dc8fde1 ("net: phy: Add DP83825I to the DP83822 driver") Reviewed-by: Andrew Lunn Signed-off-by: Dan Murphy Signed-off-by: David S. Miller commit 443180567763789b5b1c36cc2afa06397baf954f Author: Dan Murphy Date: Fri Jan 10 14:03:56 2020 -0600 net: phy: DP83TC811: Fix typo in Kconfig Fix typo in the Kconfig for the DP83TC811 as it indicates support for the DP83TC822 which is incorrect. Fixes: 6d749428788b {"net: phy: DP83TC811: Introduce support for the DP83TC811 phy") Reviewed-by: Andrew Lunn Signed-off-by: Dan Murphy Signed-off-by: David S. Miller commit b47611c8c389c3db4b6adeb3d5aa577efa0166df Merge: 41ec98def8d2 3433bdf98d8e Author: Olof Johansson Date: Fri Jan 10 22:12:53 2020 -0800 Merge tag 'v5.5-rockchip-dtsfixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes A fix for the Beelink A1 IR receiver setting the correct polarity. * tag 'v5.5-rockchip-dtsfixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Fix IR on Beelink A1 Link: https://lore.kernel.org/r/2054603.JKFSmqfO19@phil Signed-off-by: Olof Johansson commit 41ec98def8d2fd03a4c2c29a7afef40846423ca0 Merge: 3f2b5941d335 1c226017d3ec Author: Olof Johansson Date: Fri Jan 10 22:12:33 2020 -0800 Merge tag 'sunxi-fixes-for-5.5' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes A couple of fixes for GPIO polarity and regulators on the A64 olinuxino. * tag 'sunxi-fixes-for-5.5' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity arm64: dts: allwinner: a64: olinuxino: Fix SDIO supply regulator arm64: dts: allwinner: a64: olinuxino: Fix eMMC supply regulator Link: https://lore.kernel.org/r/582f4fda-38af-43e8-af58-957aee5b9dd8.lettre@localhost Signed-off-by: Olof Johansson commit 3f2b5941d3355f3613dcdf6a575aa0d0874d84d8 Merge: dc64f487f4c4 4b0b97e651ec Author: Olof Johansson Date: Fri Jan 10 22:12:16 2020 -0800 Merge tag 'imx-fixes-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.5, round 2: - Fix i.MX8MM SDMA1 AHB clock setting to remove a "Timeout waiting for CH0" error seen with UART1. - Correct compatible of RV3029 RTC device on imx6q-dhcom board. - Correct interrupt trigger type for magnetometer on board imx8mq-librem5-devkit. - A series from Anson Huang to fix vdd3p0 power supplier for a few NXP development board. - Fix imx6q-icore-mipi board to use 1.5 version of i.Core MX6DL, so that Ethernet interface on the board works properly. - Fix Toradex Colibri board to get NAND flash support back. - Fix SGTL5000 VDDIO regulator connection for imx6q-dhcom, which is connected to PMIC SW2 output rather than a fixed 3V3 rail. - Fix 'reg' of CPU node on imx7ulp to get rid of a warning given by kernel. - Fix endian setting for DCFG on LS1028A SoC, so that register access of DCFG becomes correct. * tag 'imx-fixes-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx7: Fix Toradex Colibri iMX7S 256MB NAND flash support ARM: dts: imx6sll-evk: Remove incorrect power supply assignment ARM: dts: imx6sl-evk: Remove incorrect power supply assignment ARM: dts: imx6sx-sdb: Remove incorrect power supply assignment ARM: dts: imx6qdl-sabresd: Remove incorrect power supply assignment ARM: dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL arm64: dts: imx8mq-librem5-devkit: use correct interrupt for the magnetometer ARM: dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection ARM: dts: imx7ulp: fix reg of cpu node arm64: dts: imx8mm: Change SDMA1 ahb clock for imx8mm arm64: dts: ls1028a: fix endian setting for dcfg ARM: dts: imx6q-dhcom: fix rtc compatible Link: https://lore.kernel.org/r/20200110011836.GW4456@T480 Signed-off-by: Olof Johansson commit dc64f487f4c4e7a03bfa0a7c0e8e6a49214373d0 Merge: 9f1c2cb3296a 30388cc07572 Author: Olof Johansson Date: Fri Jan 10 22:11:12 2020 -0800 Merge tag 'amlogic-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic into arm/fixes arm-soc: Amlogic fixes for v5.5-rc * tag 'amlogic-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic: arm64: dts: meson-sm1-sei610: add gpio bluetooth interrupt dt-bindings: reset: meson8b: fix duplicate reset IDs soc: amlogic: meson-ee-pwrc: propagate errors from pm_genpd_init() soc: amlogic: meson-ee-pwrc: propagate PD provider registration errors ARM: dts: meson8: fix the size of the PMU registers arm64: dts: meson-sm1-sei610: gpio-keys: switch to IRQs Link: https://lore.kernel.org/r/7hmuaweavi.fsf@baylibre.com Signed-off-by: Olof Johansson commit 4c582234ab3948d08a24c82eb1e00436aabacbc6 Author: Ido Schimmel Date: Thu Jan 9 19:57:41 2020 +0200 devlink: Wait longer before warning about unset port type The commit cited below causes devlink to emit a warning if a type was not set on a devlink port for longer than 30 seconds to "prevent misbehavior of drivers". This proved to be problematic when unregistering the backing netdev. The flow is always: devlink_port_type_clear() // schedules the warning unregister_netdev() // blocking devlink_port_unregister() // cancels the warning The call to unregister_netdev() can block for long periods of time for various reasons: RTNL lock is contended, large amounts of configuration to unroll following dismantle of the netdev, etc. This results in devlink emitting a warning despite the driver behaving correctly. In emulated environments (of future hardware) which are usually very slow, the warning can also be emitted during port creation as more than 30 seconds can pass between the time the devlink port is registered and when its type is set. In addition, syzbot has hit this warning [1] 1974 times since 07/11/19 without being able to produce a reproducer. Probably because reproduction depends on the load or other bugs (e.g., RTNL not being released). To prevent bogus warnings, increase the timeout to 1 hour. [1] https://syzkaller.appspot.com/bug?id=e99b59e9c024a666c9f7450dc162a4b74d09d9cb Fixes: 136bf27fc0e9 ("devlink: add warning in case driver does not set port type") Signed-off-by: Ido Schimmel Reported-by: syzbot+b0a18ed7b08b735d2f41@syzkaller.appspotmail.com Reported-by: Alex Veber Tested-by: Alex Veber Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit dfb9a8857f4decbba8c2206e8877e1d741ee1b47 Author: Daniel Campello Date: Tue Jan 7 11:24:21 2020 -0700 platform/chrome: wilco_ec: Fix keyboard backlight probing The EC on the Wilco platform responds with 0xFF to commands related to the keyboard backlight on the absence of a keyboard backlight module. This change allows the EC driver to continue loading even if the backlight module is not present. Fixes: 119a3cb6d687 ("platform/chrome: wilco_ec: Add keyboard backlight LED support") Signed-off-by: Daniel Campello Signed-off-by: Enric Balletbo i Serra Signed-off-by: Benson Leung commit 6b32391ed675827f8425a414abbc6fbd54ea54fe Author: Johan Hovold Date: Fri Jan 10 12:01:27 2020 -0800 Input: sur40 - fix interface sanity checks Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. This in turn could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: bdb5c57f209c ("Input: add sur40 driver for Samsung SUR40 (aka MS Surface 2.0/Pixelsense)") Signed-off-by: Johan Hovold Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-8-johan@kernel.org Signed-off-by: Dmitry Torokhov commit cea7991144754044c540bf9f974550ea5fec500c Author: Johan Hovold Date: Fri Jan 10 12:01:07 2020 -0800 Input: gtco - drop redundant variable reinit Drop the second, redundant reinitialisation of the endpoint-descriptor pointer from probe. Signed-off-by: Johan Hovold Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-7-johan@kernel.org Signed-off-by: Dmitry Torokhov commit 3563c629fb9a29b08df53747217b89444f4cd32b Author: Johan Hovold Date: Fri Jan 10 12:00:41 2020 -0800 Input: gtco - fix extra-descriptor debug message Make sure to use the current altsetting when printing size of any extra descriptors of the interface. Also fix the s/endpoint/interface/ mixup in the message itself. Signed-off-by: Johan Hovold Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-6-johan@kernel.org Signed-off-by: Dmitry Torokhov commit a8eeb74df5a6bdb214b2b581b14782c5f5a0cf83 Author: Johan Hovold Date: Fri Jan 10 12:00:18 2020 -0800 Input: gtco - fix endpoint sanity check The driver was checking the number of endpoints of the first alternate setting instead of the current one, something which could lead to the driver binding to an invalid interface. This in turn could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 162f98dea487 ("Input: gtco - fix crash on detecting device without endpoints") Signed-off-by: Johan Hovold Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-5-johan@kernel.org Signed-off-by: Dmitry Torokhov commit cfa4f6a99fb183742cace65ec551b444852b8ef6 Author: Johan Hovold Date: Fri Jan 10 11:59:52 2020 -0800 Input: aiptek - use descriptors of current altsetting Make sure to always use the descriptors of the current alternate setting to avoid future issues when accessing fields that may differ between settings. Signed-off-by: Johan Hovold Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-4-johan@kernel.org Signed-off-by: Dmitry Torokhov commit 3111491fca4f01764e0c158c5e0f7ced808eef51 Author: Johan Hovold Date: Fri Jan 10 11:59:32 2020 -0800 Input: aiptek - fix endpoint sanity check The driver was checking the number of endpoints of the first alternate setting instead of the current one, something which could lead to the driver binding to an invalid interface. This in turn could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 8e20cf2bce12 ("Input: aiptek - fix crash on detecting device without endpoints") Signed-off-by: Johan Hovold Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-3-johan@kernel.org Signed-off-by: Dmitry Torokhov commit bcfcb7f9b480dd0be8f0df2df17340ca92a03b98 Author: Johan Hovold Date: Fri Jan 10 11:55:47 2020 -0800 Input: pegasus_notetaker - fix endpoint sanity check The driver was checking the number of endpoints of the first alternate setting instead of the current one, something which could be used by a malicious device (or USB descriptor fuzzer) to trigger a NULL-pointer dereference. Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver") Signed-off-by: Johan Hovold Acked-by: Martin Kepplinger Acked-by: Vladis Dronov Link: https://lore.kernel.org/r/20191210113737.4016-2-johan@kernel.org Signed-off-by: Dmitry Torokhov commit 97e24b095348a15ec08c476423c3b3b939186ad7 Author: Chuhong Yuan Date: Fri Jan 10 10:30:04 2020 -0800 Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register The driver misses a check for devm_thermal_zone_of_sensor_register(). Add a check to fix it. Fixes: e28d0c9cd381 ("input: convert sun4i-ts to use devm_thermal_zone_of_sensor_register") Signed-off-by: Chuhong Yuan Signed-off-by: Dmitry Torokhov commit 7f439bc2d7e8c8cc4e1bab08ab7fe1bb73c9b268 Author: Miles Chen Date: Thu Jan 2 15:10:16 2020 -0800 Input: evdev - convert kzalloc()/vzalloc() to kvzalloc() We observed a large(order-3) allocation in evdev_open() and it may cause an OOM kernel panic in kzalloc(), before we getting to the vzalloc() fallback. Fix it by converting kzalloc()/vzalloc() to kvzalloc() to avoid the OOM killer logic as we have a vmalloc fallback. InputReader invoked oom-killer: gfp_mask=0x240c2c0 (GFP_KERNEL|__GFP_NOWARN|__GFP_COMP|__GFP_ZERO), nodemask=0, order=3, oom_score_adj=-900 ... (dump_backtrace) from (show_stack+0x18/0x1c) (show_stack) from (dump_stack+0x94/0xa8) (dump_stack) from (dump_header+0x7c/0xe4) (dump_header) from (out_of_memory+0x334/0x348) (out_of_memory) from (__alloc_pages_nodemask+0xe9c/0xeb8) (__alloc_pages_nodemask) from (kmalloc_order_trace+0x34/0x128) (kmalloc_order_trace) from (__kmalloc+0x258/0x36c) (__kmalloc) from (evdev_open+0x5c/0x17c) (evdev_open) from (chrdev_open+0x100/0x204) (chrdev_open) from (do_dentry_open+0x21c/0x354) (do_dentry_open) from (vfs_open+0x58/0x84) (vfs_open) from (path_openat+0x640/0xc98) (path_openat) from (do_filp_open+0x78/0x11c) (do_filp_open) from (do_sys_open+0x130/0x244) (do_sys_open) from (SyS_openat+0x14/0x18) (SyS_openat) from (__sys_trace_return+0x0/0x10) ... Normal: 12488*4kB (UMEH) 6984*8kB (UMEH) 2101*16kB (UMEH) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 139440kB HighMem: 206*4kB (H) 131*8kB (H) 42*16kB (H) 2*32kB (H) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2608kB ... Kernel panic - not syncing: Out of memory and no killable processes... Signed-off-by: Miles Chen Signed-off-by: Dmitry Torokhov commit ac61145a725ab0411c5f8ed9aeca6202076ecfd8 Merge: 213356fe986f 9e635c2851df Author: Linus Torvalds Date: Fri Jan 10 13:41:16 2020 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fix from Jiri Kosina: "A regression fix for EPOLLOUT handling in hidraw and uhid" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: hidraw, uhid: Always report EPOLLOUT commit 213356fe986faff3580f2c12c14773f53da32768 Merge: 9fb7007de8a2 1530f6f5f580 Author: Linus Torvalds Date: Fri Jan 10 13:29:40 2020 -0800 Merge tag 'usb-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/PHY fixes from Greg KH: "Here are a number of USB and PHY driver fixes for 5.5-rc6 Nothing all that unusual, just the a bunch of small fixes for a lot of different reported issues. The PHY driver fixes are in here as they interacted with the usb drivers. Full details of the patches are in the shortlog, and all of these have been in linux-next with no reported issues" * tag 'usb-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (24 commits) usb: missing parentheses in USE_NEW_SCHEME usb: ohci-da8xx: ensure error return on variable error is set usb: musb: Disable pullup at init usb: musb: fix idling for suspend after disconnect interrupt usb: typec: ucsi: Fix the notification bit offsets USB: Fix: Don't skip endpoint descriptors with maxpacket=0 USB-PD tcpm: bad warning+size, PPS adapters phy/rockchip: inno-hdmi: round clock rate down to closest 1000 Hz usb: chipidea: host: Disable port power only if previously enabled usb: cdns3: should not use the same dev_id for shared interrupt handler usb: dwc3: gadget: Fix request complete check usb: musb: dma: Correct parameter passed to IRQ handler usb: musb: jz4740: Silence error if code is -EPROBE_DEFER usb: udc: tegra: select USB_ROLE_SWITCH USB: core: fix check for duplicate endpoints phy: cpcap-usb: Drop extra write to usb2 register phy: cpcap-usb: Improve host vs docked mode detection phy: cpcap-usb: Prevent USB line glitches from waking up modem phy: mapphone-mdm6600: Fix uninitialized status value regression phy: cpcap-usb: Fix flakey host idling and enumerating of devices ... commit 9fb7007de8a2a80e4b55a850311fca10de62f1b5 Merge: 7da37cd0520e 68faa679b8be Author: Linus Torvalds Date: Fri Jan 10 13:25:24 2020 -0800 Merge tag 'char-misc-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fix from Greg KH: "Here is a single fix, for the chrdev core, for 5.5-rc6 There's been a long-standing race condition triggered by syzbot, and occasionally real people, in the chrdev open() path. Will finally took the time to track it down and fix it for real before the holidays. Here's that one patch, it's been in linux-next for a while with no reported issues and it does fix the reported problem" * tag 'char-misc-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: chardev: Avoid potential use-after-free in 'chrdev_open()' commit 7da37cd0520e71707a1190022377941b9cec3b0b Merge: 5a96c0bbff86 58dcc5bf4030 Author: Linus Torvalds Date: Fri Jan 10 13:22:11 2020 -0800 Merge tag 'staging-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging fixes from Greg KH: "Here are some small staging driver fixes for 5.5-rc6. Nothing major here, just some small fixes for a comedi driver, the vt6656 driver, and a new device id for the rtl8188eu driver. All of these have been in linux-next for a while with no reported issues" * tag 'staging-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21 staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713 staging: vt6656: set usb_set_intfdata on driver fail. staging: vt6656: remove bool from vnt_radio_power_on ret staging: vt6656: limit reg output to block size staging: vt6656: correct return of vnt_init_registers. staging: vt6656: Fix non zero logical return of, usb_control_msg commit 5a96c0bbff8690afb3a2fcfc80208cd6590f6e88 Merge: 4e4cd21c64da c5ee0b3104e0 Author: Linus Torvalds Date: Fri Jan 10 13:17:21 2020 -0800 Merge tag 'tty-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are two tty/serial driver fixes for 5.5-rc6. The first fixes a much much reported issue with a previous tty port link patch that is in your tree, and the second fixes a problem where the serdev driver would claim ACPI devices that it shouldn't be claiming. Both have been in linux-next for a while with no reported issues" * tag 'tty-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serdev: Don't claim unsupported ACPI serial devices tty: always relink the port commit 4e4cd21c64dadc608e569a15b56e86eb85137fc9 Merge: 30b6487d1519 e17016f6dcb0 Author: Linus Torvalds Date: Fri Jan 10 12:05:26 2020 -0800 Merge tag 'block-5.5-2020-01-10' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A few fixes that should go into this round. This pull request contains two NVMe fixes via Keith, removal of a dead function, and a fix for the bio op for read truncates (Ming)" * tag 'block-5.5-2020-01-10' of git://git.kernel.dk/linux-block: nvmet: fix per feat data len for get_feature nvme: Translate more status codes to blk_status_t fs: move guard_bio_eod() after bio_set_op_attrs block: remove unused mp_bvec_last_segment commit 30b6487d151981e850de19b2b3feefd9b9791957 Merge: 4936ce17bf7c eacc6dfaea96 Author: Linus Torvalds Date: Fri Jan 10 12:03:12 2020 -0800 Merge tag 'io_uring-5.5-2020-01-10' of git://git.kernel.dk/linux-block Pull io_uring fix from Jens Axboe: "Single fix for this series, fixing a regression with the short read handling. This just removes it, as it cannot safely be done for all cases" * tag 'io_uring-5.5-2020-01-10' of git://git.kernel.dk/linux-block: io_uring: remove punt of short reads to async context commit 4936ce17bf7c4a17a9223a0b7d96c49d62767762 Merge: b1d198c08ccc 82de6a6fb67e Author: Linus Torvalds Date: Fri Jan 10 11:57:10 2020 -0800 Merge tag 'mtd/fixes-for-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fixes from Miquel Raynal: "MTD: - sm_ftl: Fix NULL pointer warning. Raw NAND: - Cadence: fix compile testing. - STM32: Avoid locking. Onenand: - Fix several sparse/build warnings. SPI-NOR: - Add a flag to fix interaction with Micron parts" * tag 'mtd/fixes-for-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: spi-nor: Fix the writing of the Status Register on micron flashes mtd: sm_ftl: fix NULL pointer warning mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy mtd: onenand: samsung: Fix iomem access with regular memcpy mtd: onenand: omap2: Fix errors in style mtd: cadence: Fix cast to pointer from integer of different size warning mtd: rawnand: stm32_fmc2: avoid to lock the CPU bus commit b1d198c08ccc8fc794384a50c5202dbdf8eba8c6 Merge: 658e1af5eec6 8e85def5723e Author: Linus Torvalds Date: Fri Jan 10 11:52:36 2020 -0800 Merge tag 'sound-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few piled ASoC fixes and usual HD-audio and USB-audio fixups. Some of them are for ASoC core error-handling" * tag 'sound-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda: enable regmap internal locking ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th gen ALSA: hda/realtek - Set EAPD control to default for ALC222 ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5 ALSA: hda/realtek - Add new codec supported for ALCS1200A ASoC: Intel: boards: Fix compile-testing RT1011/RT5682 ASoC: SOF: imx8: Fix dsp_box offset ASoC: topology: Prevent use-after-free in snd_soc_get_pcm_runtime() ASoC: fsl_audmix: add missed pm_runtime_disable ASoC: stm32: spdifrx: fix input pin state management ASoC: stm32: spdifrx: fix race condition in irq handler ASoC: stm32: spdifrx: fix inconsistent lock state ASoC: core: Fix access to uninitialized list heads ASoC: soc-core: Set dpcm_playback / dpcm_capture ASoC: SOF: imx8: fix memory allocation failure check on priv->pd_dev ASoC: SOF: Intel: hda: hda-dai: fix oops on hda_link .hw_free ASoC: SOF: fix fault at driver unload after failed probe commit 658e1af5eec6d51f95fa81e61f67d2fe1c6376aa Merge: c23e744b59ef 344fa0bad693 Author: Linus Torvalds Date: Fri Jan 10 11:48:37 2020 -0800 Merge tag 'thermal-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal fix from Daniel Lezcano: "Fix backward compatibility with old DTBs on QCOM tsens (Amit Kucheria)" * tag 'thermal-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: drivers: thermal: tsens: Work with old DTBs commit c23e744b59efcf546b2b16834c68b85248d6bf3b Merge: bef1d88263ff 10674d97c4e2 Author: Linus Torvalds Date: Fri Jan 10 11:46:59 2020 -0800 Merge tag 'pm-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "Prevent the cpufreq-dt driver from probing Tegra20/30 (Dmitry Osipenko) and prevent the Intel RAPL power capping driver from crashing during CPU initialization due to a NULL pointer dereference if the processor model in use is not known to it (Harry Pan)" * tag 'pm-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: powercap: intel_rapl: add NULL pointer check to rapl_mmio_cpu_online() cpufreq: dt-platdev: Blacklist NVIDIA Tegra20 and Tegra30 SoCs commit 9827c0634e461703abf81e8cc8b7adf5da5886d0 Author: David Ahern Date: Fri Jan 10 09:03:58 2020 -0800 ipv4: Detect rollover in specific fib table dump Sven-Haegar reported looping on fib dumps when 255.255.255.255 route has been added to a table. The looping is caused by the key rolling over from FFFFFFFF to 0. When dumping a specific table only, we need a means to detect when the table dump is done. The key and count saved to cb args are both 0 only at the start of the table dump. If key is 0 and count > 0, then we are in the rollover case. Detect and return to avoid looping. This only affects dumps of a specific table; for dumps of all tables (the case prior to the change in the Fixes tag) inet_dump_fib moved the entry counter to the next table and reset the cb args used by fib_table_dump and fn_trie_dump_leaf, so the rollover ffffffff back to 0 did not cause looping with the dumps. Fixes: effe67926624 ("net: Enable kernel side filtering of route dumps") Reported-by: Sven-Haegar Koch Signed-off-by: David Ahern Signed-off-by: David S. Miller commit b509750f8e87794c97dc199a92ea4e4e47db0b16 Merge: db885e66d268 7bd754c47dd3 Author: David S. Miller Date: Fri Jan 10 11:31:10 2020 -0800 Merge branch 'stmmac-filtering-fixes' Jose Abreu says: ==================== net: stmmac: Filtering fixes Two single fixes for the L3 and L4 filtering in stmmac. 1) Updates the internal status of RSS when disabling it in order to keep internal driver status consistent. 2) Do not lets user add a filter if RSS is enabled because the filter will not work correctly as RSS bypasses this mechanism. ==================== Signed-off-by: David S. Miller commit 7bd754c47dd3ad1b048c9641294b0234fcce2c58 Author: Jose Abreu Date: Fri Jan 10 16:23:53 2020 +0100 net: stmmac: tc: Do not setup flower filtering if RSS is enabled RSS, when enabled, will bypass the L3 and L4 filtering causing it not to work. Add a check before trying to setup the filters. Fixes: 425eabddaf0f ("net: stmmac: Implement L3/L4 Filters using TC Flower") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit e715d74504352968cf24ac95476706bc911a69cd Author: Jose Abreu Date: Fri Jan 10 16:23:52 2020 +0100 net: stmmac: selftests: Update status when disabling RSS We are disabling RSS on HW but not updating the internal private status to the 'disabled' state. This is needed for next tc commit that will check if RSS is disabled before trying to apply filters. Fixes: 4647e021193d ("net: stmmac: selftests: Add selftest for L3/L4 Filters") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit db885e66d268884dc72967279b7e84f522556abc Author: Jakub Kicinski Date: Fri Jan 10 04:38:32 2020 -0800 net/tls: fix async operation Mallesham reports the TLS with async accelerator was broken by commit d10523d0b3d7 ("net/tls: free the record on encryption error") because encryption can return -EINPROGRESS in such setups, which should not be treated as an error. The error is also present in the BPF path (likely copied from there). Reported-by: Mallesham Jatharakonda Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling") Fixes: d10523d0b3d7 ("net/tls: free the record on encryption error") Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 5c5d22a750d4bcf35e9539dccec397b0edcce176 Author: Jakub Kicinski Date: Fri Jan 10 04:36:55 2020 -0800 net/tls: avoid spurious decryption error with HW resync When device loses sync mid way through a record - kernel has to re-encrypt the part of the record which the device already decrypted to be able to decrypt and authenticate the record in its entirety. The re-encryption piggy backs on the decryption routine, but obviously because the partially decrypted record can't be authenticated crypto API returns an error which is then ignored by tls_device_reencrypt(). Commit 5c5ec6685806 ("net/tls: add TlsDecryptError stat") added a statistic to count decryption errors, this statistic can't be incremented when we see the expected re-encryption error. Move the inc to the caller. Reported-and-tested-by: David Beckett Fixes: 5c5ec6685806 ("net/tls: add TlsDecryptError stat") Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 2e012c74823629d9db27963c79caa3f5b2010746 Author: Lorenz Bauer Date: Fri Jan 10 13:23:36 2020 +0000 net: bpf: Don't leak time wait and request sockets It's possible to leak time wait and request sockets via the following BPF pseudo code:   sk = bpf_skc_lookup_tcp(...) if (sk) bpf_sk_release(sk) If sk->sk_state is TCP_NEW_SYN_RECV or TCP_TIME_WAIT the refcount taken by bpf_skc_lookup_tcp is not undone by bpf_sk_release. This is because sk_flags is re-used for other data in both kinds of sockets. The check !sock_flag(sk, SOCK_RCU_FREE) therefore returns a bogus result. Check that sk_flags is valid by calling sk_fullsock. Skip checking SOCK_RCU_FREE if we already know that sk is not a full socket. Fixes: edbf8c01de5a ("bpf: add skc_lookup_tcp helper") Fixes: f7355a6c0497 ("bpf: Check sk_fullsock() before returning from bpf_sk_lookup()") Signed-off-by: Lorenz Bauer Signed-off-by: Alexei Starovoitov Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20200110132336.26099-1-lmb@cloudflare.com commit ffd08731b2d632459428612431060cf902324a8d Author: Vincenzo Frascino Date: Thu Nov 28 11:17:19 2019 +0000 lib/vdso: Make __cvdso_clock_getres() static Fix the following sparse warning in the generic vDSO library: linux/lib/vdso/gettimeofday.c:224:5: warning: symbol '__cvdso_clock_getres' was not declared. Should it be static? Make it static and also mark it __maybe_unsed. Fixes: 502a590a170b ("lib/vdso: Move fallback invocation to the callers") Reported-by: Marc Gonzalez Signed-off-by: Vincenzo Frascino Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20191128111719.8282-1-vincenzo.frascino@arm.com commit e17016f6dcb047f91a8fc9f46bbf81a21d15ca73 Author: Amit Engel Date: Wed Jan 8 01:47:24 2020 +0900 nvmet: fix per feat data len for get_feature The existing implementation for the get_feature admin-cmd does not use per-feature data len. This patch introduces a new helper function nvmet_feat_data_len(), which is used to calculate per feature data len. Right now we only set data len for fid 0x81 (NVME_FEAT_HOST_ID). Fixes: commit e9061c397839 ("nvmet: Remove the data_len field from the nvmet_req struct") Reviewed-by: Christoph Hellwig Signed-off-by: Amit Engel [endiness, naming, and kernel style fixes] Signed-off-by: Chaitanya Kulkarni Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit 35038bffa87da282010b91108cadd13238bb5bbd Author: Keith Busch Date: Fri Dec 6 04:50:44 2019 +0900 nvme: Translate more status codes to blk_status_t Decode interrupted command and not ready namespace nvme status codes to BLK_STS_TARGET. These are not generic IO errors and should use a non-path specific error so that it can use the non-failover retry path. Reported-by: John Meneghini Cc: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit 9e635c2851df6caee651e589fbf937b637973c91 Author: Jiri Kosina Date: Fri Jan 10 15:32:51 2020 +0100 HID: hidraw, uhid: Always report EPOLLOUT hidraw and uhid device nodes are always available for writing so we should always report EPOLLOUT and EPOLLWRNORM bits, not only in the cases when there is nothing to read. Reported-by: Linus Torvalds Fixes: be54e7461ffdc ("HID: uhid: Fix returning EPOLLOUT from uhid_char_poll") Fixes: 9f3b61dc1dd7b ("HID: hidraw: Fix returning EPOLLOUT from hidraw_poll") Signed-off-by: Jiri Kosina commit 8e55ea19125b65cffe42747359af99d545e85f2f Author: Olivier Moysan Date: Fri Jan 10 14:11:31 2020 +0100 ASoC: stm32: dfsdm: fix 16 bits record In stm32_afsdm_pcm_cb function, the transfer size is provided in bytes. However, samples are copied as 16 bits words from iio buffer. Divide by two the transfer size, to copy the right number of samples. Fixes: 1e7f6e1c69f0 ("ASoC: stm32: dfsdm: add 16 bits audio record support") Signed-off-by: Olivier Moysan Link: https://lore.kernel.org/r/20200110131131.3191-1-olivier.moysan@st.com Signed-off-by: Mark Brown commit 10674d97c4e266e8c50ce794d1c470c26228d52b Merge: c936069fb59c 3aa3c5882e4f Author: Rafael J. Wysocki Date: Fri Jan 10 10:58:45 2020 +0100 Merge branch 'powercap' * powercap: powercap: intel_rapl: add NULL pointer check to rapl_mmio_cpu_online() commit 529244bd1afc102ab164429d338d310d5d65e60d Author: James Bottomley Date: Wed Jan 8 17:21:32 2020 -0800 scsi: enclosure: Fix stale device oops with hot replug Doing an add/remove/add on a SCSI device in an enclosure leads to an oops caused by poisoned values in the enclosure device list pointers. The reason is because we are keeping the enclosure device across the enclosed device add/remove/add but the current code is doing a device_add/device_del/device_add on it. This is the wrong thing to do in sysfs, so fix it by not doing a device_del on the enclosure device simply because of a hot remove of the drive in the slot. [mkp: added missing email addresses] Fixes: 43d8eb9cfd0a ("[SCSI] ses: add support for enclosure component hot removal") Link: https://lore.kernel.org/r/1578532892.3852.10.camel@HansenPartnership.com Signed-off-by: James Bottomley Reported-by: Luo Jiaxing Tested-by: John Garry Signed-off-by: Martin K. Petersen commit 465f4edaecc6c37f81349233e84d46246bcac11a Author: Xiang Chen Date: Thu Jan 9 09:12:24 2020 +0800 scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI If an attached disk with protection information enabled is reformatted to Type 0 the revalidation code does not clear the original protection type and subsequent accesses will keep setting RDPROTECT/WRPROTECT. Set the protection type to 0 if the disk reports PROT_EN=0 in READ CAPACITY(16). [mkp: commit desc] Fixes: fe542396da73 ("[SCSI] sd: Ensure we correctly disable devices with unknown protection type") Link: https://lore.kernel.org/r/1578532344-101668-1-git-send-email-chenxiang66@hisilicon.com Signed-off-by: Xiang Chen Signed-off-by: Martin K. Petersen commit bef1d88263ff769f15aa0e1515cdcede84e61d15 Merge: 6d25ef773538 e163fdb3f7f8 Author: Linus Torvalds Date: Thu Jan 9 21:42:05 2020 -0800 Merge tag 'pstore-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore fix from Kees Cook: "Cengiz Can forwarded a Coverity report about more problems with a rare pstore initialization error path, so the allocation lifetime was rearranged to avoid needing to share the kfree() responsibilities between caller and callee" * tag 'pstore-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: Regularize prz label allocation lifetime commit 6d25ef773538c82445ee2ea849acecc0889cc7f6 Merge: 5e7c1b75bd2a 023b3b0e139f Author: Linus Torvalds Date: Thu Jan 9 21:37:39 2020 -0800 Merge tag 'drm-fixes-2020-01-10' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Pre-LCA pull request I'm not sure how things will look next week, myself and Daniel are at LCA and I'm speaking quite late, so if I get my talk finished I'll probably process fixes. This week has a bunch of i915 fixes, some amdgpu fixes, one sun4i, one core MST, and one core fb_helper fix. More details below: core: - mst Fix NO_STOP_BIT bit offset (Wayne) fb_helper: - fb_helper: Fix bits_per_pixel param set behavior to round up (Geert) sun4i: - Fix RGB_DIV clock min divider on old hardware (Chen-Yu) amdgpu: - Stability fix for raven - Reduce pixel encoding to if max clock is exceeded on HDMI to allow additional high res modes - enable DRIVER_SYNCOBJ_TIMELINE for amdgpu i915: - Fix GitLab issue #446 causing GPU hangs: Do not restore invalid RS state - Fix GitLab issue #846: Restore coarse power gating that was disabled by initial RC66 context corruption security fixes. - Revert f6ec9483091f ("drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms") to avoid screen flicker - Fix to fill in unitialized uabi_instance in virtual engine uAPI - Add two missing W/As for ICL and EHL" * tag 'drm-fixes-2020-01-10' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu: add DRIVER_SYNCOBJ_TIMELINE to amdgpu drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded Revert "drm/amdgpu: Set no-retry as default." drm/fb-helper: Round up bits_per_pixel if possible drm/sun4i: tcon: Set RGB DCLK min. divider based on hardware model drm/i915/dp: Disable Port sync mode correctly on teardown drm/i915: Add Wa_1407352427:icl,ehl drm/i915: Add Wa_1408615072 and Wa_1407596294 to icl,ehl drm/i915/gt: Restore coarse power gating drm/i915/gt: Do not restore invalid RS state drm/i915: Limit audio CDCLK>=2*BCLK constraint back to GLK only drm/i915/gt: Mark up virtual engine uabi_instance drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ commit 5e7c1b75bd2a75005313574dd6e5354907005f93 Merge: 4a3033ef6e6b 9554de394b7e Author: Linus Torvalds Date: Thu Jan 9 21:03:54 2020 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "First RDMA subsystem updates for 5.5-rc. A very small set of fixes, most people seem to still be recovering from December! Five small driver fixes: - Fix error flow with MR allocation in bnxt_re - An errata work around for bnxt_re - Misuse of the workqueue API in hfi1 - Protocol error in hfi1 - Regression in 5.5 related to the mmap rework with i40iw" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: i40iw: Remove setting of VMA private data and use rdma_user_mmap_io IB/hfi1: Adjust flow PSN with the correct resync_psn IB/hfi1: Don't cancel unused work item RDMA/bnxt_re: Fix Send Work Entry state check while polling completions RDMA/bnxt_re: Avoid freeing MR resources if dereg fails commit e267371dd376d1b3ebc9f01229845a9656734d97 Merge: e21dba7a4df4 d5ad7a6a7f3c Author: David S. Miller Date: Thu Jan 9 18:46:10 2020 -0800 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2020-01-09 This series contains fixes to e1000e, igb, ixgbe, ixgbevf, i40e and iavf drivers. Brett fixes the validation of the virtchnl queue select bitmaps by comparing the bitmaps against BIT(I40E_MAX_VF_QUEUES). Radoslaw removes the limitation of only 10 filter entries for a VF and allows use of all free RAR entries for the forwarding database, if needed. Cambda Zhu fixes the calculation of queue when restoring flow director filters after resetting the adapter for ixgbe. Manfred Rudigier fixes the SGMIISFP module discovery for 100FX/LX modules for igb. Stefan Assmann fixes iavf where during a VF reset event, MAC filters were not altered, which could lead to a stale filter when an administratively set MAC address is forced by the PF. Adam adds the missing code to set the PHY access flag on X722 devices, which supports accessing PHY registers with the admin queue command. Revert a previous commit for e1000e to use "delayed work" which was causing connections to reset unexpectedly and possible driver crashes. ==================== Signed-off-by: David S. Miller commit e21dba7a4df4d93da237da65a096084b4f2e87b4 Author: Martin Schiller Date: Thu Jan 9 07:31:14 2020 +0100 net/x25: fix nonblocking connect This patch fixes 2 issues in x25_connect(): 1. It makes absolutely no sense to reset the neighbour and the connection state after a (successful) nonblocking call of x25_connect. This prevents any connection from being established, since the response (call accept) cannot be processed. 2. Any further calls to x25_connect() while a call is pending should simply return, instead of creating new Call Request (on different logical channels). This patch should also fix the "KASAN: null-ptr-deref Write in x25_connect" and "BUG: unable to handle kernel NULL pointer dereference in x25_connect" bugs reported by syzbot. Signed-off-by: Martin Schiller Reported-by: syzbot+429c200ffc8772bfe070@syzkaller.appspotmail.com Reported-by: syzbot+eec0c87f31a7c3b66f7b@syzkaller.appspotmail.com Signed-off-by: David S. Miller commit 3249b1e442a1be1a6b9f1026785b519d1443f807 Author: Sergei Shtylyov Date: Wed Jan 8 23:42:42 2020 +0300 sh_eth: check sh_eth_cpu_data::dual_port when dumping registers When adding the sh_eth_cpu_data::dual_port flag I forgot to add the flag checks to __sh_eth_get_regs(), causing the non-existing TSU registers to be dumped by 'ethtool' on the single port Ether controllers having TSU... Fixes: a94cf2a614f8 ("sh_eth: fix TSU init on SH7734/R8A7740") Signed-off-by: Sergei Shtylyov Signed-off-by: David S. Miller commit 023b3b0e139f54a680202790ba801f61aa43a5c8 Merge: ac0c9d3f8ad6 2b2c4a83d69d Author: Dave Airlie Date: Fri Jan 10 11:43:02 2020 +1000 Merge tag 'drm-intel-fixes-2020-01-09-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix GitLab issue #446 causing GPU hangs: Do not restore invalid RS state - Fix GitLab issue #846: Restore coarse power gating that was disabled by initial RC66 context corruption security fixes. - Revert f6ec9483091f ("drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms") to avoid screen flicker - Fix to fill in unitialized uabi_instance in virtual engine uAPI - Add two missing W/As for ICL and EHL Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20200109133458.GA15558@jlahtine-desk.ger.corp.intel.com commit 4a3033ef6e6bb4c566bd1d556de69b494d76976c Merge: a6a55b52a1b9 aa23ca3d98f7 Author: Linus Torvalds Date: Thu Jan 9 15:43:35 2020 -0800 Merge tag 'gpio-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Here is a host of GPIO fixes for the v5.5 series. The ACPI fix is especially important, see summary below and in the commit for details: - Select GPIOLIB_IRQCHIP on the max77620 GPIO expander - Fix context restore in the Zynq driver - Create a new ACPI quirk handler for disabling wakeups on problematic hardware. - Fix a coding style issue on the mockup device" * tag 'gpio-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism gpiolib: acpi: Turn dmi_system_id table into a generic quirk table gpio: zynq: Fix for bug in zynq_gpio_restore_context API gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP gpio: mockup: fix coding style commit a6a55b52a1b94bc71843d71b7194ec3d9a34ffcf Merge: b5b3159cff66 35c60be22057 Author: Linus Torvalds Date: Thu Jan 9 15:41:54 2020 -0800 Merge tag 'pinctrl-v5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Two fixes for pin control, not much to say about it, it's just regular driver fixes: - Fix erroneous shift in the Meson driver - Make Lochnagar select the GPIOLIB Kconfig symbol" * tag 'pinctrl-v5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: meson: Fix wrong shift value when get drive-strength pinctrl: lochnagar: select GPIOLIB commit b5b3159cff66b5b6830701d318b470d4b3e9a57f Merge: e69ec487b2c7 1021dcf19db1 Author: Linus Torvalds Date: Thu Jan 9 15:37:40 2020 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: "Just a few small fixups here" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: imx_sc_key - only take the valid data from SCU firmware as key state Input: add safety guards to input_set_keycode() Input: input_event - fix struct padding on sparc64 Input: uinput - always report EPOLLOUT commit e7a5f1f1cd0008e5ad379270a8657e121eedb669 Author: Lingpeng Chen Date: Thu Jan 9 09:48:33 2020 +0800 bpf/sockmap: Read psock ingress_msg before sk_receive_queue Right now in tcp_bpf_recvmsg, sock read data first from sk_receive_queue if not empty than psock->ingress_msg otherwise. If a FIN packet arrives and there's also some data in psock->ingress_msg, the data in psock->ingress_msg will be purged. It is always happen when request to a HTTP1.0 server like python SimpleHTTPServer since the server send FIN packet after data is sent out. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Reported-by: Arika Chen Suggested-by: Arika Chen Signed-off-by: Lingpeng Chen Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20200109014833.18951-1-forrest0579@gmail.com commit cf8ce8b80f8bf9669f6ec4e71e16668430febdac Author: Russell King Date: Sun Dec 15 16:39:05 2019 +0000 i2c: fix bus recovery stop mode timing The I2C specification states that tsu:sto for standard mode timing must be at minimum 4us. Pictographically, this is: SCL: ____/~~~~~~~~~ SDA: _________/~~~~ ->| |<- 4us minimum We are currently waiting 2.5us between asserting SCL and SDA, which is in violation of the standard. Adjust the timings to ensure that we meet what is stipulated as the minimum timings to ensure that all devices correctly interpret the STOP bus transition. This is more important than trying to generate a square wave with even duty cycle. Signed-off-by: Russell King Signed-off-by: Wolfram Sang commit a14bf98c045bf119b7e779f186528e38c6428830 Author: Olivier Moysan Date: Thu Jan 9 09:32:54 2020 +0100 ASoC: stm32: sai: fix possible circular locking In current driver, locks can be taken as follows: - Register access: take a lock on regmap config and then on clock. - Master clock provider: take a lock on clock and then on regmap config. This can lead to the circular locking summarized below. Remove peripheral clock management through regmap framework, and manage peripheral clock in driver instead. On register access, lock on clock is taken first, which allows to avoid possible locking issue. [ 6696.561513] ====================================================== [ 6696.567670] WARNING: possible circular locking dependency detected [ 6696.573842] 4.19.49 #866 Not tainted [ 6696.577397] ------------------------------------------------------ [ 6696.583566] pulseaudio/6439 is trying to acquire lock: [ 6696.588697] 87b0a25b (enable_lock){..-.}, at: clk_enable_lock+0x64/0x128 [ 6696.595377] [ 6696.595377] but task is already holding lock: [ 6696.601197] d858f825 (stm32_sai_sub:1342:(sai->regmap_config)->lock){....} ... [ 6696.812513] Possible unsafe locking scenario: [ 6696.812513] [ 6696.818418] CPU0 CPU1 [ 6696.822935] ---- ---- [ 6696.827451] lock(stm32_sai_sub:1342:(sai->regmap_config)->lock); [ 6696.833618] lock(enable_lock); [ 6696.839350] lock(stm32_sai_sub:1342: (sai->regmap_config)->lock); [ 6696.848035] lock(enable_lock); Fixes: 03e78a242a15 ("ASoC: stm32: sai: add h7 support") Signed-off-by: Olivier Moysan Link: https://lore.kernel.org/r/20200109083254.478-1-olivier.moysan@st.com Signed-off-by: Mark Brown commit 82de6a6fb67e16a30ec2f586b1f6976c2d7b4b62 Author: Tudor Ambarus Date: Tue Dec 3 14:50:01 2019 +0000 mtd: spi-nor: Fix the writing of the Status Register on micron flashes Micron flashes do not support 16 bit writes on the Status Register. According to micron datasheets, when using the Write Status Register (01h) command, the chip select should be driven LOW and held LOW until the eighth bit of the last data byte has been latched in, after which it must be driven HIGH. If CS is not driven HIGH, the command is not executed, flag status register error bits are not set, and the write enable latch remains set to 1. This fixes the lock operations on micron flashes. Reported-by: John Garry Fixes: 39d1e3340c73 ("mtd: spi-nor: Fix clearing of QE bit on lock()/unlock()") Signed-off-by: Tudor Ambarus Tested-by: John Garry Signed-off-by: Miquel Raynal commit de08b5ac10420db597cb24c41b4d8d06cce15ffd Author: Arnd Bergmann Date: Tue Jan 7 22:24:52 2020 +0100 mtd: sm_ftl: fix NULL pointer warning With gcc -O3, we get a new warning: In file included from arch/arm64/include/asm/processor.h:28, from drivers/mtd/sm_ftl.c:8: In function 'memset', inlined from 'sm_read_sector.constprop' at drivers/mtd/sm_ftl.c:250:3: include/linux/string.h:411:9: error: argument 1 null where non-null expected [-Werror=nonnull] return __builtin_memset(p, c, size); >From all I can tell, this cannot happen (the function is called either with a NULL buffer or with a -1 block number but not both), but adding a check makes it more robust and avoids the warning. Fixes: mmtom ("init/Kconfig: enable -O3 for all arches") Signed-off-by: Arnd Bergmann Signed-off-by: Miquel Raynal commit 8bcef0d54067077cf9a6cb129022c77559926e8c Author: Peter Ujfalusi Date: Tue Jan 7 10:45:44 2020 +0200 mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy The commit converting the driver to DMAengine was missing the flags for the memcpy prepare call. It went unnoticed since the omap-dma driver was ignoring them. Fixes: 3ed6a4d1de2c5 (" mtd: onenand: omap2: Convert to use dmaengine for memcp") Reported-by: Aaro Koskinen Signed-off-by: Peter Ujfalusi Tested-by: H. Nikolaus Schaller Tested-by: Aaro Koskinen Signed-off-by: Miquel Raynal commit 14ebf24175df0f216256c8483ee2974f35a1a89c Author: Krzysztof Kozlowski Date: Fri Jan 3 17:41:58 2020 +0100 mtd: onenand: samsung: Fix iomem access with regular memcpy The __iomem memory should be copied with memcpy_fromio. This fixes Sparse warnings like: drivers/mtd/nand/onenand/samsung_mtd.c:678:40: warning: incorrect type in argument 2 (different address spaces) drivers/mtd/nand/onenand/samsung_mtd.c:678:40: expected void const *from drivers/mtd/nand/onenand/samsung_mtd.c:678:40: got void [noderef] *[assigned] p drivers/mtd/nand/onenand/samsung_mtd.c:679:19: warning: incorrect type in assignment (different address spaces) drivers/mtd/nand/onenand/samsung_mtd.c:679:19: expected void [noderef] *[assigned] p drivers/mtd/nand/onenand/samsung_mtd.c:679:19: got unsigned char * Reported-by: kbuild test robot Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit 44f45994f438b4f4e0ba977b173980268983c60f Author: Amir Mahdi Ghorbanian Date: Thu Jan 2 12:10:08 2020 -0500 mtd: onenand: omap2: Fix errors in style Correct mispelling, spacing, and coding style flaws caught by checkpatch.pl script in the Omap2 Onenand driver . Signed-off-by: Amir Mahdi Ghorbanian Signed-off-by: Miquel Raynal commit 4aa906f1859614842818dc3b4cb5b27bc35961e2 Author: Vasyl Gomonovych Date: Wed Dec 18 11:57:15 2019 +0200 mtd: cadence: Fix cast to pointer from integer of different size warning Use dma_addr_t type to pass memory address and control data in DMA descriptor fields memory_pointer and ctrl_data_ptr To fix warning: cast to pointer from integer of different size Signed-off-by: Vasyl Gomonovych Acked-by: Olof Johansson Signed-off-by: Miquel Raynal commit 4114b17af41272e14939b000ce8f3ed7ba937e3c Author: Christophe Kerello Date: Mon Dec 16 10:01:55 2019 +0100 mtd: rawnand: stm32_fmc2: avoid to lock the CPU bus We are currently using nand_soft_waitrdy to poll the status of the NAND flash. FMC2 enables the wait feature bit (this feature is mandatory for the sequencer mode). By enabling this feature, we can't poll the status of the NAND flash, the read status command is stucked in FMC2 pipeline until R/B# signal is high, and locks the CPU bus. To avoid to lock the CPU bus, we poll FMC2 ISR register. This register reports the status of the R/B# signal. Fixes: 2cd457f328c1 ("mtd: rawnand: stm32_fmc2: add STM32 FMC2 NAND flash controller driver") Signed-off-by: Christophe Kerello Signed-off-by: Miquel Raynal commit e69ec487b2c7c82ef99b4b15122f58a2a99289a3 Merge: a5f48c7878d2 20eee6e5af35 Author: Linus Torvalds Date: Thu Jan 9 10:51:22 2020 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fix for OOB in hiddev, from Dmitry Torokhov - _poll API fixes for hidraw, from Marcel Holtmann - functional fix for Steam driver, from Rodrigo Rivas Costa - a few new device IDs / device-specific quirks and other assorted smaller fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: steam: Fix input device disappearing HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID drivers/hid/hid-multitouch.c: fix a possible null pointer access. HID: wacom: Recognize new MobileStudio Pro PID HID: intel-ish-hid: ipc: add CMP device id HID: hiddev: fix mess in hiddev_open() HID: hid-input: clear unmapped usages HID: Add quirk for incorrect input length on Lenovo Y720 HID: asus: Ignore Asus vendor-page usage-code 0xff events HID: ite: Add USB id match for Acer SW5-012 keyboard dock HID: Add quirk for Xin-Mo Dual Controller HID: Fix slab-out-of-bounds read in hid_field_extract HID: multitouch: Add LG MELF0410 I2C touchscreen support HID: uhid: Fix returning EPOLLOUT from uhid_char_poll HID: hidraw: Fix returning EPOLLOUT from hidraw_poll commit a5f48c7878d2365f6ff7008e9317abbc16f68847 Merge: b07f636fca1c 9546a0b7ce00 Author: Linus Torvalds Date: Thu Jan 9 10:34:07 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Missing netns pointer init in arp_tables, from Florian Westphal. 2) Fix normal tcp SACK being treated as D-SACK, from Pengcheng Yang. 3) Fix divide by zero in sch_cake, from Wen Yang. 4) Len passed to skb_put_padto() is wrong in qrtr code, from Carl Huang. 5) cmd->obj.chunk is leaked in sctp code error paths, from Xin Long. 6) cgroup bpf programs can be released out of order, fix from Roman Gushchin. 7) Make sure stmmac debugfs entry name is changed when device name changes, from Jiping Ma. 8) Fix memory leak in vlan_dev_set_egress_priority(), from Eric Dumazet. 9) SKB leak in lan78xx usb driver, also from Eric Dumazet. 10) Ridiculous TCA_FQ_QUANTUM values configured can cause loops in fq packet scheduler, reject them. From Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (69 commits) tipc: fix wrong connect() return code tipc: fix link overflow issue at socket shutdown netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present netfilter: conntrack: dccp, sctp: handle null timeout argument atm: eni: fix uninitialized variable warning macvlan: do not assume mac_header is set in macvlan_broadcast() net: sch_prio: When ungrafting, replace with FIFO mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO MAINTAINERS: Remove myself as co-maintainer for qcom-ethqos gtp: fix bad unlock balance in gtp_encap_enable_socket pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM tipc: remove meaningless assignment in Makefile tipc: do not add socket.o to tipc-y twice net: stmmac: dwmac-sun8i: Allow all RGMII modes net: stmmac: dwmac-sunxi: Allow all RGMII modes net: usb: lan78xx: fix possible skb leak net: stmmac: Fixed link does not need MDIO Bus vlan: vlan_changelink() should propagate errors vlan: fix memory leak in vlan_dev_set_egress_priority stmmac: debugfs entry name is not be changed when udev rename device name. ... commit d5ad7a6a7f3c87b278d7e4973b65682be4e588dd Author: Jeff Kirsher Date: Sat Jan 4 23:29:22 2020 -0800 e1000e: Revert "e1000e: Make watchdog use delayed work" This reverts commit 59653e6497d16f7ac1d9db088f3959f57ee8c3db. This is due to this commit causing driver crashes and connections to reset unexpectedly. Signed-off-by: Jeff Kirsher Tested-by: Aaron Brown commit bb37362f34d66f8f563e74a2c97de95c0c1beee5 Author: Adam Ludkiewicz Date: Wed Jan 8 13:44:10 2020 -0800 i40e: Set PHY Access flag on X722 The X722 FW API version 1.9 adds support for accessing PHY registers with Admin Queue Command. This enables reading EEPROM data from (Q)SFP+ transceivers, what was previously possible only on X710 devices. Signed-off-by: Adam Ludkiewicz Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 9e05229190380f6b8f702da39aaeb97a0fc80dc3 Author: Stefan Assmann Date: Tue Dec 17 11:29:23 2019 +0100 iavf: remove current MAC address filter on VF reset Currently MAC filters are not altered during a VF reset event. This may lead to a stale filter when an administratively set MAC is forced by the PF. For an administratively set MAC the PF driver deletes the VFs filters, overwrites the VFs MAC address and triggers a VF reset. However the VF driver itself is not aware of the filter removal, which is what the VF reset is for. The VF reset queues all filters present in the VF driver to be re-added to the PF filter list (including the filter for the now stale VF MAC address) and triggers a VIRTCHNL_OP_GET_VF_RESOURCES event, which provides the new MAC address to the VF. When this happens i40e will complain and reject the stale MAC filter, at least in the untrusted VF case. i40e 0000:08:00.0: Setting MAC 3c:fa:fa:fa:fa:01 on VF 0 iavf 0000:08:02.0: Reset warning received from the PF iavf 0000:08:02.0: Scheduling reset task i40e 0000:08:00.0: Bring down and up the VF interface to make this change effective. i40e 0000:08:00.0: VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation i40e 0000:08:00.0: VF 0 failed opcode 10, retval: -1 iavf 0000:08:02.0: Failed to add MAC filter, error IAVF_ERR_NVM To avoid re-adding the stale MAC filter it needs to be removed from the VF driver's filter list before queuing the existing filters. Then during the VIRTCHNL_OP_GET_VF_RESOURCES event the correct filter needs to be added again, at which point the MAC address has been updated. As a bonus this change makes bringing the VF down and up again superfluous for the administratively set MAC case. Signed-off-by: Stefan Assmann Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 5365ec1aeff5b9f2962a9c9b31d63f9dad7e0e2d Author: Manfred Rudigier Date: Wed Dec 4 11:40:26 2019 +0100 igb: Fix SGMII SFP module discovery for 100FX/LX. Changing the link mode should also be done for 100BaseFX SGMII modules, otherwise they just don't work when the default link mode in CTRL_EXT coming from the EEPROM is SERDES. Additionally 100Base-LX SGMII SFP modules are also supported now, which was not the case before. Tested with an i210 using Flexoptix S.1303.2M.G 100FX and S.1303.10.G 100LX SGMII SFP modules. Signed-off-by: Manfred Rudigier Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 4fad78ad6422d9bca62135bbed8b6abc4cbb85b8 Author: Cambda Zhu Date: Wed Nov 27 17:03:55 2019 +0800 ixgbe: Fix calculation of queue with VFs and flow director on interface flap This patch fixes the calculation of queue when we restore flow director filters after resetting adapter. In ixgbe_fdir_filter_restore(), filter's vf may be zero which makes the queue outside of the rx_ring array. The calculation is changed to the same as ixgbe_add_ethtool_fdir_entry(). Signed-off-by: Cambda Zhu Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit aa604651d523b1493988d0bf6710339f3ee60272 Author: Radoslaw Tyl Date: Mon Nov 25 15:24:52 2019 +0100 ixgbevf: Remove limit of 10 entries for unicast filter list Currently, though the FDB entry is added to VF, it does not appear in RAR filters. VF driver only allows to add 10 entries. Attempting to add another causes an error. This patch removes limitation and allows use of all free RAR entries for the FDB if needed. Fixes: 46ec20ff7d ("ixgbevf: Add macvlan support in the set rx mode op") Signed-off-by: Radoslaw Tyl Acked-by: Paul Menzel Signed-off-by: Jeff Kirsher commit d9d6a9aed3f66f8ce5fa3ca6ca26007d75032296 Author: Brett Creeley Date: Wed Nov 13 11:28:17 2019 -0800 i40e: Fix virtchnl_queue_select bitmap validation Currently in i40e_vc_disable_queues_msg() we are incorrectly validating the virtchnl queue select bitmaps. The virtchnl_queue_select rx_queues and tx_queue bitmap is being compared against ICE_MAX_VF_QUEUES, but the problem is that these bitmaps can have a value greater than I40E_MAX_VF_QUEUES. Fix this by comparing the bitmaps against BIT(I40E_MAX_VF_QUEUES). Also, add the function i40e_vc_validate_vqs_bitmaps() that checks to see if both virtchnl_queue_select bitmaps are empty along with checking that the bitmaps only have valid bits set. This function can then be used in both the queue enable and disable flows. Suggested-by: Arkady Gilinksky Signed-off-by: Brett Creeley Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit f35deaff1b8eadb9897e4fb8b3edc7717f4ec6fa Author: Arnd Bergmann Date: Sat Dec 7 20:10:26 2019 +0100 time/posix-stubs: Provide compat itimer supoprt for alpha Using compat_sys_getitimer and compat_sys_setitimer on alpha causes a link failure in the Alpha tinyconfig and other configurations that turn off CONFIG_POSIX_TIMERS. Use the same #ifdef check for the stub version as well. Fixes: 4c22ea2b9120 ("y2038: use compat_{get,set}_itimer on alpha") Reported-by: Guenter Roeck Reported-by: kbuild test robot Signed-off-by: Arnd Bergmann Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Link: https://lore.kernel.org/r/20191207191043.656328-1-arnd@arndb.de commit dc8d37ed304eeeea47e65fb9edc1c6c8b0093386 Author: Arnd Bergmann Date: Tue Dec 10 20:56:04 2019 +0100 cpu/SMT: Fix x86 link error without CONFIG_SYSFS When CONFIG_SYSFS is disabled, but CONFIG_HOTPLUG_SMT is enabled, the kernel fails to link: arch/x86/power/cpu.o: In function `hibernate_resume_nonboot_cpu_disable': (.text+0x38d): undefined reference to `cpuhp_smt_enable' arch/x86/power/hibernate.o: In function `arch_resume_nosmt': hibernate.c:(.text+0x291): undefined reference to `cpuhp_smt_enable' hibernate.c:(.text+0x29c): undefined reference to `cpuhp_smt_disable' Move the exported functions out of the #ifdef section into its own with the correct conditions. The patch that caused this is marked for stable backports, so this one may need to be backported as well. Fixes: ec527c318036 ("x86/power: Fix 'nosmt' vs hibernation triple fault during resume") Signed-off-by: Arnd Bergmann Signed-off-by: Thomas Gleixner Reviewed-by: Jiri Kosina Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191210195614.786555-1-arnd@arndb.de commit 40260b01d029ba374637838213af500e03305326 Author: Philipp Rudo Date: Wed Dec 18 11:24:43 2019 +0100 s390/setup: Fix secure ipl message The new machine loader on z15 always creates an IPL Report block and thus sets the IPL_PL_FLAG_IPLSR even when secure boot is disabled. This causes the wrong message being printed at boot. Fix this by checking for IPL_PL_FLAG_SIPL instead. Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot") Signed-off-by: Philipp Rudo Signed-off-by: Vasily Gorbik commit 0c874cd04292c7ee22d70eefc341fa2648f41f46 Author: Harald Freudenberger Date: Fri Nov 22 16:30:06 2019 +0100 s390/zcrypt: move ap device reset from bus to driver code This patch moves the reset invocation of an ap device when fresh detected from the ap bus to the probe() function of the driver responsible for this device. The virtualisation of ap devices makes it necessary to remove unconditioned resets on fresh appearing apqn devices. It may be that such a device is already enabled for guest usage. So there may be a race condition between host ap bus and guest ap bus doing the reset. This patch moves the reset from the ap bus to the zcrypt drivers. So if there is no zcrypt driver bound to an ap device - for example the ap device is bound to the vfio device driver - the ap device is untouched passed to the vfio device driver. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 94dd3bada53ee77b80d0aeee5571eeb83654d156 Author: Harald Freudenberger Date: Fri Dec 20 09:06:09 2019 +0100 s390/zcrypt: Fix CCA cipher key gen with clear key value function Regression tests showed that the CCA cipher key function which generates an CCA cipher key with given clear key value does not work correctly. At parsing the reply CPRB two limits are wrong calculated resulting in rejecting the reply as invalid with s390dbf message "_ip_cprb_helper reply with invalid or unknown key block". Fixes: f2bbc96e7cfa ("s390/pkey: add CCA AES cipher key support") Cc: Stable Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit bc8a76a152c5f9ef3b48104154a65a68a8b76946 Author: Akeem G Abodunrin Date: Wed Jan 8 09:25:00 2020 -0800 drm/i915/gen9: Clear residual context state on context switch Intel ID: PSIRT-TA-201910-001 CVEID: CVE-2019-14615 Intel GPU Hardware prior to Gen11 does not clear EU state during a context switch. This can result in information leakage between contexts. For Gen8 and Gen9, hardware provides a mechanism for fast cleardown of the EU state, by issuing a PIPE_CONTROL with bit 27 set. We can use this in a context batch buffer to explicitly cleardown the state on every context switch. As this workaround is already in place for gen8, we can borrow the code verbatim for Gen9. Signed-off-by: Mika Kuoppala Signed-off-by: Akeem G Abodunrin Cc: Kumar Valsan Prathap Cc: Chris Wilson Cc: Balestrieri Francesco Cc: Bloomfield Jon Cc: Dutt Sudeep commit 83c9c547168e8b914ea6398430473a4de68c52cc Author: Ming Lei Date: Sun Jan 5 09:41:14 2020 +0800 fs: move guard_bio_eod() after bio_set_op_attrs Commit 85a8ce62c2ea ("block: add bio_truncate to fix guard_bio_eod") adds bio_truncate() for handling bio EOD. However, bio_truncate() doesn't use the passed 'op' parameter from guard_bio_eod's callers. So bio_trunacate() may retrieve wrong 'op', and zering pages may not be done for READ bio. Fixes this issue by moving guard_bio_eod() after bio_set_op_attrs() in submit_bh_wbc() so that bio_truncate() can always retrieve correct op info. Meantime remove the 'op' parameter from guard_bio_eod() because it isn't used any more. Cc: Carlos Maiolino Cc: linux-fsdevel@vger.kernel.org Fixes: 85a8ce62c2ea ("block: add bio_truncate to fix guard_bio_eod") Signed-off-by: Ming Lei Fold in kerneldoc and bio_op() change. Signed-off-by: Jens Axboe commit 51bfb1d11d6daf095addf9fe8471c20992caae0b Author: Randy Dunlap Date: Sun Dec 8 20:26:55 2019 -0800 futex: Fix kernel-doc notation warning Fix a kernel-doc warning in kernel/futex.c by adding notation for @ret. ../kernel/futex.c:1187: warning: Function parameter or member 'ret' not described in 'wait_for_owner_exiting' Fixes: 3ef240eaff36 ("futex: Prevent exit livelock") Signed-off-by: Randy Dunlap Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/223be78c-f3c8-52df-836d-c5fb8e7907e9@infradead.org commit 4b0b97e651ecf29f20248420b52b6864fbd40bc2 Author: Marcel Ziswiler Date: Wed Jan 8 17:12:31 2020 +0100 ARM: dts: imx7: Fix Toradex Colibri iMX7S 256MB NAND flash support Turns out when introducing the eMMC version the gpmi node required for NAND flash support got enabled exclusively on Colibri iMX7D 512MB. Fixes: f928a4a377e4 ("ARM: dts: imx7: add Toradex Colibri iMX7D 1GB (eMMC) support") Signed-off-by: Marcel Ziswiler Signed-off-by: Shawn Guo commit 9608ea6c6613ced75b2c41703d99f44e6f8849f1 Author: Boyan Ding Date: Wed Jan 1 12:41:20 2020 -0800 pinctrl: sunrisepoint: Add missing Interrupt Status register offset Commit 179e5a6114cc ("pinctrl: intel: Remove default Interrupt Status offset") removes default interrupt status offset of GPIO controllers, with previous commits explicitly providing the previously default offsets. However, the is_offset value in SPTH_COMMUNITY is missing, preventing related irq from being properly detected and handled. Fixes: f702e0b93cdb ("pinctrl: sunrisepoint: Provide Interrupt Status register offset") Link: https://bugzilla.kernel.org/show_bug.cgi?id=205745 Cc: stable@vger.kernel.org Signed-off-by: Boyan Ding Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 3479b2843c78ffb60247f522226ba68f93aee355 Author: Anson Huang Date: Mon Dec 30 09:41:10 2019 +0800 ARM: dts: imx6sll-evk: Remove incorrect power supply assignment The vdd3p0 LDO's input should be from external USB VBUS directly, NOT PMIC's power supply, the vdd3p0 LDO's target output voltage can be controlled by SW, and it requires input voltage to be high enough, with incorrect power supply assigned, if the power supply's voltage is lower than the LDO target output voltage, it will return fail and skip the LDO voltage adjustment, so remove the power supply assignment for vdd3p0 to avoid such scenario. Fixes: 96a9169cf621 ("ARM: dts: imx6sll-evk: Assign corresponding power supply for vdd3p0") Signed-off-by: Anson Huang Signed-off-by: Shawn Guo commit b4eb9ef0e29cd28c6fd684e0ab77bda824acb20e Author: Anson Huang Date: Mon Dec 30 09:41:09 2019 +0800 ARM: dts: imx6sl-evk: Remove incorrect power supply assignment The vdd3p0 LDO's input should be from external USB VBUS directly, NOT PMIC's power supply, the vdd3p0 LDO's target output voltage can be controlled by SW, and it requires input voltage to be high enough, with incorrect power supply assigned, if the power supply's voltage is lower than the LDO target output voltage, it will return fail and skip the LDO voltage adjustment, so remove the power supply assignment for vdd3p0 to avoid such scenario. Fixes: 3feea8805d6f ("ARM: dts: imx6sl-evk: Assign corresponding power supply for LDOs") Signed-off-by: Anson Huang Signed-off-by: Shawn Guo commit d4918ebb5c256d26696a13e78ac68c146111191a Author: Anson Huang Date: Mon Dec 30 09:41:08 2019 +0800 ARM: dts: imx6sx-sdb: Remove incorrect power supply assignment The vdd3p0 LDO's input should be from external USB VBUS directly, NOT PMIC's power supply, the vdd3p0 LDO's target output voltage can be controlled by SW, and it requires input voltage to be high enough, with incorrect power supply assigned, if the power supply's voltage is lower than the LDO target output voltage, it will return fail and skip the LDO voltage adjustment, so remove the power supply assignment for vdd3p0 to avoid such scenario. Fixes: 37a4bdead109 ("ARM: dts: imx6sx-sdb: Assign corresponding power supply for LDOs") Signed-off-by: Anson Huang Signed-off-by: Shawn Guo commit 4521de30fbb3f5be0db58de93582ebce72c9d44f Author: Anson Huang Date: Mon Dec 30 09:41:07 2019 +0800 ARM: dts: imx6qdl-sabresd: Remove incorrect power supply assignment The vdd3p0 LDO's input should be from external USB VBUS directly, NOT PMIC's power supply, the vdd3p0 LDO's target output voltage can be controlled by SW, and it requires input voltage to be high enough, with incorrect power supply assigned, if the power supply's voltage is lower than the LDO target output voltage, it will return fail and skip the LDO voltage adjustment, so remove the power supply assignment for vdd3p0 to avoid such scenario. Fixes: 93385546ba36 ("ARM: dts: imx6qdl-sabresd: Assign corresponding power supply for LDOs") Signed-off-by: Anson Huang Signed-off-by: Shawn Guo commit 20eee6e5af35d9586774e80b6e0b1850e7cc9899 Author: Rodrigo Rivas Costa Date: Tue Jan 7 20:48:13 2020 +0100 HID: steam: Fix input device disappearing The `connected` value for wired devices was not properly initialized, it must be set to `true` upon creation, because wired devices do not generate connection events. When a raw client (the Steam Client) uses the device, the input device is destroyed. Then, when the raw client finishes, it must be recreated. But since the `connected` variable was false this never happended. Signed-off-by: Rodrigo Rivas Costa Signed-off-by: Jiri Kosina commit 4a132f60808ae3a751e107a373f8572012352d3c Author: Jagan Teki Date: Mon Dec 30 17:30:19 2019 +0530 ARM: dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL The EDIMM STARTER KIT i.Core 1.5 MIPI Evaluation is based on the 1.5 version of the i.Core MX6 cpu module. The 1.5 version differs from the original one for a few details, including the ethernet PHY interface clock provider. With this commit, the ethernet interface works properly: SMSC LAN8710/LAN8720 2188000.ethernet-1:00: attached PHY driver While before using the 1.5 version, ethernet failed to startup do to un-clocked PHY interface: fec 2188000.ethernet eth0: could not attach to PHY Similar fix has merged for i.Core MX6Q but missed to update for DL. Fixes: a8039f2dd089 ("ARM: dts: imx6dl: Add Engicam i.CoreM6 1.5 Quad/Dual MIPI starter kit support") Cc: Jacopo Mondi Signed-off-by: Michael Trimarchi Signed-off-by: Jagan Teki Signed-off-by: Shawn Guo commit cb1eeb75cf3dd84ced81333967200583993dfd73 Author: Arnd Bergmann Date: Tue Jan 7 21:08:58 2020 +0100 crypto: hisilicon/sec2 - Use atomics instead of __sync The use of __sync functions for atomic memory access is not supported in the kernel, and can result in a link error depending on configuration: ERROR: "__tsan_atomic32_compare_exchange_strong" [drivers/crypto/hisilicon/sec2/hisi_sec2.ko] undefined! ERROR: "__tsan_atomic64_fetch_add" [drivers/crypto/hisilicon/sec2/hisi_sec2.ko] undefined! Use the kernel's own atomic interfaces instead. This way the debugfs interface actually reads the counter atomically. Fixes: 416d82204df4 ("crypto: hisilicon - add HiSilicon SEC V2 driver") Signed-off-by: Arnd Bergmann Signed-off-by: Herbert Xu commit ac0c9d3f8ad616bc9e57126e9d542bff69de0ce7 Merge: 2c3addd83928 db4ff423cd16 Author: Dave Airlie Date: Thu Jan 9 12:32:05 2020 +1000 Merge tag 'amd-drm-fixes-5.5-2020-01-08' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.5-2020-01-08: amdgpu: - Stability fix for raven - Reduce pixel encoding to if max clock is exceeded on HDMI to allow additional high res modes UAPI: - enable DRIVER_SYNCOBJ_TIMELINE for amdgpu Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200108213649.5485-1-alexander.deucher@amd.com commit 2c3addd839282ec41e7a4079ed2ffce1806fbc54 Merge: c79f46a28239 f30e27779d30 Author: Dave Airlie Date: Thu Jan 9 12:23:57 2020 +1000 Merge tag 'drm-misc-fixes-2020-01-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes mst: Fix NO_STOP_BIT bit offset (Wayne) sun4i: Fix RGB_DIV clock min divider on old hardware (Chen-Yu) fb_helper: Fix bits_per_pixel param set behavior to round up (Geert) Cc: Wayne Lin Cc: Chen-Yu Tsai Cc: Geert Uytterhoeven Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20200108205949.GA233273@art_vandelay commit e163fdb3f7f8c62dccf194f3f37a7bcb3c333aa8 Author: Kees Cook Date: Wed Jan 8 10:06:54 2020 -0800 pstore/ram: Regularize prz label allocation lifetime In my attempt to fix a memory leak, I introduced a double-free in the pstore error path. Instead of trying to manage the allocation lifetime between persistent_ram_new() and its callers, adjust the logic so persistent_ram_new() always takes a kstrdup() copy, and leaves the caller's allocation lifetime up to the caller. Therefore callers are _always_ responsible for freeing their label. Before, it only needed freeing when the prz itself failed to allocate, and not in any of the other prz failure cases, which callers would have no visibility into, which is the root design problem that lead to both the leak and now double-free bugs. Reported-by: Cengiz Can Link: https://lore.kernel.org/lkml/d4ec59002ede4aaf9928c7f7526da87c@kernel.wtf Fixes: 8df955a32a73 ("pstore/ram: Fix error-path memory leak in persistent_ram_new() callers") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook commit 9546a0b7ce0077d827470f603f2522b845ce5954 Author: Tuong Lien Date: Wed Jan 8 09:19:00 2020 +0700 tipc: fix wrong connect() return code The current 'tipc_wait_for_connect()' function does a wait-loop for the condition 'sk->sk_state != TIPC_CONNECTING' to conclude if the socket connecting has done. However, when the condition is met, it returns '0' even in the case the connecting is actually failed, the socket state is set to 'TIPC_DISCONNECTING' (e.g. when the server socket has closed..). This results in a wrong return code for the 'connect()' call from user, making it believe that the connection is established and go ahead with building, sending a message, etc. but finally failed e.g. '-EPIPE'. This commit fixes the issue by changing the wait condition to the 'tipc_sk_connected(sk)', so the function will return '0' only when the connection is really established. Otherwise, either the socket 'sk_err' if any or '-ETIMEDOUT'/'-EINTR' will be returned correspondingly. Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller commit 49afb806cb650dd1f06f191994f3aa657d264009 Author: Tuong Lien Date: Wed Jan 8 09:18:15 2020 +0700 tipc: fix link overflow issue at socket shutdown When a socket is suddenly shutdown or released, it will reject all the unreceived messages in its receive queue. This applies to a connected socket too, whereas there is only one 'FIN' message required to be sent back to its peer in this case. In case there are many messages in the queue and/or some connections with such messages are shutdown at the same time, the link layer will easily get overflowed at the 'TIPC_SYSTEM_IMPORTANCE' backlog level because of the message rejections. As a result, the link will be taken down. Moreover, immediately when the link is re-established, the socket layer can continue to reject the messages and the same issue happens... The commit refactors the '__tipc_shutdown()' function to only send one 'FIN' in the situation mentioned above. For the connectionless case, it is unavoidable but usually there is no rejections for such socket messages because they are 'dest-droppable' by default. In addition, the new code makes the other socket states clear (e.g.'TIPC_LISTEN') and treats as a separate case to avoid misbehaving. Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller commit b73a65610b7decff6415d24940722e8aa09195cf Merge: 30780d086a83 22dad713b8a5 Author: David S. Miller Date: Wed Jan 8 15:22:41 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Missing netns context in arp_tables, from Florian Westphal. 2) Underflow in flowtable reference counter, from wenxu. 3) Fix incorrect ethernet destination address in flowtable offload, from wenxu. 4) Check for status of neighbour entry, from wenxu. 5) Fix NAT port mangling, from wenxu. 6) Unbind callbacks from destroy path to cleanup hardware properly on flowtable removal. 7) Fix missing casting statistics timestamp, add nf_flowtable_time_stamp and use it. 8) NULL pointer exception when timeout argument is null in conntrack dccp and sctp protocol helpers, from Florian Westphal. 9) Possible nul-dereference in ipset with IPSET_ATTR_LINENO, also from Florian. ==================== Signed-off-by: David S. Miller commit 22dad713b8a5ff488e07b821195270672f486eb2 Author: Florian Westphal Date: Wed Jan 8 10:59:38 2020 +0100 netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present The set uadt functions assume lineno is never NULL, but it is in case of ip_set_utest(). syzkaller managed to generate a netlink message that calls this with LINENO attr present: general protection fault: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:hash_mac4_uadt+0x1bc/0x470 net/netfilter/ipset/ip_set_hash_mac.c:104 Call Trace: ip_set_utest+0x55b/0x890 net/netfilter/ipset/ip_set_core.c:1867 nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 nfnetlink_rcv+0x1ba/0x460 net/netfilter/nfnetlink.c:563 pass a dummy lineno storage, its easier than patching all set implementations. This seems to be a day-0 bug. Cc: Jozsef Kadlecsik Reported-by: syzbot+34bd2369d38707f3f4a7@syzkaller.appspotmail.com Fixes: a7b4f989a6294 ("netfilter: ipset: IP set core support") Signed-off-by: Florian Westphal Acked-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 1d9a7acd3d1e74c2d150d8934f7f55bed6d70858 Author: Florian Westphal Date: Mon Jan 6 23:34:17 2020 +0100 netfilter: conntrack: dccp, sctp: handle null timeout argument The timeout pointer can be NULL which means we should modify the per-nets timeout instead. All do this, except sctp and dccp which instead give: general protection fault: 0000 [#1] PREEMPT SMP KASAN net/netfilter/nf_conntrack_proto_dccp.c:682 ctnl_timeout_parse_policy+0x150/0x1d0 net/netfilter/nfnetlink_cttimeout.c:67 cttimeout_default_set+0x150/0x1c0 net/netfilter/nfnetlink_cttimeout.c:368 nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 Reported-by: syzbot+46a4ad33f345d1dd346e@syzkaller.appspotmail.com Fixes: c779e849608a8 ("netfilter: conntrack: remove get_timeout() indirection") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 30780d086a83332adcd9362281201cee7c3d9d19 Author: Arnd Bergmann Date: Tue Jan 7 21:43:59 2020 +0100 atm: eni: fix uninitialized variable warning With -O3, gcc has found an actual unintialized variable stored into an mmio register in two instances: drivers/atm/eni.c: In function 'discard': drivers/atm/eni.c:465:13: error: 'dma[1]' is used uninitialized in this function [-Werror=uninitialized] writel(dma[i*2+1],eni_dev->rx_dma+dma_wr*8+4); ^ drivers/atm/eni.c:465:13: error: 'dma[3]' is used uninitialized in this function [-Werror=uninitialized] Change the code to always write zeroes instead. Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 96cc4b69581db68efc9749ef32e9cf8e0160c509 Author: Eric Dumazet Date: Mon Jan 6 12:30:48 2020 -0800 macvlan: do not assume mac_header is set in macvlan_broadcast() Use of eth_hdr() in tx path is error prone. Many drivers call skb_reset_mac_header() before using it, but others do not. Commit 6d1ccff62780 ("net: reset mac header in dev_start_xmit()") attempted to fix this generically, but commit d346a3fae3ff ("packet: introduce PACKET_QDISC_BYPASS socket option") brought back the macvlan bug. Lets add a new helper, so that tx paths no longer have to call skb_reset_mac_header() only to get a pointer to skb->data. Hopefully we will be able to revert 6d1ccff62780 ("net: reset mac header in dev_start_xmit()") and save few cycles in transmit fast path. BUG: KASAN: use-after-free in __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline] BUG: KASAN: use-after-free in mc_hash drivers/net/macvlan.c:251 [inline] BUG: KASAN: use-after-free in macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277 Read of size 4 at addr ffff8880a4932401 by task syz-executor947/9579 CPU: 0 PID: 9579 Comm: syz-executor947 Not tainted 5.5.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:639 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/generic_report.c:145 __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline] mc_hash drivers/net/macvlan.c:251 [inline] macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277 macvlan_queue_xmit drivers/net/macvlan.c:520 [inline] macvlan_start_xmit+0x402/0x77f drivers/net/macvlan.c:559 __netdev_start_xmit include/linux/netdevice.h:4447 [inline] netdev_start_xmit include/linux/netdevice.h:4461 [inline] dev_direct_xmit+0x419/0x630 net/core/dev.c:4079 packet_direct_xmit+0x1a9/0x250 net/packet/af_packet.c:240 packet_snd net/packet/af_packet.c:2966 [inline] packet_sendmsg+0x260d/0x6220 net/packet/af_packet.c:2991 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:659 __sys_sendto+0x262/0x380 net/socket.c:1985 __do_sys_sendto net/socket.c:1997 [inline] __se_sys_sendto net/socket.c:1993 [inline] __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1993 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x442639 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc13549e08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442639 RDX: 000000000000000e RSI: 0000000020000080 RDI: 0000000000000003 RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000403bb0 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 9389: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527 __do_kmalloc mm/slab.c:3656 [inline] __kmalloc+0x163/0x770 mm/slab.c:3665 kmalloc include/linux/slab.h:561 [inline] tomoyo_realpath_from_path+0xc5/0x660 security/tomoyo/realpath.c:252 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822 tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129 security_inode_getattr+0xf2/0x150 security/security.c:1222 vfs_getattr+0x25/0x70 fs/stat.c:115 vfs_statx_fd+0x71/0xc0 fs/stat.c:145 vfs_fstat include/linux/fs.h:3265 [inline] __do_sys_newfstat+0x9b/0x120 fs/stat.c:378 __se_sys_newfstat fs/stat.c:375 [inline] __x64_sys_newfstat+0x54/0x80 fs/stat.c:375 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 9389: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:335 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:474 kasan_slab_free+0xe/0x10 mm/kasan/common.c:483 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x2c0 mm/slab.c:3757 tomoyo_realpath_from_path+0x1a7/0x660 security/tomoyo/realpath.c:289 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822 tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129 security_inode_getattr+0xf2/0x150 security/security.c:1222 vfs_getattr+0x25/0x70 fs/stat.c:115 vfs_statx_fd+0x71/0xc0 fs/stat.c:145 vfs_fstat include/linux/fs.h:3265 [inline] __do_sys_newfstat+0x9b/0x120 fs/stat.c:378 __se_sys_newfstat fs/stat.c:375 [inline] __x64_sys_newfstat+0x54/0x80 fs/stat.c:375 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880a4932000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 1025 bytes inside of 4096-byte region [ffff8880a4932000, ffff8880a4933000) The buggy address belongs to the page: page:ffffea0002924c80 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0 raw: 00fffe0000010200 ffffea0002846208 ffffea00028f3888 ffff8880aa402000 raw: 0000000000000000 ffff8880a4932000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a4932300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a4932380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880a4932400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880a4932480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a4932500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: b863ceb7ddce ("[NET]: Add macvlan driver") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit 2f806c2a16b37ed6f90e4d9c1b14e97bb24ab0c2 Merge: cb6f74a1ead4 240ce7f6428f Author: David S. Miller Date: Wed Jan 8 12:45:53 2020 -0800 Merge branch 'net-ungraft-prio' Petr Machata says: ==================== When ungrafting from PRIO, replace child with FIFO When a child Qdisc is removed from one of the PRIO Qdisc's bands, it is replaced unconditionally by a NOOP qdisc. As a result, any traffic hitting that band gets dropped. That is incorrect--no Qdisc was explicitly added when PRIO was created, and after removal, none should have to be added either. In patch #2, this problem is fixed for PRIO by first attempting to create a default Qdisc and only falling back to noop when that fails. This pattern of attempting to create an invisible FIFO, using NOOP only as a fallback, is also seen in some other Qdiscs. The only driver currently offloading PRIO (and thus presumably the only one impacted by this) is mlxsw. Therefore patch #1 extends mlxsw to handle the replacement by an invisible FIFO gracefully. ==================== Signed-off-by: David S. Miller commit 240ce7f6428ff5188b9eedc066e1e4d645b8635f Author: Petr Machata Date: Mon Jan 6 18:01:56 2020 +0000 net: sch_prio: When ungrafting, replace with FIFO When a child Qdisc is removed from one of the PRIO Qdisc's bands, it is replaced unconditionally by a NOOP qdisc. As a result, any traffic hitting that band gets dropped. That is incorrect--no Qdisc was explicitly added when PRIO was created, and after removal, none should have to be added either. Fix PRIO by first attempting to create a default Qdisc and only falling back to noop when that fails. This pattern of attempting to create an invisible FIFO, using NOOP only as a fallback, is also seen in other Qdiscs. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 3971a535b839489e4ea31796cc086e6ce616318c Author: Petr Machata Date: Mon Jan 6 18:01:55 2020 +0000 mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO The following patch will change PRIO to replace a removed Qdisc with an invisible FIFO, instead of NOOP. mlxsw will see this replacement due to the graft message that is generated. But because FIFO does not issue its own REPLACE message, when the graft operation takes place, the Qdisc that mlxsw tracks under the indicated band is still the old one. The child handle (0:0) therefore does not match, and mlxsw rejects the graft operation, which leads to an extack message: Warning: Offloading graft operation failed. Fix by ignoring the invisible children in the PRIO graft handler. The DESTROY message of the removed Qdisc is going to follow shortly and handle the removal. Fixes: 32dc5efc6cb4 ("mlxsw: spectrum: qdiscs: prio: Handle graft command") Signed-off-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit cb6f74a1ead4c5ab2431ea6dbecd1447b74f7249 Author: Niklas Cassel Date: Mon Jan 6 17:31:30 2020 +0100 MAINTAINERS: Remove myself as co-maintainer for qcom-ethqos As I am no longer with Linaro, I no longer have access to documentation for this IP. The Linaro email will start bouncing soon. Vinod is fully capable to maintain this driver by himself, therefore remove myself as co-maintainer for qcom-ethqos. Signed-off-by: Niklas Cassel Signed-off-by: David S. Miller commit 90d72256addff9e5f8ad645e8f632750dd1f8935 Author: Eric Dumazet Date: Mon Jan 6 06:45:37 2020 -0800 gtp: fix bad unlock balance in gtp_encap_enable_socket WARNING: bad unlock balance detected! 5.5.0-rc5-syzkaller #0 Not tainted ------------------------------------- syz-executor921/9688 is trying to release lock (sk_lock-AF_INET6) at: [] gtp_encap_enable_socket+0x146/0x400 drivers/net/gtp.c:830 but there are no more locks to release! other info that might help us debug this: 2 locks held by syz-executor921/9688: #0: ffffffff8a4d8840 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8a4d8840 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x405/0xaf0 net/core/rtnetlink.c:5421 #1: ffff88809304b560 (slock-AF_INET6){+...}, at: spin_lock_bh include/linux/spinlock.h:343 [inline] #1: ffff88809304b560 (slock-AF_INET6){+...}, at: release_sock+0x20/0x1c0 net/core/sock.c:2951 stack backtrace: CPU: 0 PID: 9688 Comm: syz-executor921 Not tainted 5.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_unlock_imbalance_bug kernel/locking/lockdep.c:4008 [inline] print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3984 __lock_release kernel/locking/lockdep.c:4242 [inline] lock_release+0x5f2/0x960 kernel/locking/lockdep.c:4503 sock_release_ownership include/net/sock.h:1496 [inline] release_sock+0x17c/0x1c0 net/core/sock.c:2961 gtp_encap_enable_socket+0x146/0x400 drivers/net/gtp.c:830 gtp_encap_enable drivers/net/gtp.c:852 [inline] gtp_newlink+0x9fc/0xc60 drivers/net/gtp.c:666 __rtnl_newlink+0x109e/0x1790 net/core/rtnetlink.c:3305 rtnl_newlink+0x69/0xa0 net/core/rtnetlink.c:3363 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5424 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x58c/0x7d0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:659 ____sys_sendmsg+0x753/0x880 net/socket.c:2330 ___sys_sendmsg+0x100/0x170 net/socket.c:2384 __sys_sendmsg+0x105/0x1d0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg net/socket.c:2424 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2424 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x445d49 Code: e8 bc b7 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f8019074db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000006dac38 RCX: 0000000000445d49 RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003 RBP: 00000000006dac30 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000008 R11: 0000000000000246 R12: 00000000006dac3c R13: 00007ffea687f6bf R14: 00007f80190759c0 R15: 20c49ba5e353f7cf Fixes: e198987e7dd7 ("gtp: fix suspicious RCU usage") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Taehee Yoo Signed-off-by: David S. Miller commit d9e15a2733067c9328fb56d98fe8e574fa19ec31 Author: Eric Dumazet Date: Mon Jan 6 06:10:39 2020 -0800 pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM As diagnosed by Florian : If TCA_FQ_QUANTUM is set to 0x80000000, fq_deueue() can loop forever in : if (f->credit <= 0) { f->credit += q->quantum; goto begin; } ... because f->credit is either 0 or -2147483648. Let's limit TCA_FQ_QUANTUM to no more than 1 << 20 : This max value should limit risks of breaking user setups while fixing this bug. Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler") Signed-off-by: Eric Dumazet Diagnosed-by: Florian Westphal Reported-by: syzbot+dc9071cc5a85950bdfce@syzkaller.appspotmail.com Signed-off-by: David S. Miller commit b969fee12b6330fd6a0b15337a314d5b5ee56916 Author: Masahiro Yamada Date: Mon Jan 6 16:35:27 2020 +0900 tipc: remove meaningless assignment in Makefile There is no module named tipc_diag. The assignment to tipc_diag-y has no effect. Signed-off-by: Masahiro Yamada Signed-off-by: David S. Miller commit ea04b445a266cddd5d5c653690d9676df020302f Author: Masahiro Yamada Date: Mon Jan 6 16:35:26 2020 +0900 tipc: do not add socket.o to tipc-y twice net/tipc/Makefile adds socket.o twice. tipc-y += addr.o bcast.o bearer.o \ core.o link.o discover.o msg.o \ name_distr.o subscr.o monitor.o name_table.o net.o \ netlink.o netlink_compat.o node.o socket.o eth_media.o \ ^^^^^^^^ topsrv.o socket.o group.o trace.o ^^^^^^^^ Signed-off-by: Masahiro Yamada Signed-off-by: David S. Miller commit f1239d8aa84dad8fe4b6cc1356f40fc8e842db47 Author: Chen-Yu Tsai Date: Mon Jan 6 11:09:45 2020 +0800 net: stmmac: dwmac-sun8i: Allow all RGMII modes Allow all the RGMII modes to be used. This would allow us to represent the hardware better in the device tree with RGMII_ID where in most cases the PHY's internal delay for both RX and TX are used. Fixes: 9f93ac8d4085 ("net-next: stmmac: Add dwmac-sun8i") Signed-off-by: Chen-Yu Tsai Signed-off-by: David S. Miller commit 52cc73e5404c7ba0cbfc50cb4c265108c84b3d5a Author: Chen-Yu Tsai Date: Mon Jan 6 11:09:22 2020 +0800 net: stmmac: dwmac-sunxi: Allow all RGMII modes Allow all the RGMII modes to be used. This would allow us to represent the hardware better in the device tree with RGMII_ID where in most cases the PHY's internal delay for both RX and TX are used. Fixes: af0bd4e9ba80 ("net: stmmac: sunxi platform extensions for GMAC in Allwinner A20 SoC's") Signed-off-by: Chen-Yu Tsai Signed-off-by: David S. Miller commit 8e85def5723eccea30ebf22645673692ab8cb3e2 Author: Kai Vehmanen Date: Wed Jan 8 20:08:56 2020 +0200 ALSA: hda: enable regmap internal locking This reverts commit 42ec336f1f9d ("ALSA: hda: Disable regmap internal locking"). Without regmap locking, there is a race between snd_hda_codec_amp_init() and PM callbacks issuing regcache_sync(). This was caught by following kernel warning trace: <4> [358.080081] WARNING: CPU: 2 PID: 4157 at drivers/base/regmap/regcache.c:498 regcache_cache_only+0xf5/0x130 [...] <4> [358.080148] Call Trace: <4> [358.080158] snd_hda_codec_amp_init+0x4e/0x100 [snd_hda_codec] <4> [358.080169] snd_hda_codec_amp_init_stereo+0x40/0x80 [snd_hda_codec] Suggested-by: Takashi Iwai BugLink: https://gitlab.freedesktop.org/drm/intel/issues/592 Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20200108180856.5194-1-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit 9f1c2cb3296a252bd84d56f80346369bd0d95387 Merge: fe013e2121c6 ffcdc5df08bf Author: Olof Johansson Date: Wed Jan 8 10:24:48 2020 -0800 Merge tag 'aspeed-5.5-devicetree-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/aspeed into arm/fixes ASPEED device tree fixes for 5.5 Fixes for some badly applied patches that went in to 5.5. There is also a fix for an incorrect i2c address. * tag 'aspeed-5.5-devicetree-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/aspeed: ARM: dts: aspeed: rainier: Fix fan fault and presence ARM: dts: aspeed: rainier: Remove duplicate i2c busses ARM: dts: aspeed: tacoma: Remove duplicate flash nodes ARM: dts: aspeed: tacoma: Remove duplicate i2c busses ARM: dts: aspeed: tacoma: Fix fsi master node ARM: dts: aspeed-g6: Fix FSI master location Link: https://lore.kernel.org/r/CACPK8XcjazgORXNZBU1ECMukXG4HA8D9VeDxiSPifDk_iB7_dw@mail.gmail.com Signed-off-by: Olof Johansson commit fe013e2121c63bb2a3d0741d9245679e3f4028d2 Author: Arnd Bergmann Date: Mon Dec 16 14:21:26 2019 +0100 ARM: omap2plus: select RESET_CONTROLLER With the new omap_prm driver added unconditionally, omap2 builds fail when the reset controller subsystem is disabled: drivers/soc/ti/omap_prm.o: In function `omap_prm_probe': omap_prm.c:(.text+0x2d4): undefined reference to `devm_reset_controller_register' Link: https://lore.kernel.org/r/20191216132132.3330811-1-arnd@arndb.de Fixes: 3e99cb214f03 ("soc: ti: add initial PRM driver with reset control support") Signed-off-by: Arnd Bergmann Acked-by: Tony Lindgren Signed-off-by: Olof Johansson commit 7afec66e2bf5683d8bfc812cc295313d1b8473bc Author: Arnd Bergmann Date: Tue Dec 10 20:51:44 2019 +0100 ARM: davinci: select CONFIG_RESET_CONTROLLER Selecting RESET_CONTROLLER is actually required, otherwise we can get a link failure in the clock driver: drivers/clk/davinci/psc.o: In function `__davinci_psc_register_clocks': psc.c:(.text+0x9a0): undefined reference to `devm_reset_controller_register' drivers/clk/davinci/psc-da850.o: In function `da850_psc0_init': psc-da850.c:(.text+0x24): undefined reference to `reset_controller_add_lookup' Link: https://lore.kernel.org/r/20191210195202.622734-1-arnd@arndb.de Fixes: f962396ce292 ("ARM: davinci: support multiplatform build for ARM v5") Cc: # v5.4 Signed-off-by: Arnd Bergmann Reviewed-by: Bartosz Golaszewski Reviewed-by: Philipp Zabel Acked-by: Sekhar Nori Signed-off-by: Olof Johansson commit b07f636fca1c8fbba124b0082487c0b3890a0e0c Merge: ae6088216ce4 a430e67d9a2c Author: Linus Torvalds Date: Wed Jan 8 09:26:33 2020 -0800 Merge tag 'tpmdd-next-20200108' of git://git.infradead.org/users/jjs/linux-tpmdd Pull more tpmd fixes from Jarkko Sakkinen: "One critical regression fix (the faulty commit got merged in rc3, but also marked for stable)" * tag 'tpmdd-next-20200108' of git://git.infradead.org/users/jjs/linux-tpmdd: tpm: Handle negative priv->response_len in tpm_common_read() commit 26ef8493e1ab771cb01d27defca2fa1315dc3980 Author: Johannes Thumshirn Date: Wed Jan 8 21:07:32 2020 +0900 btrfs: fix memory leak in qgroup accounting When running xfstests on the current btrfs I get the following splat from kmemleak: unreferenced object 0xffff88821b2404e0 (size 32): comm "kworker/u4:7", pid 26663, jiffies 4295283698 (age 8.776s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 10 ff fd 26 82 88 ff ff ...........&.... 10 ff fd 26 82 88 ff ff 20 ff fd 26 82 88 ff ff ...&.... ..&.... backtrace: [<00000000f94fd43f>] ulist_alloc+0x25/0x60 [btrfs] [<00000000fd023d99>] btrfs_find_all_roots_safe+0x41/0x100 [btrfs] [<000000008f17bd32>] btrfs_find_all_roots+0x52/0x70 [btrfs] [<00000000b7660afb>] btrfs_qgroup_rescan_worker+0x343/0x680 [btrfs] [<0000000058e66778>] btrfs_work_helper+0xac/0x1e0 [btrfs] [<00000000f0188930>] process_one_work+0x1cf/0x350 [<00000000af5f2f8e>] worker_thread+0x28/0x3c0 [<00000000b55a1add>] kthread+0x109/0x120 [<00000000f88cbd17>] ret_from_fork+0x35/0x40 This corresponds to: (gdb) l *(btrfs_find_all_roots_safe+0x41) 0x8d7e1 is in btrfs_find_all_roots_safe (fs/btrfs/backref.c:1413). 1408 1409 tmp = ulist_alloc(GFP_NOFS); 1410 if (!tmp) 1411 return -ENOMEM; 1412 *roots = ulist_alloc(GFP_NOFS); 1413 if (!*roots) { 1414 ulist_free(tmp); 1415 return -ENOMEM; 1416 } 1417 Following the lifetime of the allocated 'roots' ulist, it gets freed again in btrfs_qgroup_account_extent(). But this does not happen if the function is called with the 'BTRFS_FS_QUOTA_ENABLED' flag cleared, then btrfs_qgroup_account_extent() does a short leave and directly returns. Instead of directly returning we should jump to the 'out_free' in order to free all resources as expected. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Qu Wenruo Signed-off-by: Johannes Thumshirn [ add comment ] Signed-off-by: David Sterba commit 1530f6f5f5806b2abbf2a9276c0db313ae9a0e09 Author: Qi Zhou Date: Sat Jan 4 11:02:01 2020 +0000 usb: missing parentheses in USE_NEW_SCHEME According to bd0e6c9614b9 ("usb: hub: try old enumeration scheme first for high speed devices") the kernel will try the old enumeration scheme first for high speed devices. This can happen when a high speed device is plugged in. But due to missing parentheses in the USE_NEW_SCHEME define, this logic can get messed up and the incorrect result happens. Acked-by: Alan Stern Signed-off-by: Qi Zhou Link: https://lore.kernel.org/r/ht4mtag8ZP-HKEhD0KkJhcFnVlOFV8N8eNjJVRD9pDkkLUNhmEo8_cL_sl7xy9mdajdH-T8J3TFQsjvoYQT61NFjQXy469Ed_BbBw_x4S1E=@protonmail.com [ fixup changelog text - gregkh] Cc: stable Fixes: bd0e6c9614b9 ("usb: hub: try old enumeration scheme first for high speed devices") Signed-off-by: Greg Kroah-Hartman commit ba9b40810bb43e6bf73b395012b98633c03f7f59 Author: Colin Ian King Date: Tue Jan 7 12:39:01 2020 +0000 usb: ohci-da8xx: ensure error return on variable error is set Currently when an error occurs when calling devm_gpiod_get_optional or calling gpiod_to_irq it causes an uninitialized error return in variable 'error' to be returned. Fix this by ensuring the error variable is set from da8xx_ohci->oc_gpio and oc_irq. Thanks to Dan Carpenter for spotting the uninitialized error in the gpiod_to_irq failure case. Addresses-Coverity: ("Uninitialized scalar variable") Fixes: d193abf1c913 ("usb: ohci-da8xx: add vbus and overcurrent gpios") Signed-off-by: Colin Ian King Cc: stable Acked-by: Alan Stern Link: https://lore.kernel.org/r/20200107123901.101190-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit 96a0c12843109e5c4d5eb1e09d915fdd0ce31d25 Author: Paul Cercueil Date: Tue Jan 7 09:26:25 2020 -0600 usb: musb: Disable pullup at init The pullup may be already enabled before the driver is initialized. This happens for instance on JZ4740. It has to be disabled at init time, as we cannot guarantee that a gadget driver will be bound to the UDC. Signed-off-by: Paul Cercueil Suggested-by: Bin Liu Cc: stable@vger.kernel.org Signed-off-by: Bin Liu Link: https://lore.kernel.org/r/20200107152625.857-3-b-liu@ti.com Signed-off-by: Greg Kroah-Hartman commit 5fbf7a2534703fd71159d3d71504b0ad01b43394 Author: Tony Lindgren Date: Tue Jan 7 09:26:24 2020 -0600 usb: musb: fix idling for suspend after disconnect interrupt When disconnected as USB B-device, suspend interrupt should come before diconnect interrupt, because the DP/DM pins are shorter than the VBUS/GND pins on the USB connectors. But we sometimes get a suspend interrupt after disconnect interrupt. In that case we have devctl set to 99 with VBUS still valid and musb_pm_runtime_check_session() wrongly thinks we have an active session. We have no other interrupts after disconnect coming in this case at least with the omap2430 glue. Let's fix the issue by checking the interrupt status again with delayed work for the devctl 99 case. In the suspend after disconnect case the devctl session bit has cleared by then and musb can idle. For a typical USB B-device connect case we just continue with normal interrupts. Fixes: 467d5c980709 ("usb: musb: Implement session bit based runtime PM for musb-core") Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Cc: stable@vger.kernel.org Signed-off-by: Tony Lindgren Signed-off-by: Bin Liu Link: https://lore.kernel.org/r/20200107152625.857-2-b-liu@ti.com Signed-off-by: Greg Kroah-Hartman commit 33786a2801163a5888679ae064b99927fa849a9e Author: Heikki Krogerus Date: Wed Jan 8 16:13:46 2020 +0300 usb: typec: ucsi: Fix the notification bit offsets The bit offsets for the Set Notification Enable command were not considering the reserved bits in the middle. Fixes: 470ce43a1a81 ("usb: typec: ucsi: Remove struct ucsi_control") Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20200108131347.43217-2-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a430e67d9a2c62a8c7b315b99e74de02018d0a96 Author: Tadeusz Struk Date: Tue Jan 7 14:04:48 2020 -0800 tpm: Handle negative priv->response_len in tpm_common_read() The priv->response_length can hold the size of an response or an negative error code, and the tpm_common_read() needs to handle both cases correctly. Changed the type of response_length to signed and accounted for negative value in tpm_common_read(). Cc: stable@vger.kernel.org Fixes: d23d12484307 ("tpm: fix invalid locking in NONBLOCKING mode") Reported-by: Laura Abbott Signed-off-by: Tadeusz Struk Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 423a716cd7be16fb08690760691befe3be97d3fc Author: Josef Bacik Date: Wed Dec 18 17:20:29 2019 -0500 btrfs: do not delete mismatched root refs btrfs_del_root_ref() will simply WARN_ON() if the ref doesn't match in any way, and then continue to delete the reference. This shouldn't happen, we have these values because there's more to the reference than the original root and the sub root. If any of these checks fail, return -ENOENT. CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit d49d3287e74ffe55ae7430d1e795e5f9bf7359ea Author: Josef Bacik Date: Wed Dec 18 17:20:28 2019 -0500 btrfs: fix invalid removal of root ref If we have the following sequence of events btrfs sub create A btrfs sub create A/B btrfs sub snap A C mkdir C/foo mv A/B C/foo rm -rf * We will end up with a transaction abort. The reason for this is because we create a root ref for B pointing to A. When we create a snapshot of C we still have B in our tree, but because the root ref points to A and not C we will make it appear to be empty. The problem happens when we move B into C. This removes the root ref for B pointing to A and adds a ref of B pointing to C. When we rmdir C we'll see that we have a ref to our root and remove the root ref, despite not actually matching our reference name. Now btrfs_del_root_ref() allowing this to work is a bug as well, however we know that this inode does not actually point to a root ref in the first place, so we shouldn't be calling btrfs_del_root_ref() in the first place and instead simply look up our dir index for this item and do the rest of the removal. CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 045d3967b6920b663fc010ad414ade1b24143bd1 Author: Josef Bacik Date: Wed Dec 18 17:20:27 2019 -0500 btrfs: rework arguments of btrfs_unlink_subvol btrfs_unlink_subvol takes the name of the dentry and the root objectid based on what kind of inode this is, either a real subvolume link or a empty one that we inherited as a snapshot. We need to fix how we unlink in the case for BTRFS_EMPTY_SUBVOL_DIR_OBJECTID in the future, so rework btrfs_unlink_subvol to just take the dentry and handle getting the right objectid given the type of inode this is. There is no functional change here, simply pushing the work into btrfs_unlink_subvol() proper. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 54a6a7dc107da0492a9e84fd7e9a107b3c58138d Author: Kailang Yang Date: Wed Jan 8 16:47:56 2020 +0800 ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th gen Add quirk to ALC285_FIXUP_SPEAKER2_TO_DAC1, which is the same fixup applied for X1 Carbon 7th gen in commit d2cd795c4ece ("ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen"). Signed-off-by: Kailang Yang Reviewed-by: Jaroslav Kysela Cc: Signed-off-by: Takashi Iwai commit 9194a1ebbc56d7006835e2b4cacad301201fb832 Author: Kailang Yang Date: Tue Jan 7 17:22:19 2020 +0800 ALSA: hda/realtek - Set EAPD control to default for ALC222 Set EAPD control to verb control. Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai commit ffcdc5df08bfc4f418693b22cf2a1182de3375b4 Author: Brandon Wyman Date: Thu Nov 21 18:33:33 2019 -0600 ARM: dts: aspeed: rainier: Fix fan fault and presence The PCA9552 used for fan fault and presence information is at address 61h, not 60h. Fixes: 2efc118ce3c3 ("ARM: dts: aspeed: rainier: Add i2c devices") Signed-off-by: Brandon Wyman Reviewed-by: Eddie James Signed-off-by: Joel Stanley commit 195cf4dbedce3becda34a29ece232b63eba77221 Author: Joel Stanley Date: Fri Jan 3 10:44:51 2020 +1100 ARM: dts: aspeed: rainier: Remove duplicate i2c busses This is a revert of "ARM: dts: aspeed: rainier: Add i2c devices", which was already applied to the tree. Fixes: 9c44db7096e0 ("ARM: dts: aspeed: rainier: Add i2c devices") Reviewed-by: Jim Wright Tested-by: Jim Wright Signed-off-by: Joel Stanley commit 87c5947ffeec42a4ef72e19b4c822be5d8e09c84 Author: Joel Stanley Date: Tue Dec 24 00:47:34 2019 +1100 ARM: dts: aspeed: tacoma: Remove duplicate flash nodes This is a revert of "ARM: dts: aspeed: tacoma: Enable FMC and SPI devices" which was already applied as part of "ARM: dts: aspeed: Add Tacoma machine". Fixes: 8737481e381c ("ARM: dts: aspeed: tacoma: Enable FMC and SPI devices") Reviewed-by: Andrew Jeffery Signed-off-by: Joel Stanley commit 265ae459b3ba3da4518c5ca2c89fd85c43723a99 Author: Joel Stanley Date: Tue Dec 24 00:47:33 2019 +1100 ARM: dts: aspeed: tacoma: Remove duplicate i2c busses This is a revert of "ARM: dts: aspeed: tacoma: Enable I2C busses", which was already applied as part of "ARM: dts: aspeed: Add Tacoma machine". Fixes: 606bcdde6724 ("ARM: dts: aspeed: tacoma: Enable I2C busses") Reviewed-by: Andrew Jeffery Signed-off-by: Joel Stanley commit e30dcbbcb0ee16ca259f962840fc6246f00cd18e Author: Joel Stanley Date: Tue Dec 24 00:47:32 2019 +1100 ARM: dts: aspeed: tacoma: Fix fsi master node This was broken when applying "ARM: dts: aspeed: tacoma: Add host FSI description". Fixes: a981c93300ef ("ARM: dts: aspeed: tacoma: Add host FSI description") Acked-by: Andrew Jeffery Signed-off-by: Joel Stanley commit 413200017b8e5a603c3d872a62b222bd1e1a7b90 Author: Joel Stanley Date: Tue Dec 24 00:47:35 2019 +1100 ARM: dts: aspeed-g6: Fix FSI master location The FIS nodes were placed incorrectly in the device tree. Fixes: 0fe4e304782c ("ARM: dts: aspeed-g6: Describe FSI masters") Reviewed-by: Andrew Jeffery Signed-off-by: Joel Stanley commit 8e3366cad2bfe4e669bfd3758110be90b1dc75aa Author: Takashi Iwai Date: Tue Jan 7 08:09:56 2020 +0100 ASoC: Fix NULL dereference at freeing When an ASoC driver with pcm_destruct component ops is freed before the PCM object instantiation (e.g. deferring the probe), it hits an Oops at snd_soc_pcm_component_free() that calls the pcm_destruct ops unconditionally. Fix it by adding a NULL-check of rtd->pcm before calling callbacks. Fixes: c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcm_destruct") Reported-by: Matthias Brugger Tested-by: Ben Ho Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20200107070956.15807-1-tiwai@suse.de Signed-off-by: Mark Brown commit 47240ba0cd09bb6fe6db9889582048324999dfa4 Author: Eric Dumazet Date: Tue Jan 7 10:57:01 2020 -0800 net: usb: lan78xx: fix possible skb leak If skb_linearize() fails, we need to free the skb. TSO makes skb bigger, and this bug might be the reason Raspberry Pi 3B+ users had to disable TSO. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Signed-off-by: Eric Dumazet Reported-by: RENARD Pierre-Francois Cc: Stefan Wahren Cc: Woojung Huh Cc: Microchip Linux Driver Support Signed-off-by: David S. Miller commit da29f2d84bd10234df570b7f07cbd0166e738230 Author: Jose Abreu Date: Tue Jan 7 13:35:42 2020 +0100 net: stmmac: Fixed link does not need MDIO Bus When using fixed link we don't need the MDIO bus support. Reported-by: Heiko Stuebner Reported-by: kernelci.org bot Fixes: d3e014ec7d5e ("net: stmmac: platform: Fix MDIO init for platforms without PHY") Signed-off-by: Jose Abreu Acked-by: Sriram Dash Tested-by: Patrice Chotard Tested-by: Heiko Stuebner Acked-by: Neil Armstrong Reviewed-by: Florian Fainelli Tested-by: Florian Fainelli # Lamobo R1 (fixed-link + MDIO sub node for roboswitch). Signed-off-by: David S. Miller commit b57e1fff7da1cb228c328905079eeb915d0a34f0 Merge: 96b11e935808 eb8ef2a3c500 Author: David S. Miller Date: Tue Jan 7 13:35:14 2020 -0800 Merge branch 'vlan-rtnetlink-newlink-fixes' Eric Dumazet says: ==================== vlan: rtnetlink newlink fixes First patch fixes a potential memory leak found by syzbot Second patch makes vlan_changelink() aware of errors and report them to user. ==================== Signed-off-by: David S. Miller commit eb8ef2a3c50092bb018077c047b8dba1ce0e78e3 Author: Eric Dumazet Date: Tue Jan 7 01:42:25 2020 -0800 vlan: vlan_changelink() should propagate errors Both vlan_dev_change_flags() and vlan_dev_set_egress_priority() can return an error. vlan_changelink() should not ignore them. Fixes: 07b5b17e157b ("[VLAN]: Use rtnl_link API") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 9bbd917e0bec9aebdbd0c8dbc966caec15eb33e9 Author: Eric Dumazet Date: Tue Jan 7 01:42:24 2020 -0800 vlan: fix memory leak in vlan_dev_set_egress_priority There are few cases where the ndo_uninit() handler might be not called if an error happens while device is initialized. Since vlan_newlink() calls vlan_changelink() before trying to register the netdevice, we need to make sure vlan_dev_uninit() has been called at least once, or we might leak allocated memory. BUG: memory leak unreferenced object 0xffff888122a206c0 (size 32): comm "syz-executor511", pid 7124, jiffies 4294950399 (age 32.240s) hex dump (first 32 bytes): 00 00 00 00 00 00 61 73 00 00 00 00 00 00 00 00 ......as........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000000eb3bb85>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<000000000eb3bb85>] slab_post_alloc_hook mm/slab.h:586 [inline] [<000000000eb3bb85>] slab_alloc mm/slab.c:3320 [inline] [<000000000eb3bb85>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549 [<000000007b99f620>] kmalloc include/linux/slab.h:556 [inline] [<000000007b99f620>] vlan_dev_set_egress_priority+0xcc/0x150 net/8021q/vlan_dev.c:194 [<000000007b0cb745>] vlan_changelink+0xd6/0x140 net/8021q/vlan_netlink.c:126 [<0000000065aba83a>] vlan_newlink+0x135/0x200 net/8021q/vlan_netlink.c:181 [<00000000fb5dd7a2>] __rtnl_newlink+0x89a/0xb80 net/core/rtnetlink.c:3305 [<00000000ae4273a1>] rtnl_newlink+0x4e/0x80 net/core/rtnetlink.c:3363 [<00000000decab39f>] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424 [<00000000accba4ee>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477 [<00000000319fe20f>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442 [<00000000d51938dc>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] [<00000000d51938dc>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328 [<00000000e539ac79>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917 [<000000006250c27e>] sock_sendmsg_nosec net/socket.c:639 [inline] [<000000006250c27e>] sock_sendmsg+0x54/0x70 net/socket.c:659 [<00000000e2a156d1>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330 [<000000008c87466e>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384 [<00000000110e3054>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417 [<00000000d71077c8>] __do_sys_sendmsg net/socket.c:2426 [inline] [<00000000d71077c8>] __se_sys_sendmsg net/socket.c:2424 [inline] [<00000000d71077c8>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424 Fixe: 07b5b17e157b ("[VLAN]: Use rtnl_link API") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit 96b11e9358080e8b705babd078cefa753109204b Merge: 481a7d154cbb 6d4f151acf9a Author: David S. Miller Date: Tue Jan 7 13:31:23 2020 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2020-01-07 The following pull-request contains BPF updates for your *net* tree. We've added 2 non-merge commits during the last 1 day(s) which contain a total of 2 files changed, 16 insertions(+), 4 deletions(-). The main changes are: 1) Fix a use-after-free in cgroup BPF due to auto-detachment, from Roman Gushchin. 2) Fix skb out-of-bounds access in ld_abs/ind instruction, from Daniel Borkmann. ==================== Signed-off-by: David S. Miller commit 481a7d154cbbd5ca355cc01cc8969876b240eded Author: Jiping Ma Date: Tue Jan 7 14:34:00 2020 +0800 stmmac: debugfs entry name is not be changed when udev rename device name. Add one notifier for udev changes net device name. Fixes: b6601323ef9e ("net: stmmac: debugfs entry name is not be changed when udev rename") Signed-off-by: Jiping Ma Signed-off-by: David S. Miller commit eacc6dfaea963ef61540abb31ad7829be5eff284 Author: Jens Axboe Date: Tue Jan 7 13:08:56 2020 -0700 io_uring: remove punt of short reads to async context We currently punt any short read on a regular file to async context, but this fails if the short read is due to running into EOF. This is especially problematic since we only do the single prep for commands now, as we don't reset kiocb->ki_pos. This can result in a 4k read on a 1k file returning zero, as we detect the short read and then retry from async context. At the time of retry, the position is now 1k, and we end up reading nothing, and hence return 0. Instead of trying to patch around the fact that short reads can be legitimate and won't succeed in case of retry, remove the logic to punt a short read to async context. Simply return it. Signed-off-by: Jens Axboe commit b583cef5690581fa5f15f373a27f5c023232464a Merge: 850e0a99361b 03729cfa0d54 Author: Olof Johansson Date: Tue Jan 7 11:15:26 2020 -0800 Merge tag 'omap-for-v5.5/fixes-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Fixes for omaps for v5.5-rc cycle Here are few fixes for v5.5-rc cycle: - Two corner case fixes related to ti-sysc driver clock issues - Fixes for am57xx dts for pcie gpios - Beagle-x15 regulator dts fix - Fix for wkup_m3_ipc driver race * tag 'omap-for-v5.5/fixes-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot ARM: dts: beagle-x15-common: Model 5V0 regulator ARM: dts: am571x-idk: Fix gpios property to have the correct gpio number ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes bus: ti-sysc: Fix iterating over clocks ARM: OMAP2+: Fix ti_sysc_find_one_clockdomain to check for to_clk_hw_omap Link: https://lore.kernel.org/r/pull-1578418121-413328@atomide.com Signed-off-by: Olof Johansson commit 9554de394b7eee01606e64c3806cd43893f3037e Author: Shiraz Saleem Date: Tue Jan 7 10:22:23 2020 -0600 i40iw: Remove setting of VMA private data and use rdma_user_mmap_io vm_ops is now initialized in ib_uverbs_mmap() with the recent rdma mmap API changes. Earlier it was done in rdma_umap_priv_init() which would not be called unless a driver called rdma_user_mmap_io() in its mmap. i40iw does not use the rdma_user_mmap_io API but sets the vma's vm_private_data to a driver object. This now conflicts with the vm_op rdma_umap_close as priv pointer points to the i40iw driver object instead of the private data setup by core when rdma_user_mmap_io is called. This leads to a crash in rdma_umap_close with a mmap put being called when it should not have. Remove the redundant setting of the vma private_data in i40iw as it is not used. Also move i40iw over to use the rdma_user_mmap_io API. This gives the extra protection of having the mappings zapped when the context is detsroyed. BUG: unable to handle page fault for address: 0000000100000001 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP PTI CPU: 6 PID: 9528 Comm: rping Kdump: loaded Not tainted 5.5.0-rc4+ #117 Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./Q87M-D2H, BIOS F7 01/17/2014 RIP: 0010:rdma_user_mmap_entry_put+0xa/0x30 [ib_core] RSP: 0018:ffffb340c04c7c38 EFLAGS: 00010202 RAX: 00000000ffffffff RBX: ffff9308e7be2a00 RCX: 000000000000cec0 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000100000001 RBP: ffff9308dc7641f0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff8d4414d8 R12: ffff93075182c780 R13: 0000000000000001 R14: ffff93075182d2a8 R15: ffff9308e2ddc840 FS: 0000000000000000(0000) GS:ffff9308fdc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000100000001 CR3: 00000002e0412004 CR4: 00000000001606e0 Call Trace: rdma_umap_close+0x40/0x90 [ib_uverbs] remove_vma+0x43/0x80 exit_mmap+0xfd/0x1b0 mmput+0x6e/0x130 do_exit+0x290/0xcc0 ? get_signal+0x152/0xc40 do_group_exit+0x46/0xc0 get_signal+0x1bd/0xc40 ? prepare_to_wait_event+0x97/0x190 do_signal+0x36/0x630 ? remove_wait_queue+0x60/0x60 ? __audit_syscall_exit+0x1d9/0x290 ? rcu_read_lock_sched_held+0x52/0x90 ? kfree+0x21c/0x2e0 exit_to_usermode_loop+0x4f/0xc3 do_syscall_64+0x1ed/0x270 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fae715a81fd Code: Bad RIP value. RSP: 002b:00007fae6e163cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: fffffffffffffe00 RBX: 00007fae6e163d30 RCX: 00007fae715a81fd RDX: 0000000000000010 RSI: 00007fae6e163cf0 RDI: 0000000000000003 RBP: 00000000013413a0 R08: 00007fae68000000 R09: 0000000000000017 R10: 0000000000000001 R11: 0000000000000293 R12: 00007fae680008c0 R13: 00007fae6e163cf0 R14: 00007fae717c9804 R15: 00007fae6e163ed0 CR2: 0000000100000001 ---[ end trace b33d58d3a06782cb ]--- RIP: 0010:rdma_user_mmap_entry_put+0xa/0x30 [ib_core] Fixes: b86deba977a9 ("RDMA/core: Move core content from ib_uverbs to ib_core") Link: https://lore.kernel.org/r/20200107162223.1745-1-shiraz.saleem@intel.com Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit db4ff423cd1659580e541a2d4363342f15c14230 Author: Chunming Zhou Date: Tue May 28 10:46:04 2019 +0800 drm/amdgpu: add DRIVER_SYNCOBJ_TIMELINE to amdgpu Can expose it now that the khronos has exposed the vlk extension. Signed-off-by: Chunming Zhou Reviewed-by: Flora Cui Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 840c90fce6c78bc6b2c4cb9e836d70985ed32066 Author: Thomas Anderson Date: Mon Dec 2 13:47:13 2019 -0800 drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded For high-res (8K) or HFR (4K120) displays, using uncompressed pixel formats like YCbCr444 would exceed the bandwidth of HDMI 2.0, so the "interesting" modes would be disabled, leaving only low-res or low framerate modes. This change lowers the pixel encoding to 4:2:2 or 4:2:0 if the max TMDS clock is exceeded. Verified that 8K30 and 4K120 are now available and working with a Samsung Q900R over an HDMI 2.0b link from a Radeon 5700. Reviewed-by: Harry Wentland Signed-off-by: Thomas Anderson Signed-off-by: Alex Deucher commit 7aec9ec1cf324d5c5a8d17b9c78a34c388e5f17b Author: Alex Deucher Date: Mon Jan 6 15:24:47 2020 -0500 Revert "drm/amdgpu: Set no-retry as default." This reverts commit 51bfac71cade386966791a8db87a5912781d249f. This causes stability issues on some raven boards. Revert for now until a proper fix is completed. Bug: https://gitlab.freedesktop.org/drm/amd/issues/934 Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206017 Reviewed-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 55817b340a31951d23d1692db45522560b1d20f9 Author: Qian Cai Date: Mon Jan 6 10:27:27 2020 -0500 iommu/dma: fix variable 'cookie' set but not used The commit c18647900ec8 ("iommu/dma: Relax locking in iommu_dma_prepare_msi()") introduced a compliation warning, drivers/iommu/dma-iommu.c: In function 'iommu_dma_prepare_msi': drivers/iommu/dma-iommu.c:1206:27: warning: variable 'cookie' set but not used [-Wunused-but-set-variable] struct iommu_dma_cookie *cookie; ^~~~~~ Fixes: c18647900ec8 ("iommu/dma: Relax locking in iommu_dma_prepare_msi()") Signed-off-by: Qian Cai Acked-by: Robin Murphy Signed-off-by: Joerg Roedel commit f78947c409204138a4bc0609f98e07ef9d01ac0a Author: Jon Derrick Date: Tue Dec 31 13:24:20 2019 -0700 iommu/vt-d: Unlink device if failed to add to group If the device fails to be added to the group, make sure to unlink the reference before returning. Signed-off-by: Jon Derrick Fixes: 39ab9555c2411 ("iommu: Add sysfs bindings for struct iommu_device") Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit 7d4e6ccd1fb09dbfbc49746ca82bd5c25ad4bfe4 Author: Jon Derrick Date: Tue Dec 31 13:24:19 2019 -0700 iommu: Remove device link to group on failure This adds the missing teardown step that removes the device link from the group when the device addition fails. Signed-off-by: Jon Derrick Fixes: 797a8b4d768c5 ("iommu: Handle default domain attach failure") Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit 4a350a0ee5b0a14f826fcdf60dd1a3199cafbfd6 Author: Patrick Steinhardt Date: Fri Dec 27 00:56:18 2019 +0100 iommu/vt-d: Fix adding non-PCI devices to Intel IOMMU Starting with commit fa212a97f3a3 ("iommu/vt-d: Probe DMA-capable ACPI name space devices"), we now probe DMA-capable ACPI name space devices. On Dell XPS 13 9343, which has an Intel LPSS platform device INTL9C60 enumerated via ACPI, this change leads to the following warning: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1 at pci_device_group+0x11a/0x130 CPU: 1 PID: 1 Comm: swapper/0 Tainted: G T 5.5.0-rc3+ #22 Hardware name: Dell Inc. XPS 13 9343/0310JH, BIOS A20 06/06/2019 RIP: 0010:pci_device_group+0x11a/0x130 Code: f0 ff ff 48 85 c0 49 89 c4 75 c4 48 8d 74 24 10 48 89 ef e8 48 ef ff ff 48 85 c0 49 89 c4 75 af e8 db f7 ff ff 49 89 c4 eb a5 <0f> 0b 49 c7 c4 ea ff ff ff eb 9a e8 96 1e c7 ff 66 0f 1f 44 00 00 RSP: 0000:ffffc0d6c0043cb0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffa3d1d43dd810 RCX: 0000000000000000 RDX: ffffa3d1d4fecf80 RSI: ffffa3d12943dcc0 RDI: ffffa3d1d43dd810 RBP: ffffa3d1d43dd810 R08: 0000000000000000 R09: ffffa3d1d4c04a80 R10: ffffa3d1d4c00880 R11: ffffa3d1d44ba000 R12: 0000000000000000 R13: ffffa3d1d4383b80 R14: ffffa3d1d4c090d0 R15: ffffa3d1d4324530 FS: 0000000000000000(0000) GS:ffffa3d1d6700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000000460a001 CR4: 00000000003606e0 Call Trace: ? iommu_group_get_for_dev+0x81/0x1f0 ? intel_iommu_add_device+0x61/0x170 ? iommu_probe_device+0x43/0xd0 ? intel_iommu_init+0x1fa2/0x2235 ? pci_iommu_init+0x52/0xe7 ? e820__memblock_setup+0x15c/0x15c ? do_one_initcall+0xcc/0x27e ? kernel_init_freeable+0x169/0x259 ? rest_init+0x95/0x95 ? kernel_init+0x5/0xeb ? ret_from_fork+0x35/0x40 ---[ end trace 28473e7abc25b92c ]--- DMAR: ACPI name space devices didn't probe correctly The bug results from the fact that while we now enumerate ACPI devices, we aren't able to handle any non-PCI device when generating the device group. Fix the issue by implementing an Intel-specific callback that returns `pci_device_group` only if the device is a PCI device. Otherwise, it will return a generic device group. Fixes: fa212a97f3a3 ("iommu/vt-d: Probe DMA-capable ACPI name space devices") Signed-off-by: Patrick Steinhardt Cc: stable@vger.kernel.org # v5.3+ Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit f30e27779d3031a092c2a177b7fb76adccc45241 Author: Geert Uytterhoeven Date: Mon Dec 30 14:27:34 2019 +0100 drm/fb-helper: Round up bits_per_pixel if possible When userspace requests a video mode parameter value that is not supported, frame buffer device drivers should round it up to a supported value, if possible, instead of just rejecting it. This allows applications to quickly scan for supported video modes. Currently this rule is not followed for the number of bits per pixel, causing e.g. "fbset -depth N" to fail, if N is smaller than the current number of bits per pixel. Fix this by returning an error only if bits per pixel is too large, and setting it to the current value otherwise. See also Documentation/fb/framebuffer.rst, Section 2 (Programmer's View of /dev/fb*"). Fixes: 865afb11949e5bf4 ("drm/fb-helper: reject any changes to the fbdev") Cc: stable@vger.kernel.org Signed-off-by: Geert Uytterhoeven Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20191230132734.4538-1-geert+renesas@glider.be commit 4396393fb96449c56423fb4b351f76e45a6bcaf6 Author: Chen-Yu Tsai Date: Tue Jan 7 15:01:13 2020 +0800 drm/sun4i: tcon: Set RGB DCLK min. divider based on hardware model In commit 0b8e7bbde5e7 ("drm/sun4i: tcon: Set min division of TCON0_DCLK to 1.") it was assumed that all TCON variants support a minimum divider of 1 if only DCLK was used. However, the oldest generation of hardware only supports minimum divider of 4 if only DCLK is used. If a divider of 1 was used on this old hardware, some scrolling artifact would appear. A divider of 2 seemed OK, but a divider of 3 had artifacts as well. Set the minimum divider when outputing to parallel RGB based on the hardware model, with a minimum of 4 for the oldest (A10/A10s/A13/A20) hardware, and a minimum of 1 for the rest. A value is not set for the TCON variants lacking channel 0. This fixes the scrolling artifacts seen on my A13 tablet. Fixes: 0b8e7bbde5e7 ("drm/sun4i: tcon: Set min division of TCON0_DCLK to 1.") Cc: # 5.4.x Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20200107070113.28951-1-wens@kernel.org commit 2b2c4a83d69dc9f2b46b8e791f5b8c2451c267bd Author: Manasi Navare Date: Fri Dec 27 19:12:04 2019 -0800 drm/i915/dp: Disable Port sync mode correctly on teardown While clearing the Ports ync mode enable and master select bits we need to clear the register completely instead of using disable masks v3: * Remove reg variable (Matt) v2: * Just write 0 to the reg (Ville) * Rebase Bugzilla: https://gitlab.freedesktop.org/drm/intel/issues/5 Cc: Ville Syrjälä Cc: Jani Nikula Fixes: 51528afe7c5e ("drm/i915/display/icl: Disable transcoder port sync as part of crtc_disable() sequence") Signed-off-by: Manasi Navare Reviewed-by: Matt Roper Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20191228031204.10189-3-manasi.d.navare@intel.com (cherry picked from commit a3d9382bd439e7be1858abc3d5f014dd55913448) Signed-off-by: Joonas Lahtinen commit 25b79ad51bf04a8aa67b5bccd631fc05f963b8e0 Author: Matt Roper Date: Tue Dec 31 11:07:13 2019 -0800 drm/i915: Add Wa_1407352427:icl,ehl The workaround database now indicates we need to disable psdunit clock gating as well. v3: - Rebase on top of other workarounds that have landed. - Restrict cc:stable tag to 5.2+ since that's when ICL was first officially supported. Bspec: 32354 Bspec: 33450 Bspec: 33451 Suggested-by: Lionel Landwerlin Cc: stable@vger.kernel.org # v5.2+ Cc: Lionel Landwerlin Cc: Lucas De Marchi Cc: Matt Atwood Signed-off-by: Matt Roper Acked-by: Lionel Landwerlin Link: https://patchwork.freedesktop.org/patch/msgid/20191231190713.1549533-1-matthew.d.roper@intel.com (cherry picked from commit 1cd21a7c5679015352e8a6f46813aced51d71bb8) Signed-off-by: Joonas Lahtinen commit a7f3ad37f80d0d5eec9dad156964c0dac800a80e Author: Matt Roper Date: Mon Dec 23 17:20:25 2019 -0800 drm/i915: Add Wa_1408615072 and Wa_1407596294 to icl,ehl Workaround database indicates we should disable clock gating of both the vsunit and hsunit. Bspec: 33450 Bspec: 33451 Cc: stable@kernel.vger.org Cc: Lucas De Marchi Cc: Matt Atwood Cc: Radhakrishna Sripada Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20191224012026.3157766-3-matthew.d.roper@intel.com Reviewed-by: Lucas De Marchi (cherry picked from commit b9cf9dac3dac4c1d2a47d34f30ec53c0423cecf8) Signed-off-by: Joonas Lahtinen commit ce69e553b9a4a652830add9906939a8a04d0d585 Author: Chris Wilson Date: Tue Dec 31 12:27:08 2019 +0000 drm/i915/gt: Restore coarse power gating The coarse power gating was disabled as part of commit 2248a28384fe ("drm/i915/gen8+: Add RC6 CTX corruption WA") as a prelude to recover from the context corruption; the power gating itself has no direct impact on the RC6 context corruption. However, that recovery scheme was never implemented due to difficult corner cases, and so we no longer need to keep the power gating disabled. Fixes: 2248a28384fe ("drm/i915/gen8+: Add RC6 CTX corruption WA") Closes: https://gitlab.freedesktop.org/drm/intel/issues/846 Signed-off-by: Chris Wilson Cc: Imre Deak Cc: Mika Kuoppala Cc: Eero Tamminen Cc: Jon Bloomfield Reviewed-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20191231122708.4025916-1-chris@chris-wilson.co.uk (cherry picked from commit 32f408ac3e5d95781f52328a09e5409b01255841) Signed-off-by: Joonas Lahtinen commit 103309977589fe6be0f4314de4925737cdfc146f Author: Chris Wilson Date: Sun Dec 29 18:31:50 2019 +0000 drm/i915/gt: Do not restore invalid RS state Only restore valid resource streamer state from the context image, i.e. avoid restoring if we know the image is invalid. Closes: https://gitlab.freedesktop.org/drm/intel/issues/446 Signed-off-by: Chris Wilson Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20191229183153.3719869-4-chris@chris-wilson.co.uk Cc: stable@vger.kernel.org (cherry picked from commit ecfcd2da335816516dc27434a65899a77886d80a) Signed-off-by: Joonas Lahtinen commit 457677c70c7672a4586b0b8abc396cc1ecdd376d Author: Amanieu d'Antras Date: Sat Jan 4 13:39:30 2020 +0100 um: Implement copy_thread_tls This is required for clone3 which passes the TLS value through a struct rather than a register. Signed-off-by: Amanieu d'Antras Cc: linux-um@lists.infradead.org Cc: # 5.3.x Link: https://lore.kernel.org/r/20200104123928.1048822-1-amanieu@gmail.com Signed-off-by: Christian Brauner commit dd499f7a7e34270208350a849ef103c0b3ae477f Author: Amanieu d'Antras Date: Thu Jan 2 18:24:13 2020 +0100 clone3: ensure copy_thread_tls is implemented copy_thread implementations handle CLONE_SETTLS by reading the TLS value from the registers containing the syscall arguments for clone. This doesn't work with clone3 since the TLS value is passed in clone_args instead. Signed-off-by: Amanieu d'Antras Cc: # 5.3.x Link: https://lore.kernel.org/r/20200102172413.654385-8-amanieu@gmail.com Signed-off-by: Christian Brauner commit c346b94f8c5d1b7d637522c908209de93305a8eb Author: Amanieu d'Antras Date: Thu Jan 2 18:24:12 2020 +0100 xtensa: Implement copy_thread_tls This is required for clone3 which passes the TLS value through a struct rather than a register. Signed-off-by: Amanieu d'Antras Cc: linux-xtensa@linux-xtensa.org Cc: # 5.3.x Link: https://lore.kernel.org/r/20200102172413.654385-7-amanieu@gmail.com Signed-off-by: Christian Brauner commit 20bda4ed62f507ed72e30e817b43c65fdba60be7 Author: Amanieu d'Antras Date: Thu Jan 2 18:24:11 2020 +0100 riscv: Implement copy_thread_tls This is required for clone3 which passes the TLS value through a struct rather than a register. Signed-off-by: Amanieu d'Antras Cc: linux-riscv@lists.infradead.org Cc: # 5.3.x Link: https://lore.kernel.org/r/20200102172413.654385-6-amanieu@gmail.com Signed-off-by: Christian Brauner commit d2f36c787b2181561d8b95814f8cdad64b348ad7 Author: Amanieu d'Antras Date: Thu Jan 2 18:24:10 2020 +0100 parisc: Implement copy_thread_tls This is required for clone3 which passes the TLS value through a struct rather than a register. Signed-off-by: Amanieu d'Antras Cc: linux-parisc@vger.kernel.org Cc: # 5.3.x Link: https://lore.kernel.org/r/20200102172413.654385-5-amanieu@gmail.com Signed-off-by: Christian Brauner commit 167ee0b82429cb5df272808c7a21370b7c961ab2 Author: Amanieu d'Antras Date: Thu Jan 2 18:24:09 2020 +0100 arm: Implement copy_thread_tls This is required for clone3 which passes the TLS value through a struct rather than a register. Signed-off-by: Amanieu d'Antras Cc: linux-arm-kernel@lists.infradead.org Cc: # 5.3.x Link: https://lore.kernel.org/r/20200102172413.654385-4-amanieu@gmail.com Signed-off-by: Christian Brauner commit a4376f2fbcc8084832f2f114577c8d68234c7903 Author: Amanieu d'Antras Date: Thu Jan 2 18:24:08 2020 +0100 arm64: Implement copy_thread_tls This is required for clone3 which passes the TLS value through a struct rather than a register. Signed-off-by: Amanieu d'Antras Cc: linux-arm-kernel@lists.infradead.org Cc: # 5.3.x Acked-by: Will Deacon Link: https://lore.kernel.org/r/20200102172413.654385-3-amanieu@gmail.com Signed-off-by: Christian Brauner commit 3e3c8ca5a351350031f0f3d5ecedf7048b1b9008 Author: Amanieu d'Antras Date: Thu Jan 2 18:24:07 2020 +0100 arm64: Move __ARCH_WANT_SYS_CLONE3 definition to uapi headers Previously this was only defined in the internal headers which resulted in __NR_clone3 not being defined in the user headers. Signed-off-by: Amanieu d'Antras Cc: linux-arm-kernel@lists.infradead.org Cc: # 5.3.x Reviewed-by: Arnd Bergmann Link: https://lore.kernel.org/r/20200102172413.654385-2-amanieu@gmail.com Signed-off-by: Christian Brauner commit aa23ca3d98f756d5b1e503fb140665fb24a41a38 Author: Hans de Goede Date: Sun Jan 5 17:03:57 2020 +0100 gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism On some laptops enabling wakeup on the GPIO interrupts used for ACPI _AEI event handling causes spurious wakeups. This commit adds a new honor_wakeup option, defaulting to true (our current behavior), which can be used to disable wakeup on troublesome hardware to avoid these spurious wakeups. This is a workaround for an architectural problem with s2idle under Linux where we do not have any mechanism to immediately go back to sleep after wakeup events, other then for embedded-controller events using the standard ACPI EC interface, for details see: https://lore.kernel.org/linux-acpi/61450f9b-cbc6-0c09-8b3a-aff6bf9a0b3c@redhat.com/ One series of laptops which is not able to suspend without this workaround is the HP x2 10 Cherry Trail models, this commit adds a DMI based quirk which makes sets honor_wakeup to false on these models. Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200105160357.97154-3-hdegoede@redhat.com Signed-off-by: Linus Walleij commit 1ad1b54099c231aed8f6f257065c1b322583f264 Author: Hans de Goede Date: Sun Jan 5 17:03:56 2020 +0100 gpiolib: acpi: Turn dmi_system_id table into a generic quirk table Turn the existing run_edge_events_on_boot_blacklist dmi_system_id table into a generic quirk table, storing the quirks in the driver_data ptr. This is a preparation patch for adding other types of (DMI based) quirks. Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200105160357.97154-2-hdegoede@redhat.com Signed-off-by: Linus Walleij commit 3aa3c5882e4fb2274448908aaed605a3ed7dd15d Author: Harry Pan Date: Mon Dec 30 22:36:56 2019 +0800 powercap: intel_rapl: add NULL pointer check to rapl_mmio_cpu_online() RAPL MMIO support depends on the RAPL common driver. During CPU initialization rapl_mmio_cpu_online() is called via CPU hotplug to initialize the MMIO RAPL for the new CPU, but if that CPU is not present in the common RAPL driver's support list, rapl_defaults is NULL and the kernel crashes on an attempt to dereference it: [ 4.188566] BUG: kernel NULL pointer dereference, address: 0000000000000020 ...snip... [ 4.189555] RIP: 0010:rapl_add_package+0x223/0x574 [ 4.189555] Code: b5 a0 31 c0 49 8b 4d 78 48 01 d9 48 8b 0c c1 49 89 4c c6 10 48 ff c0 48 83 f8 05 75 e7 49 83 ff 03 75 15 48 8b 05 09 bc 18 01 <8b> 70 20 41 89 b6 0c 05 00 00 85 f6 75 1a 49 81 c6 18 9 [ 4.189555] RSP: 0000:ffffb3adc00b3d90 EFLAGS: 00010246 [ 4.189555] RAX: 0000000000000000 RBX: 0000000000000098 RCX: 0000000000000000 [ 4.267161] usb 1-1: New USB device found, idVendor=2109, idProduct=2812, bcdDevice= b.e0 [ 4.189555] RDX: 0000000000001000 RSI: 0000000000000000 RDI: ffff9340caafd000 [ 4.189555] RBP: ffffb3adc00b3df8 R08: ffffffffa0246e28 R09: ffff9340caafc000 [ 4.189555] R10: 000000000000024a R11: ffffffff9ff1f6f2 R12: 00000000ffffffed [ 4.189555] R13: ffff9340caa94800 R14: ffff9340caafc518 R15: 0000000000000003 [ 4.189555] FS: 0000000000000000(0000) GS:ffff9340ce200000(0000) knlGS:0000000000000000 [ 4.189555] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4.189555] CR2: 0000000000000020 CR3: 0000000302c14001 CR4: 00000000003606f0 [ 4.189555] Call Trace: [ 4.189555] ? __switch_to_asm+0x40/0x70 [ 4.189555] rapl_mmio_cpu_online+0x47/0x64 [ 4.189555] ? rapl_mmio_write_raw+0x33/0x33 [ 4.281059] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 4.189555] cpuhp_invoke_callback+0x29f/0x66f [ 4.189555] ? __schedule+0x46d/0x6a0 [ 4.189555] cpuhp_thread_fun+0xb9/0x11c [ 4.189555] smpboot_thread_fn+0x17d/0x22f [ 4.297006] usb 1-1: Product: USB2.0 Hub [ 4.189555] ? cpu_report_death+0x43/0x43 [ 4.189555] kthread+0x137/0x13f [ 4.189555] ? cpu_report_death+0x43/0x43 [ 4.189555] ? kthread_blkcg+0x2e/0x2e [ 4.312951] usb 1-1: Manufacturer: VIA Labs, Inc. [ 4.189555] ret_from_fork+0x1f/0x40 [ 4.189555] Modules linked in: [ 4.189555] CR2: 0000000000000020 [ 4.189555] ---[ end trace 01bb812aabc791f4 ]--- To avoid that problem, check rapl_defaults NULL upfront and return an error code if it is NULL. [Note that it does not make sense to even try to allocate memory in that case, because it is not going to be used anyway.] Fixes: 555c45fe0d04 ("int340X/processor_thermal_device: add support for MMIO RAPL") Cc: 5.3+ # 5.3+ Signed-off-by: Harry Pan [ rjw: Subject & changelog ] Signed-off-by: Rafael J. Wysocki commit f4b18892dca8e629e0ce192b233579505f8ed343 Author: Kai Vehmanen Date: Tue Dec 31 16:00:07 2019 +0200 drm/i915: Limit audio CDCLK>=2*BCLK constraint back to GLK only Revert changes done in commit f6ec9483091f ("drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms"). Audio drivers communicate with i915 over HDA bus multiple times during system boot-up and each of these transactions result in matching get_power/put_power calls to i915, and depending on the platform, a modeset change causing visible flicker. GLK is the only platform with minimum CDCLK significantly lower than BCLK, and thus for GLK setting a higher CDCLK is mandatory. For other platforms, minimum CDCLK is close but below 2*BCLK (e.g. on ICL, CDCLK=176.4kHz with BCLK=96kHz). Spec-wise the constraint should be set, but in practise no communication errors have been reported and the downside if set is the flicker observed at boot-time. Revert to old behaviour until better mechanism to manage probe-time clocks is available. The full CDCLK>=2*BCLK constraint is still enforced at pipe enable time in intel_crtc_compute_min_cdclk(). Bugzilla: https://gitlab.freedesktop.org/drm/intel/issues/913 Fixes: f6ec9483091f ("drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms") Signed-off-by: Kai Vehmanen Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20191231140007.31728-1-kai.vehmanen@linux.intel.com (cherry picked from commit 1ee48a61aa57dbdbc3cd2808d8b28df40d938e44) Signed-off-by: Joonas Lahtinen commit 1325008f5c8dbc84aa835d98af8447fa0569bc4d Author: Chris Wilson Date: Mon Jan 6 12:39:21 2020 +0000 drm/i915/gt: Mark up virtual engine uabi_instance Be sure to initialise the uabi_instance on the virtual engine to the special invalid value, just in case we ever peek at it from the uAPI. Reported-by: Tvrtko Ursulin Fixes: 750e76b4f9f6 ("drm/i915/gt: Move the [class][inst] lookup for engines onto the GT") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: # v5.4+ Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20200106123921.2543886-1-chris@chris-wilson.co.uk (cherry picked from commit f75fc37b5e70b75f21550410f88e2379648120e2) Signed-off-by: Joonas Lahtinen commit 36f2e7207f21a83ca0054116191f119ac64583ab Author: Swapna Manupati Date: Thu Dec 26 17:42:11 2019 +0530 gpio: zynq: Fix for bug in zynq_gpio_restore_context API This patch writes the inverse value of Interrupt Mask Status register into the Interrupt Enable register in zynq_gpio_restore_context API to fix the bug. Fixes: e11de4de28c0 ("gpio: zynq: Add support for suspend resume") Signed-off-by: Swapna Manupati Signed-off-by: Michal Simek Signed-off-by: Srinivas Neeli Link: https://lore.kernel.org/r/1577362338-28744-2-git-send-email-srinivas.neeli@xilinx.com Signed-off-by: Linus Walleij commit 35c60be220572de7d6605c4318f640d133982040 Author: Qianggui Song Date: Thu Dec 26 10:37:34 2019 +0800 pinctrl: meson: Fix wrong shift value when get drive-strength In meson_pinconf_get_drive_strength, variable bit is calculated by meson_calc_reg_and_bit, this value is the offset from the first pin of a certain bank to current pin, while Meson SoCs use two bits for each pin to depict drive-strength. So a left shift by 1 should be done or node pinconf-pins shows wrong message. Fixes: 6ea3e3bbef37 ("pinctrl: meson: add support of drive-strength-microamp") Signed-off-by: Qianggui Song Link: https://lore.kernel.org/r/20191226023734.9631-1-qianggui.song@amlogic.com Signed-off-by: Linus Walleij commit f7e36e18946b4ec756b9c5cf4fb8891be8d1e4a3 Author: Arnd Bergmann Date: Wed Dec 18 17:36:46 2019 +0100 pinctrl: lochnagar: select GPIOLIB In a rare randconfig build I came across one configuration that does not enable CONFIG_GPIOLIB, which is needed by lochnagar: ERROR: "devm_gpiochip_add_data" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined! ERROR: "gpiochip_generic_free" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined! ERROR: "gpiochip_generic_request" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined! ERROR: "gpiochip_get_data" [drivers/pinctrl/cirrus/pinctrl-lochnagar.ko] undefined! Add another 'select' like all other pinctrl drivers have. Fixes: 0548448b719a ("pinctrl: lochnagar: Add support for the Cirrus Logic Lochnagar") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20191218163701.171914-1-arnd@arndb.de Acked-by: Charles Keepax Signed-off-by: Linus Walleij commit c936069fb59c008013affd5672f0f27db2e03005 Merge: c79f46a28239 26a7a47510ed Author: Rafael J. Wysocki Date: Tue Jan 7 10:41:35 2020 +0100 Merge branch 'cpufreq/arm/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull cpufreq driver fix for v5.5-rc6 from Viresh Kumar: "Blacklist Tegra20/30 for probing by cpufreq-dt driver." * 'cpufreq/arm/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: dt-platdev: Blacklist NVIDIA Tegra20 and Tegra30 SoCs commit 344fa0bad6932204146d305607790340f2324a90 Author: Amit Kucheria Date: Thu Dec 12 16:08:14 2019 +0530 drivers: thermal: tsens: Work with old DTBs In order for the old DTBs to continue working, the new interrupt code must not return an error if interrupts are not defined. Don't return an error in case of -ENXIO. Fixes: 634e11d5b450a ("drivers: thermal: tsens: Add interrupt support") Suggested-by: Stephan Gerhold Signed-off-by: Amit Kucheria Reviewed-by: Bjorn Andersson Tested-by: Bjorn Andersson Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/cea3317c5d793db312064d68b261ad420a4a81b1.1576146898.git.amit.kucheria@linaro.org commit c101fffcd7fa83a851d180721426fe1b7c7daf8e Merge: d76063c506da df55c5586e51 Author: David S. Miller Date: Mon Jan 6 18:24:18 2020 -0800 Merge tag 'mlx5-fixes-2020-01-06' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2020-01-06 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. For -stable v5.3 ('net/mlx5: Move devlink registration before interfaces load') For -stable v5.4 ('net/mlx5e: Fix hairpin RSS table size') ('net/mlx5: DR, Init lists that are used in rule's member') ('net/mlx5e: Always print health reporter message to dmesg') ('net/mlx5: DR, No need for atomic refcount for internal SW steering resources') ==================== Signed-off-by: David S. Miller commit ae6088216ce4b99b3a4aaaccd2eb2dd40d473d42 Merge: 7ae564122f75 72879ee0c53e Author: Linus Torvalds Date: Mon Jan 6 15:38:38 2020 -0800 Merge tag 'trace-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Various tracing fixes: - kbuild found missing define of MCOUNT_INSN_SIZE for various build configs - Initialize variable to zero as gcc thinks it is used undefined (it really isn't but the code is subtle enough that this doesn't hurt) - Convert from do_div() to div64_ull() to prevent potential divide by zero - Unregister a trace point on error path in sched_wakeup tracer - Use signed offset for archs that can have stext not be first - A simple indentation fix (whitespace error)" * tag 'trace-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix indentation issue kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail tracing: Change offset type to s32 in preempt/irq tracepoints ftrace: Avoid potential division by zero in function profiler tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined tracing: Define MCOUNT_INSN_SIZE when not defined without direct calls tracing: Initialize val to zero in parse_entry of inject code commit df55c5586e5185f890192a6802dc5b46fddd3606 Author: Erez Shitrit Date: Mon Nov 25 10:26:24 2019 +0200 net/mlx5: DR, Init lists that are used in rule's member Whenever adding new member of rule object we attach it to 2 lists, These 2 lists should be initialized first. Fixes: 41d07074154c ("net/mlx5: DR, Expose steering rule functionality") Signed-off-by: Erez Shitrit Signed-off-by: Saeed Mahameed commit 6412bb396a63f28de994b1480edf8e4caf4aa494 Author: Eli Cohen Date: Wed Dec 11 09:17:40 2019 +0200 net/mlx5e: Fix hairpin RSS table size Set hairpin table size to the corret size, based on the groups that would be created in it. Groups are laid out on the table such that a group occupies a range of entries in the table. This implies that the group ranges should have correspondence to the table they are laid upon. The patch cited below made group 1's size to grow hence causing overflow of group range laid on the table. Fixes: a795d8db2a6d ("net/mlx5e: Support RSS for IP-in-IP and IPv6 tunneled packets") Signed-off-by: Eli Cohen Signed-off-by: Mark Bloch Signed-off-by: Saeed Mahameed commit 4ce380ca477507e2f413584cdd99e1698d6682d6 Author: Yevgeny Kliteynik Date: Mon Dec 23 16:16:31 2019 +0200 net/mlx5: DR, No need for atomic refcount for internal SW steering resources No need for an atomic refcounter for the STE and hashtables. These are internal SW steering resources and they are always under domain mutex. This also fixes the following refcount error: refcount_t: addition on 0; use-after-free. WARNING: CPU: 9 PID: 3527 at lib/refcount.c:25 refcount_warn_saturate+0x81/0xe0 Call Trace: dr_table_init_nic+0x10d/0x110 [mlx5_core] mlx5dr_table_create+0xb4/0x230 [mlx5_core] mlx5_cmd_dr_create_flow_table+0x39/0x120 [mlx5_core] __mlx5_create_flow_table+0x221/0x5f0 [mlx5_core] esw_create_offloads_fdb_tables+0x180/0x5a0 [mlx5_core] ... Fixes: 26d688e33f88 ("net/mlx5: DR, Add Steering entry (STE) utilities") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 1f0593e791ed3fb4074d4470a261cde62d806ed5 Author: Parav Pandit Date: Wed Dec 11 00:35:18 2019 -0600 Revert "net/mlx5: Support lockless FTE read lookups" This reverts commit 7dee607ed0e04500459db53001d8e02f8831f084. During cleanup path, FTE's parent node group is removed which is referenced by the FTE while freeing the FTE. Hence FTE's lockless read lookup optimization done in cited commit is not possible at the moment. Hence, revert the commit. This avoid below KAZAN call trace. [ 110.390896] BUG: KASAN: use-after-free in find_root.isra.14+0x56/0x60 [mlx5_core] [ 110.391048] Read of size 4 at addr ffff888c19e6d220 by task swapper/12/0 [ 110.391219] CPU: 12 PID: 0 Comm: swapper/12 Not tainted 5.5.0-rc1+ [ 110.391222] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/02/2014 [ 110.391225] Call Trace: [ 110.391229] [ 110.391246] dump_stack+0x95/0xd5 [ 110.391307] ? find_root.isra.14+0x56/0x60 [mlx5_core] [ 110.391320] print_address_description.constprop.5+0x20/0x320 [ 110.391379] ? find_root.isra.14+0x56/0x60 [mlx5_core] [ 110.391435] ? find_root.isra.14+0x56/0x60 [mlx5_core] [ 110.391441] __kasan_report+0x149/0x18c [ 110.391499] ? find_root.isra.14+0x56/0x60 [mlx5_core] [ 110.391504] kasan_report+0x12/0x20 [ 110.391511] __asan_report_load4_noabort+0x14/0x20 [ 110.391567] find_root.isra.14+0x56/0x60 [mlx5_core] [ 110.391625] del_sw_fte_rcu+0x4a/0x100 [mlx5_core] [ 110.391633] rcu_core+0x404/0x1950 [ 110.391640] ? rcu_accelerate_cbs_unlocked+0x100/0x100 [ 110.391649] ? run_rebalance_domains+0x201/0x280 [ 110.391654] rcu_core_si+0xe/0x10 [ 110.391661] __do_softirq+0x181/0x66c [ 110.391670] irq_exit+0x12c/0x150 [ 110.391675] smp_apic_timer_interrupt+0xf0/0x370 [ 110.391681] apic_timer_interrupt+0xf/0x20 [ 110.391684] [ 110.391695] RIP: 0010:cpuidle_enter_state+0xfa/0xba0 [ 110.391703] Code: 3d c3 9b b5 50 e8 56 75 6e fe 48 89 45 c8 0f 1f 44 00 00 31 ff e8 a6 94 6e fe 45 84 ff 0f 85 f6 02 00 00 fb 66 0f 1f 44 00 00 <45> 85 f6 0f 88 db 06 00 00 4d 63 fe 4b 8d 04 7f 49 8d 04 87 49 8d [ 110.391706] RSP: 0018:ffff888c23a6fce8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 110.391712] RAX: dffffc0000000000 RBX: ffffe8ffff7002f8 RCX: 000000000000001f [ 110.391715] RDX: 1ffff11184ee6cb5 RSI: 0000000040277d83 RDI: ffff888c277365a8 [ 110.391718] RBP: ffff888c23a6fd40 R08: 0000000000000002 R09: 0000000000035280 [ 110.391721] R10: ffff888c23a6fc80 R11: ffffed11847485d0 R12: ffffffffb1017740 [ 110.391723] R13: 0000000000000003 R14: 0000000000000003 R15: 0000000000000000 [ 110.391732] ? cpuidle_enter_state+0xea/0xba0 [ 110.391738] cpuidle_enter+0x4f/0xa0 [ 110.391747] call_cpuidle+0x6d/0xc0 [ 110.391752] do_idle+0x360/0x430 [ 110.391758] ? arch_cpu_idle_exit+0x40/0x40 [ 110.391765] ? complete+0x67/0x80 [ 110.391771] cpu_startup_entry+0x1d/0x20 [ 110.391779] start_secondary+0x2f3/0x3c0 [ 110.391784] ? set_cpu_sibling_map+0x2500/0x2500 [ 110.391795] secondary_startup_64+0xa4/0xb0 [ 110.391841] Allocated by task 290: [ 110.391917] save_stack+0x21/0x90 [ 110.391921] __kasan_kmalloc.constprop.8+0xa7/0xd0 [ 110.391925] kasan_kmalloc+0x9/0x10 [ 110.391929] kmem_cache_alloc_trace+0xf6/0x270 [ 110.391987] create_root_ns.isra.36+0x58/0x260 [mlx5_core] [ 110.392044] mlx5_init_fs+0x5fd/0x1ee0 [mlx5_core] [ 110.392092] mlx5_load_one+0xc7a/0x3860 [mlx5_core] [ 110.392139] init_one+0x6ff/0xf90 [mlx5_core] [ 110.392145] local_pci_probe+0xde/0x190 [ 110.392150] work_for_cpu_fn+0x56/0xa0 [ 110.392153] process_one_work+0x678/0x1140 [ 110.392157] worker_thread+0x573/0xba0 [ 110.392162] kthread+0x341/0x400 [ 110.392166] ret_from_fork+0x1f/0x40 [ 110.392218] Freed by task 2742: [ 110.392288] save_stack+0x21/0x90 [ 110.392292] __kasan_slab_free+0x137/0x190 [ 110.392296] kasan_slab_free+0xe/0x10 [ 110.392299] kfree+0x94/0x250 [ 110.392357] tree_put_node+0x257/0x360 [mlx5_core] [ 110.392413] tree_remove_node+0x63/0xb0 [mlx5_core] [ 110.392469] clean_tree+0x199/0x240 [mlx5_core] [ 110.392525] mlx5_cleanup_fs+0x76/0x580 [mlx5_core] [ 110.392572] mlx5_unload+0x22/0xc0 [mlx5_core] [ 110.392619] mlx5_unload_one+0x99/0x260 [mlx5_core] [ 110.392666] remove_one+0x61/0x160 [mlx5_core] [ 110.392671] pci_device_remove+0x10b/0x2c0 [ 110.392677] device_release_driver_internal+0x1e4/0x490 [ 110.392681] device_driver_detach+0x36/0x40 [ 110.392685] unbind_store+0x147/0x200 [ 110.392688] drv_attr_store+0x6f/0xb0 [ 110.392693] sysfs_kf_write+0x127/0x1d0 [ 110.392697] kernfs_fop_write+0x296/0x420 [ 110.392702] __vfs_write+0x66/0x110 [ 110.392707] vfs_write+0x1a0/0x500 [ 110.392711] ksys_write+0x164/0x250 [ 110.392715] __x64_sys_write+0x73/0xb0 [ 110.392720] do_syscall_64+0x9f/0x3a0 [ 110.392725] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 7dee607ed0e0 ("net/mlx5: Support lockless FTE read lookups") Signed-off-by: Parav Pandit Signed-off-by: Saeed Mahameed commit a6f3b62386a02c1e94bfa22c543f82d63f5e631b Author: Michael Guralnik Date: Wed Nov 20 11:43:49 2019 +0200 net/mlx5: Move devlink registration before interfaces load Register devlink before interfaces are added. This will allow interfaces to use devlink while initalizing. For example, call mlx5_is_roce_enabled. Fixes: aba25279c100 ("net/mlx5e: Add TX reporter support") Signed-off-by: Michael Guralnik Signed-off-by: Saeed Mahameed commit 99cda45426c9a2c59bb2f7cb886a405440282455 Author: Eran Ben Elisha Date: Wed Dec 4 14:34:18 2019 +0200 net/mlx5e: Always print health reporter message to dmesg In case a reporter exists, error message is logged only to the devlink tracer. The devlink tracer is a visibility utility only, which user can choose not to monitor. After cited patch, 3rd party monitoring tools that tracks these error message will no longer find them in dmesg, causing a regression. With this patch, error messages are also logged into the dmesg. Fixes: c50de4af1d63 ("net/mlx5e: Generalize tx reporter's functionality") Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 554fe75c1b3f679b1eebf193a4e56492837d3f5a Author: Dmytro Linkin Date: Thu Oct 31 18:15:51 2019 +0200 net/mlx5e: Avoid duplicating rule destinations Following scenario easily break driver logic and crash the kernel: 1. Add rule with mirred actions to same device. 2. Delete this rule. In described scenario rule is not added to database and on deletion driver access invalid entry. Example: $ tc filter add dev ens1f0_0 ingress protocol ip prio 1 \ flower skip_sw \ action mirred egress mirror dev ens1f0_1 pipe \ action mirred egress redirect dev ens1f0_1 $ tc filter del dev ens1f0_0 ingress protocol ip prio 1 Dmesg output: [ 376.634396] mlx5_core 0000:82:00.0: mlx5_cmd_check:756:(pid 3439): DESTROY_FLOW_GROUP(0x934) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0x563e2f) [ 376.654983] mlx5_core 0000:82:00.0: del_hw_flow_group:567:(pid 3439): flow steering can't destroy fg 89 of ft 3145728 [ 376.673433] kasan: CONFIG_KASAN_INLINE enabled [ 376.683769] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 376.695229] general protection fault: 0000 [#1] PREEMPT SMP KASAN PTI [ 376.705069] CPU: 7 PID: 3439 Comm: tc Not tainted 5.4.0-rc5+ #76 [ 376.714959] Hardware name: Supermicro SYS-2028TP-DECTR/X10DRT-PT, BIOS 2.0a 08/12/2016 [ 376.726371] RIP: 0010:mlx5_del_flow_rules+0x105/0x960 [mlx5_core] [ 376.735817] Code: 01 00 00 00 48 83 eb 08 e8 28 d9 ff ff 4c 39 e3 75 d8 4c 8d bd c0 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 84 04 00 00 48 8d 7d 28 8b 9 d [ 376.761261] RSP: 0018:ffff888847c56db8 EFLAGS: 00010202 [ 376.770054] RAX: dffffc0000000000 RBX: ffff8888582a6da0 RCX: ffff888847c56d60 [ 376.780743] RDX: 0000000000000058 RSI: 0000000000000008 RDI: 0000000000000282 [ 376.791328] RBP: 0000000000000000 R08: fffffbfff0c60ea6 R09: fffffbfff0c60ea6 [ 376.802050] R10: fffffbfff0c60ea5 R11: ffffffff8630752f R12: ffff8888582a6da0 [ 376.812798] R13: dffffc0000000000 R14: ffff8888582a6da0 R15: 00000000000002c0 [ 376.823445] FS: 00007f675f9a8840(0000) GS:ffff88886d200000(0000) knlGS:0000000000000000 [ 376.834971] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 376.844179] CR2: 00000000007d9640 CR3: 00000007d3f26003 CR4: 00000000001606e0 [ 376.854843] Call Trace: [ 376.868542] __mlx5_eswitch_del_rule+0x49/0x300 [mlx5_core] [ 376.877735] mlx5e_tc_del_fdb_flow+0x6ec/0x9e0 [mlx5_core] [ 376.921549] mlx5e_flow_put+0x2b/0x50 [mlx5_core] [ 376.929813] mlx5e_delete_flower+0x5b6/0xbd0 [mlx5_core] [ 376.973030] tc_setup_cb_reoffload+0x29/0xc0 [ 376.980619] fl_reoffload+0x50a/0x770 [cls_flower] [ 377.015087] tcf_block_playback_offloads+0xbd/0x250 [ 377.033400] tcf_block_setup+0x1b2/0xc60 [ 377.057247] tcf_block_offload_cmd+0x195/0x240 [ 377.098826] tcf_block_offload_unbind+0xe7/0x180 [ 377.107056] __tcf_block_put+0xe5/0x400 [ 377.114528] ingress_destroy+0x3d/0x60 [sch_ingress] [ 377.122894] qdisc_destroy+0xf1/0x5a0 [ 377.129993] qdisc_graft+0xa3d/0xe50 [ 377.151227] tc_get_qdisc+0x48e/0xa20 [ 377.165167] rtnetlink_rcv_msg+0x35d/0x8d0 [ 377.199528] netlink_rcv_skb+0x11e/0x340 [ 377.219638] netlink_unicast+0x408/0x5b0 [ 377.239913] netlink_sendmsg+0x71b/0xb30 [ 377.267505] sock_sendmsg+0xb1/0xf0 [ 377.273801] ___sys_sendmsg+0x635/0x900 [ 377.312784] __sys_sendmsg+0xd3/0x170 [ 377.338693] do_syscall_64+0x95/0x460 [ 377.344833] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 377.352321] RIP: 0033:0x7f675e58e090 To avoid this, for every mirred action check if output device was already processed. If so - drop rule with EOPNOTSUPP error. Signed-off-by: Dmytro Linkin Reviewed-by: Roi Dayan Reviewed-by: Vlad Buslov Signed-off-by: Saeed Mahameed commit c5706c7defc79de68a115b5536376298a8fef111 Author: Dmitry Osipenko Date: Mon Jan 6 04:51:54 2020 +0300 gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP Driver fails to compile in a minimized kernel's configuration because of the missing dependency on GPIOLIB_IRQCHIP. error: ‘struct gpio_chip’ has no member named ‘irq’ 44 | virq = irq_find_mapping(gpio->gpio_chip.irq.domain, offset); Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20200106015154.12040-1-digetx@gmail.com Signed-off-by: Linus Walleij commit 7ae564122f75337d84c41b3963a6e25e8665dfac Merge: baf4dc829574 aa4a63dd9816 Author: Linus Torvalds Date: Mon Jan 6 14:49:52 2020 -0800 Merge tag 'tpmdd-next-20200106' of git://git.infradead.org/users/jjs/linux-tpmdd Pull tpmd fixes from Jarkko Sakkinen: "There has been a bunch of reports (e.g. [*]) reporting that when commit 5b359c7c4372 ("tpm_tis_core: Turn on the TPM before probing IRQ's") and subsequent fixes are applied it causes boot freezes on some machines. Unfortunately hardware where this causes a failure is not widely available (only one I'm aware is Lenovo T490), which means we cannot predict yet how long it will take to properly fix tpm_tis interrupt probing. Thus, the least worst short term action is to revert the code to the state before this commit. In long term we need fix the tpm_tis probing code to work on machines that Stefan's patches were supposed to fix. With these patches reverted nothing fatal happens, TPM is fallbacked to be used in polling mode (which is not in the end too bad because there are no high throughput workloads for TPM). [*] https://bugzilla.kernel.org/show_bug.cgi?id=205935" * tag 'tpmdd-next-20200106' of git://git.infradead.org/users/jjs/linux-tpmdd: tpm: Revert "tpm_tis_core: Turn on the TPM before probing IRQ's" tpm: Revert "tpm_tis_core: Set TPM_CHIP_FLAG_IRQ before probing for interrupts" tpm: Revert "tpm_tis: reserve chip for duration of tpm_tis_core_init" commit 6d4f151acf9a4f6fab09b615f246c717ddedcf0c Author: Daniel Borkmann Date: Mon Jan 6 22:51:57 2020 +0100 bpf: Fix passing modified ctx to ld/abs/ind instruction Anatoly has been fuzzing with kBdysch harness and reported a KASAN slab oob in one of the outcomes: [...] [ 77.359642] BUG: KASAN: slab-out-of-bounds in bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.360463] Read of size 4 at addr ffff8880679bac68 by task bpf/406 [ 77.361119] [ 77.361289] CPU: 2 PID: 406 Comm: bpf Not tainted 5.5.0-rc2-xfstests-00157-g2187f215eba #1 [ 77.362134] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 77.362984] Call Trace: [ 77.363249] dump_stack+0x97/0xe0 [ 77.363603] print_address_description.constprop.0+0x1d/0x220 [ 77.364251] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365030] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365860] __kasan_report.cold+0x37/0x7b [ 77.366365] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.366940] kasan_report+0xe/0x20 [ 77.367295] bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.367821] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.368278] ? mark_lock+0xa3/0x9b0 [ 77.368641] ? kvm_sched_clock_read+0x14/0x30 [ 77.369096] ? sched_clock+0x5/0x10 [ 77.369460] ? sched_clock_cpu+0x18/0x110 [ 77.369876] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.370330] ___bpf_prog_run+0x16c0/0x28f0 [ 77.370755] __bpf_prog_run32+0x83/0xc0 [ 77.371153] ? __bpf_prog_run64+0xc0/0xc0 [ 77.371568] ? match_held_lock+0x1b/0x230 [ 77.371984] ? rcu_read_lock_held+0xa1/0xb0 [ 77.372416] ? rcu_is_watching+0x34/0x50 [ 77.372826] sk_filter_trim_cap+0x17c/0x4d0 [ 77.373259] ? sock_kzfree_s+0x40/0x40 [ 77.373648] ? __get_filter+0x150/0x150 [ 77.374059] ? skb_copy_datagram_from_iter+0x80/0x280 [ 77.374581] ? do_raw_spin_unlock+0xa5/0x140 [ 77.375025] unix_dgram_sendmsg+0x33a/0xa70 [ 77.375459] ? do_raw_spin_lock+0x1d0/0x1d0 [ 77.375893] ? unix_peer_get+0xa0/0xa0 [ 77.376287] ? __fget_light+0xa4/0xf0 [ 77.376670] __sys_sendto+0x265/0x280 [ 77.377056] ? __ia32_sys_getpeername+0x50/0x50 [ 77.377523] ? lock_downgrade+0x350/0x350 [ 77.377940] ? __sys_setsockopt+0x2a6/0x2c0 [ 77.378374] ? sock_read_iter+0x240/0x240 [ 77.378789] ? __sys_socketpair+0x22a/0x300 [ 77.379221] ? __ia32_sys_socket+0x50/0x50 [ 77.379649] ? mark_held_locks+0x1d/0x90 [ 77.380059] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 77.380536] __x64_sys_sendto+0x74/0x90 [ 77.380938] do_syscall_64+0x68/0x2a0 [ 77.381324] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.381878] RIP: 0033:0x44c070 [...] After further debugging, turns out while in case of other helper functions we disallow passing modified ctx, the special case of ld/abs/ind instruction which has similar semantics (except r6 being the ctx argument) is missing such check. Modified ctx is impossible here as bpf_skb_load_helper_8_no_cache() and others are expecting skb fields in original position, hence, add check_ctx_reg() to reject any modified ctx. Issue was first introduced back in f1174f77b50c ("bpf/verifier: rework value tracking"). Fixes: f1174f77b50c ("bpf/verifier: rework value tracking") Reported-by: Anatoly Trosinenko Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20200106215157.3553-1-daniel@iogearbox.net commit baf4dc829574ed9dd8ba33cda0536a50f28937de Merge: ec7b3f5372e2 dcbce5fbcc69 Author: Linus Torvalds Date: Mon Jan 6 14:12:50 2020 -0800 Merge tag 'linux-watchdog-5.5-fixes' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog fixes from Wim Van Sebroeck: - fix module aliases - fix potential build errors - fix missing conversion of imx7ulp_wdt_enable() - fix platform_get_irq() complaints - fix NCT6116D support * tag 'linux-watchdog-5.5-fixes' of git://www.linux-watchdog.org/linux-watchdog: watchdog: orion: fix platform_get_irq() complaints watchdog: rn5t618_wdt: fix module aliases watchdog: tqmx86_wdt: Fix build error watchdog: max77620_wdt: fix potential build errors watchdog: imx7ulp: Fix missing conversion of imx7ulp_wdt_enable() watchdog: w83627hf_wdt: Fix support NCT6116D commit d76063c506da79247e626018c9ed0b916d78f358 Merge: 4012a6f2fa56 b585f8602acb Author: David S. Miller Date: Mon Jan 6 14:06:11 2020 -0800 Merge branch 'atlantic-bugfixes' Igor Russkikh says: ==================== Aquantia/Marvell atlantic bugfixes 2020/01 Here is a set of recently discovered bugfixes, ==================== Signed-off-by: David S. Miller commit b585f8602acbe2620212cbedc1760906814ff515 Author: Igor Russkikh Date: Mon Jan 6 14:22:30 2020 +0300 net: atlantic: remove duplicate entries Function entries were duplicated accidentally, removing the dups. Fixes: ea4b4d7fc106 ("net: atlantic: loopback tests via private flags") Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit 883daa1854b61fe3d21d7d9bf2c81d26a07d586b Author: Igor Russkikh Date: Mon Jan 6 14:22:29 2020 +0300 net: atlantic: loopback configuration in improper place Initial loopback configuration should be called earlier, before starting traffic on HW blocks. Otherwise depending on race conditions it could be kept disabled. Fixes: ea4b4d7fc106 ("net: atlantic: loopback tests via private flags") Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit ac70957ee19f198a3884e6f506d75b3f6d8a7dc9 Author: Igor Russkikh Date: Mon Jan 6 14:22:28 2020 +0300 net: atlantic: broken link status on old fw Last code/checkpatch cleanup did a copy paste error where code from firmware 3 API logic was moved to firmware 1 logic. This resulted in FW1.x users would never see the link state as active. Fixes: 7b0c342f1f67 ("net: atlantic: code style cleanup") Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit e10360f815ca6367357b2c2cfef17fc663e50f7b Author: Roman Gushchin Date: Fri Dec 27 13:50:34 2019 -0800 bpf: cgroup: prevent out-of-order release of cgroup bpf Before commit 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself") cgroup bpf structures were released with corresponding cgroup structures. It guaranteed the hierarchical order of destruction: children were always first. It preserved attached programs from being released before their propagated copies. But with cgroup auto-detachment there are no such guarantees anymore: cgroup bpf is released as soon as the cgroup is offline and there are no live associated sockets. It means that an attached program can be detached and released, while its propagated copy is still living in the cgroup subtree. This will obviously lead to an use-after-free bug. To reproduce the issue the following script can be used: #!/bin/bash CGROOT=/sys/fs/cgroup mkdir -p ${CGROOT}/A ${CGROOT}/B ${CGROOT}/A/C sleep 1 ./test_cgrp2_attach ${CGROOT}/A egress & A_PID=$! ./test_cgrp2_attach ${CGROOT}/B egress & B_PID=$! echo $$ > ${CGROOT}/A/C/cgroup.procs iperf -s & S_PID=$! iperf -c localhost -t 100 & C_PID=$! sleep 1 echo $$ > ${CGROOT}/B/cgroup.procs echo ${S_PID} > ${CGROOT}/B/cgroup.procs echo ${C_PID} > ${CGROOT}/B/cgroup.procs sleep 1 rmdir ${CGROOT}/A/C rmdir ${CGROOT}/A sleep 1 kill -9 ${S_PID} ${C_PID} ${A_PID} ${B_PID} On the unpatched kernel the following stacktrace can be obtained: [ 33.619799] BUG: unable to handle page fault for address: ffffbdb4801ab002 [ 33.620677] #PF: supervisor read access in kernel mode [ 33.621293] #PF: error_code(0x0000) - not-present page [ 33.622754] Oops: 0000 [#1] SMP NOPTI [ 33.623202] CPU: 0 PID: 601 Comm: iperf Not tainted 5.5.0-rc2+ #23 [ 33.625545] RIP: 0010:__cgroup_bpf_run_filter_skb+0x29f/0x3d0 [ 33.635809] Call Trace: [ 33.636118] ? __cgroup_bpf_run_filter_skb+0x2bf/0x3d0 [ 33.636728] ? __switch_to_asm+0x40/0x70 [ 33.637196] ip_finish_output+0x68/0xa0 [ 33.637654] ip_output+0x76/0xf0 [ 33.638046] ? __ip_finish_output+0x1c0/0x1c0 [ 33.638576] __ip_queue_xmit+0x157/0x410 [ 33.639049] __tcp_transmit_skb+0x535/0xaf0 [ 33.639557] tcp_write_xmit+0x378/0x1190 [ 33.640049] ? _copy_from_iter_full+0x8d/0x260 [ 33.640592] tcp_sendmsg_locked+0x2a2/0xdc0 [ 33.641098] ? sock_has_perm+0x10/0xa0 [ 33.641574] tcp_sendmsg+0x28/0x40 [ 33.641985] sock_sendmsg+0x57/0x60 [ 33.642411] sock_write_iter+0x97/0x100 [ 33.642876] new_sync_write+0x1b6/0x1d0 [ 33.643339] vfs_write+0xb6/0x1a0 [ 33.643752] ksys_write+0xa7/0xe0 [ 33.644156] do_syscall_64+0x5b/0x1b0 [ 33.644605] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix this by grabbing a reference to the bpf structure of each ancestor on the initialization of the cgroup bpf structure, and dropping the reference at the end of releasing the cgroup bpf structure. This will restore the hierarchical order of cgroup bpf releasing, without adding any operations on hot paths. Thanks to Josef Bacik for the debugging and the initial analysis of the problem. Fixes: 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself") Reported-by: Josef Bacik Signed-off-by: Roman Gushchin Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit 4012a6f2fa562b4b2884ea96db263caa4c6057a8 Author: Vikas Gupta Date: Mon Jan 6 11:54:02 2020 +0530 firmware: tee_bnxt: Fix multiple call to tee_client_close_context Fix calling multiple tee_client_close_context in case of shm allocation fails. Fixes: 246880958ac9 (“firmware: broadcom: add OP-TEE based BNXT f/w manager”) Signed-off-by: Vikas Gupta Signed-off-by: David S. Miller commit d8dc2c9676e614ef62f54a155b50076888c8a29a Author: Andrew Lunn Date: Sat Jan 4 23:14:51 2020 +0100 net: dsa: mv88e6xxx: Preserve priority when setting CPU port. The 6390 family uses an extended register to set the port connected to the CPU. The lower 5 bits indicate the port, the upper three bits are the priority of the frames as they pass through the switch, what egress queue they should use, etc. Since frames being set to the CPU are typically management frames, BPDU, IGMP, ARP, etc set the priority to 7, the reset default, and the highest. Fixes: 33641994a676 ("net: dsa: mv88e6xxx: Monitor and Management tables") Signed-off-by: Andrew Lunn Tested-by: Chris Healy Signed-off-by: David S. Miller commit 5adcb8b18611c69577fd0f35337ab8d2573712fa Author: Krzysztof Kozlowski Date: Sat Jan 4 16:21:06 2020 +0100 net: ethernet: sxgbe: Rename Samsung to lowercase Fix up inconsistent usage of upper and lowercase letters in "Samsung" name. "SAMSUNG" is not an abbreviation but a regular trademarked name. Therefore it should be written with lowercase letters starting with capital letter. Although advertisement materials usually use uppercase "SAMSUNG", the lowercase version is used in all legal aspects (e.g. on Wikipedia and in privacy/legal statements on https://www.samsung.com/semiconductor/privacy-global/). Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 00c0688cecadbf7ac2f5b4cdb36d912a2d3f0cca Author: Krzysztof Kozlowski Date: Sat Jan 4 15:31:43 2020 +0100 net: wan: sdla: Fix cast from pointer to integer of different size Since net_device.mem_start is unsigned long, it should not be cast to int right before casting to pointer. This fixes warning (compile testing on alpha architecture): drivers/net/wan/sdla.c: In function ‘sdla_transmit’: drivers/net/wan/sdla.c:711:13: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit be7a7729207797476b6666f046d765bdf9630407 Author: Xin Long Date: Sat Jan 4 14:15:02 2020 +0800 sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY This patch is to fix a memleak caused by no place to free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY. This issue occurs when failing to process a cmd while there're still SCTP_CMD_REPLY cmds on the cmd seq with an allocated chunk in cmd->obj.chunk. So fix it by freeing cmd->obj.chunk for each SCTP_CMD_REPLY cmd left on the cmd seq when any cmd returns error. While at it, also remove 'nomem' label. Reported-by: syzbot+107c4aff5f392bf1517f@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Signed-off-by: David S. Miller commit a7869e5f9174f246b662b2db6390bc128a351388 Author: Ying Xue Date: Sat Jan 4 10:48:36 2020 +0800 tipc: eliminate KMSAN: uninit-value in __tipc_nl_compat_dumpit error syzbot found the following crash on: ===================================================== BUG: KMSAN: uninit-value in __nlmsg_parse include/net/netlink.h:661 [inline] BUG: KMSAN: uninit-value in nlmsg_parse_deprecated include/net/netlink.h:706 [inline] BUG: KMSAN: uninit-value in __tipc_nl_compat_dumpit+0x553/0x11e0 net/tipc/netlink_compat.c:215 CPU: 0 PID: 12425 Comm: syz-executor062 Not tainted 5.5.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108 __msan_warning+0x57/0xa0 mm/kmsan/kmsan_instr.c:245 __nlmsg_parse include/net/netlink.h:661 [inline] nlmsg_parse_deprecated include/net/netlink.h:706 [inline] __tipc_nl_compat_dumpit+0x553/0x11e0 net/tipc/netlink_compat.c:215 tipc_nl_compat_dumpit+0x761/0x910 net/tipc/netlink_compat.c:308 tipc_nl_compat_handle net/tipc/netlink_compat.c:1252 [inline] tipc_nl_compat_recv+0x12e9/0x2870 net/tipc/netlink_compat.c:1311 genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline] genl_family_rcv_msg net/netlink/genetlink.c:717 [inline] genl_rcv_msg+0x1dd0/0x23a0 net/netlink/genetlink.c:734 netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2477 genl_rcv+0x63/0x80 net/netlink/genetlink.c:745 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xfa0/0x1100 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x11f0/0x1480 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x1362/0x13f0 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x4f0/0x5e0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x444179 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffd2d6409c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444179 RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000003 RBP: 00000000006ce018 R08: 0000000000000000 R09: 00000000004002e0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401e20 R13: 0000000000401eb0 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline] kmsan_internal_poison_shadow+0x5c/0x110 mm/kmsan/kmsan.c:132 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:86 slab_alloc_node mm/slub.c:2774 [inline] __kmalloc_node_track_caller+0xe47/0x11f0 mm/slub.c:4382 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x309/0xa50 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] nlmsg_new include/net/netlink.h:888 [inline] tipc_nl_compat_dumpit+0x6e4/0x910 net/tipc/netlink_compat.c:301 tipc_nl_compat_handle net/tipc/netlink_compat.c:1252 [inline] tipc_nl_compat_recv+0x12e9/0x2870 net/tipc/netlink_compat.c:1311 genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline] genl_family_rcv_msg net/netlink/genetlink.c:717 [inline] genl_rcv_msg+0x1dd0/0x23a0 net/netlink/genetlink.c:734 netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2477 genl_rcv+0x63/0x80 net/netlink/genetlink.c:745 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xfa0/0x1100 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x11f0/0x1480 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x1362/0x13f0 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x4f0/0x5e0 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ===================================================== The complaint above occurred because the memory region pointed by attrbuf variable was not initialized. To eliminate this warning, we use kcalloc() rather than kmalloc_array() to allocate memory for attrbuf. Reported-by: syzbot+b1fd2bf2c89d8407e15f@syzkaller.appspotmail.com Signed-off-by: Ying Xue Signed-off-by: David S. Miller commit 869bced7a055665e3ddb1ba671a441ce6f997bf1 Author: Hans de Goede Date: Mon Jan 6 12:39:03 2020 +0100 ASoC: Intel: bytcht_es8316: Fix Irbis NB41 netbook quirk When a quirk for the Irbis NB41 netbook was added, to override the defaults for this device, I forgot to add/keep the BYT_CHT_ES8316_SSP0 part of the defaults, completely breaking audio on this netbook. This commit adds the BYT_CHT_ES8316_SSP0 flag to the Irbis NB41 netbook quirk, making audio work again. Cc: stable@vger.kernel.org Cc: russianneuromancer@ya.ru Fixes: aa2ba991c420 ("ASoC: Intel: bytcht_es8316: Add quirk for Irbis NB41 netbook") Reported-and-tested-by: russianneuromancer@ya.ru Signed-off-by: Hans de Goede Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200106113903.279394-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit 89b71b3f02d8ae5a08a1dd6f4a2098b7b868d498 Author: Dmitry Osipenko Date: Mon Jan 6 04:47:07 2020 +0300 ASoC: rt5640: Fix NULL dereference on module unload The rt5640->jack is NULL if jack is already disabled at the time of driver's module unloading. Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20200106014707.11378-1-digetx@gmail.com Signed-off-by: Mark Brown commit ec7b3f5372e2f674ce19c23ca8f5a2c103025264 Merge: 5acefdc27b73 09b6636cea4f Author: Linus Torvalds Date: Mon Jan 6 12:34:44 2020 -0800 Merge tag 'spi-fix-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of fixes here, one to make the newly added PTP timestamping code more accurate, a few driver fixes and a fix for the core DT binding to document the fact that we support eight wire buses" * tag 'spi-fix-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: Document Octal mode as valid SPI bus width spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls spi: spi-fsl-dspi: Fix 16-bit word order in 32-bit XSPI mode spi: Don't look at TX buffer for PTP system timestamping spi: uniphier: Fix FIFO threshold commit 5acefdc27b739e68294259c1a89c39d250246554 Merge: b967793c96dd 6f1ff76154b8 Author: Linus Torvalds Date: Mon Jan 6 12:04:31 2020 -0800 Merge tag 'regulator-fix-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "Three small fixes here, two the result of Axel Lin's amazing work tracking down inconsistencies in drivers" * tag 'regulator-fix-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: bd70528: Remove .set_ramp_delay for bd70528_ldo_ops regulator: axp20x: Fix axp20x_set_ramp_delay regulator: axp20x: Fix AXP22x ELDO2 regulator enable bitmask commit 68faa679b8be1a74e6663c21c3a9d25d32f1c079 Author: Will Deacon Date: Thu Dec 19 12:02:03 2019 +0000 chardev: Avoid potential use-after-free in 'chrdev_open()' 'chrdev_open()' calls 'cdev_get()' to obtain a reference to the 'struct cdev *' stashed in the 'i_cdev' field of the target inode structure. If the pointer is NULL, then it is initialised lazily by looking up the kobject in the 'cdev_map' and so the whole procedure is protected by the 'cdev_lock' spinlock to serialise initialisation of the shared pointer. Unfortunately, it is possible for the initialising thread to fail *after* installing the new pointer, for example if the subsequent '->open()' call on the file fails. In this case, 'cdev_put()' is called, the reference count on the kobject is dropped and, if nobody else has taken a reference, the release function is called which finally clears 'inode->i_cdev' from 'cdev_purge()' before potentially freeing the object. The problem here is that a racing thread can happily take the 'cdev_lock' and see the non-NULL pointer in the inode, which can result in a refcount increment from zero and a warning: | ------------[ cut here ]------------ | refcount_t: addition on 0; use-after-free. | WARNING: CPU: 2 PID: 6385 at lib/refcount.c:25 refcount_warn_saturate+0x6d/0xf0 | Modules linked in: | CPU: 2 PID: 6385 Comm: repro Not tainted 5.5.0-rc2+ #22 | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 | RIP: 0010:refcount_warn_saturate+0x6d/0xf0 | Code: 05 55 9a 15 01 01 e8 9d aa c8 ff 0f 0b c3 80 3d 45 9a 15 01 00 75 ce 48 c7 c7 00 9c 62 b3 c6 08 | RSP: 0018:ffffb524c1b9bc70 EFLAGS: 00010282 | RAX: 0000000000000000 RBX: ffff9e9da1f71390 RCX: 0000000000000000 | RDX: ffff9e9dbbd27618 RSI: ffff9e9dbbd18798 RDI: ffff9e9dbbd18798 | RBP: 0000000000000000 R08: 000000000000095f R09: 0000000000000039 | R10: 0000000000000000 R11: ffffb524c1b9bb20 R12: ffff9e9da1e8c700 | R13: ffffffffb25ee8b0 R14: 0000000000000000 R15: ffff9e9da1e8c700 | FS: 00007f3b87d26700(0000) GS:ffff9e9dbbd00000(0000) knlGS:0000000000000000 | CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | CR2: 00007fc16909c000 CR3: 000000012df9c000 CR4: 00000000000006e0 | DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 | DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 | Call Trace: | kobject_get+0x5c/0x60 | cdev_get+0x2b/0x60 | chrdev_open+0x55/0x220 | ? cdev_put.part.3+0x20/0x20 | do_dentry_open+0x13a/0x390 | path_openat+0x2c8/0x1470 | do_filp_open+0x93/0x100 | ? selinux_file_ioctl+0x17f/0x220 | do_sys_open+0x186/0x220 | do_syscall_64+0x48/0x150 | entry_SYSCALL_64_after_hwframe+0x44/0xa9 | RIP: 0033:0x7f3b87efcd0e | Code: 89 54 24 08 e8 a3 f4 ff ff 8b 74 24 0c 48 8b 3c 24 41 89 c0 44 8b 54 24 08 b8 01 01 00 00 89 f4 | RSP: 002b:00007f3b87d259f0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 | RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3b87efcd0e | RDX: 0000000000000000 RSI: 00007f3b87d25a80 RDI: 00000000ffffff9c | RBP: 00007f3b87d25e90 R08: 0000000000000000 R09: 0000000000000000 | R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffe188f504e | R13: 00007ffe188f504f R14: 00007f3b87d26700 R15: 0000000000000000 | ---[ end trace 24f53ca58db8180a ]--- Since 'cdev_get()' can already fail to obtain a reference, simply move it over to use 'kobject_get_unless_zero()' instead of 'kobject_get()', which will cause the racing thread to return -ENXIO if the initialising thread fails unexpectedly. Cc: Hillf Danton Cc: Andrew Morton Cc: Al Viro Reported-by: syzbot+82defefbbd8527e1c2cb@syzkaller.appspotmail.com Signed-off-by: Will Deacon Cc: stable Link: https://lore.kernel.org/r/20191219120203.32691-1-will@kernel.org Signed-off-by: Greg Kroah-Hartman commit c5ee0b3104e0b292d353e63fd31cb8c692645d8c Author: Punit Agrawal Date: Thu Dec 19 19:03:45 2019 +0900 serdev: Don't claim unsupported ACPI serial devices Serdev sub-system claims all ACPI serial devices that are not already initialised. As a result, no device node is created for serial ports on certain boards such as the Apollo Lake based UP2. This has the unintended consequence of not being able to raise the login prompt via serial connection. Introduce a blacklist to reject ACPI serial devices that should not be claimed by serdev sub-system. Add the peripheral ids for Intel HS UART to the blacklist to bring back serial port on SoCs carrying them. Cc: stable@vger.kernel.org Signed-off-by: Punit Agrawal Acked-by: Hans de Goede Acked-by: Johan Hovold Cc: Rob Herring Link: https://lore.kernel.org/r/20191219100345.911093-1-punit1.agrawal@toshiba.co.jp Signed-off-by: Greg Kroah-Hartman commit b967793c96dde15cbcb07fb98238535682cc27f8 Merge: 8f8b69aa501e f01f4ffdfb70 Author: Linus Torvalds Date: Mon Jan 6 10:46:43 2020 -0800 Merge tag 'rtc-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fixes from Alexandre Belloni: "A few fixes for this cycle. The CMOS AltCentury support broke a few platforms with a recent BIOS so I reverted it. The mt6397 fix is not that critical but good to have. And finally, the sun6i fix repairs WiFi and BT on a few platforms. Summary: - cmos: revert AltCentury support on AMD/Hygon - mt6397: fix alarm register overwrite - sun6i: ensure clock is working on R40" * tag 'rtc-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: cmos: Revert "rtc: Fix the AltCentury value on AMD/Hygon platform" rtc: mt6397: fix alarm register overwrite rtc: sun6i: Add support for RTC clocks on R40 commit 8f8b69aa501e84a0043428467a5a22b55e937cbd Merge: 24cecc377463 7ecc6c1d5c8d Author: Linus Torvalds Date: Mon Jan 6 10:16:48 2020 -0800 Merge tag 'arc-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: "Kconfig warning, stale define, duplicate asm-offset entry ..." * tag 'arc-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: pt_regs: remove hardcoded registers offset ARC: asm-offsets: remove duplicate entry ARC: mm: drop stale define of __ARCH_USE_5LEVEL_HACK arc: eznps: fix allmodconfig kconfig warning commit 24cecc37746393432d994c0dbc251fb9ac7c5d72 Author: Catalin Marinas Date: Mon Jan 6 14:35:39 2020 +0000 arm64: Revert support for execute-only user mappings The ARMv8 64-bit architecture supports execute-only user permissions by clearing the PTE_USER and PTE_UXN bits, practically making it a mostly privileged mapping but from which user running at EL0 can still execute. The downside, however, is that the kernel at EL1 inadvertently reading such mapping would not trip over the PAN (privileged access never) protection. Revert the relevant bits from commit cab15ce604e5 ("arm64: Introduce execute-only page access permissions") so that PROT_EXEC implies PROT_READ (and therefore PTE_USER) until the architecture gains proper support for execute-only user mappings. Fixes: cab15ce604e5 ("arm64: Introduce execute-only page access permissions") Cc: # 4.9.x- Acked-by: Will Deacon Signed-off-by: Catalin Marinas Signed-off-by: Linus Torvalds commit aa4a63dd981682b1742baa01237036e48bc11923 Author: Stefan Berger Date: Tue Nov 26 08:17:53 2019 -0500 tpm: Revert "tpm_tis_core: Turn on the TPM before probing IRQ's" There has been a bunch of reports (one from kernel bugzilla linked) reporting that when this commit is applied it causes on some machines boot freezes. Unfortunately hardware where this commit causes a failure is not widely available (only one I'm aware is Lenovo T490), which means we cannot predict yet how long it will take to properly fix tpm_tis interrupt probing. Thus, the least worst short term action is to revert the code to the state before this commit. In long term we need fix the tpm_tis probing code to work on machines that Stefan's fix was supposed to fix. Fixes: 21df4a8b6018 ("tpm_tis: reserve chip for duration of tpm_tis_core_init") Link: https://bugzilla.kernel.org/show_bug.cgi?id=205935 Cc: stable@vger.kernel.org Cc: Jerry Snitselaar Cc: Dan Williams Tested-by: Dan Williams Tested-by: Xiaoping Zhou Signed-off-by: Stefan Berger Reported-by: Jerry Snitselaar Signed-off-by: Jarkko Sakkinen commit dda8b2af395b2ed508e2ef314ae32e122841b447 Author: Stefan Berger Date: Tue Nov 26 08:17:52 2019 -0500 tpm: Revert "tpm_tis_core: Set TPM_CHIP_FLAG_IRQ before probing for interrupts" There has been a bunch of reports (one from kernel bugzilla linked) reporting that when this commit is applied it causes on some machines boot freezes. Unfortunately hardware where this commit causes a failure is not widely available (only one I'm aware is Lenovo T490), which means we cannot predict yet how long it will take to properly fix tpm_tis interrupt probing. Thus, the least worst short term action is to revert the code to the state before this commit. In long term we need fix the tpm_tis probing code to work on machines that Stefan's fix was supposed to fix. Link: https://bugzilla.kernel.org/show_bug.cgi?id=205935 Fixes: 1ea32c83c699 ("tpm_tis_core: Set TPM_CHIP_FLAG_IRQ before probing for interrupts") Cc: stable@vger.kernel.org Cc: Jerry Snitselaar Cc: Dan Williams Tested-by: Dan Williams Tested-by: Xiaoping Zhou Signed-off-by: Stefan Berger Reported-by: Jerry Snitselaar Signed-off-by: Jarkko Sakkinen commit 9550f210492c6f88415709002f42a9d15c0e6231 Author: Jarkko Sakkinen Date: Tue Dec 31 01:19:59 2019 +0200 tpm: Revert "tpm_tis: reserve chip for duration of tpm_tis_core_init" Revert a commit, which was included in Linux v5.5-rc3 because it did not properly fix the issues it was supposed to fix. Fixes: 21df4a8b6018 ("tpm_tis: reserve chip for duration of tpm_tis_core_init") Link: https://bugzilla.kernel.org/show_bug.cgi?id=205935 Cc: stable@vger.kernel.org Cc: Jerry Snitselaar Cc: Dan Williams Tested-by: Dan Williams Tested-by: Xiaoping Zhou Signed-off-by: Jarkko Sakkinen commit 850e0a99361b6fd88f8def26f9422a0561654c2f Merge: 8396bdc008fc 5a769f6ff439 Author: Olof Johansson Date: Mon Jan 6 09:20:40 2020 -0800 Merge tag 'tee-optee-fix-for-5.5' of git://git.linaro.org:/people/jens.wiklander/linux-tee into arm/fixes Fix OP-TEE multi page dynamic shm pool alloc * tag 'tee-optee-fix-for-5.5' of git://git.linaro.org:/people/jens.wiklander/linux-tee: optee: Fix multi page dynamic shm pool alloc Link: https://lore.kernel.org/r/20200103103710.GA3469@jax Signed-off-by: Olof Johansson commit 8396bdc008fc70f4826de8a1d6d48f59dfd6d030 Author: Lubomir Rintel Date: Fri Dec 20 08:14:43 2019 +0100 ARM: dts: mmp3: Fix the TWSI ranges The register blocks don't occupy 4K. In fact, some blocks are packed close to others and assuming they're 4K causes overlaps: pxa2xx-i2c d4033800.i2c: can't request region for resource [mem 0xd4033800-0xd40347ff] Link: https://lore.kernel.org/r/20191220071443.247183-1-lkundrak@v3.sk Signed-off-by: Lubomir Rintel Signed-off-by: Olof Johansson commit 8bea5ac0fbc5b2103f8779ddff216122e3c2e1ad Author: Lubomir Rintel Date: Wed Dec 18 20:04:54 2019 +0100 clk: mmp2: Fix the order of timer mux parents Determined empirically, no documentation is available. The OLPC XO-1.75 laptop used parent 1, that one being VCTCXO/4 (65MHz), but thought it's a VCTCXO/2 (130MHz). The mmp2 timer driver, not knowing what is going on, ended up just dividing the rate as of commit f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock")' Link: https://lore.kernel.org/r/20191218190454.420358-3-lkundrak@v3.sk Signed-off-by: Lubomir Rintel Acked-by: Stephen Boyd Signed-off-by: Olof Johansson commit 0bd0f30bbf060891f58866a46083a9931f71787c Author: Lubomir Rintel Date: Wed Dec 18 20:04:53 2019 +0100 ARM: mmp: do not divide the clock rate This was done because the clock driver returned the wrong rate, which is fixed in "clk: mmp2: Fix the order of timer mux parents" patch. Link: https://lore.kernel.org/r/20191218190454.420358-2-lkundrak@v3.sk Signed-off-by: Lubomir Rintel Signed-off-by: Olof Johansson commit fbca72c1542b12495512debf9426426a6687dbde Merge: 51d4efab7865 ff3b57417012 Author: Takashi Iwai Date: Mon Jan 6 17:39:15 2020 +0100 Merge tag 'asoc-fix-v5.5-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.5 More fixes that have been collected, nothing super remarkable here - the few core fixes are mainly error handling related as are many of the driver fixes. commit 2548288b4fb059b2da9ceada172ef763077e8a59 Author: Alan Stern Date: Mon Jan 6 10:43:42 2020 -0500 USB: Fix: Don't skip endpoint descriptors with maxpacket=0 It turns out that even though endpoints with a maxpacket length of 0 aren't useful for data transfer, the descriptors do serve other purposes. In particular, skipping them will also skip over other class-specific descriptors for classes such as UVC. This unexpected side effect has caused some UVC cameras to stop working. In addition, the USB spec requires that when isochronous endpoint descriptors are present in an interface's altsetting 0 (which is true on some devices), the maxpacket size _must_ be set to 0. Warning about such things seems like a bad idea. This patch updates an earlier commit which would log a warning and skip these endpoint descriptors. Now we only log a warning, and we don't even do that for isochronous endpoints in altsetting 0. We don't need to worry about preventing endpoints with maxpacket = 0 from ever being used for data transfers; usb_submit_urb() already checks for this. Reported-and-tested-by: Roger Whittaker Fixes: d482c7bb0541 ("USB: Skip endpoints with 0 maxpacket length") Signed-off-by: Alan Stern CC: Laurent Pinchart Link: https://marc.info/?l=linux-usb&m=157790377329882&w=2 Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2001061040270.1514-100000@iolanthe.rowland.org Signed-off-by: Greg Kroah-Hartman commit 3b722da6672df8392f9c43d7c7e04bddd81d7e37 Author: Stefan Wahren Date: Sat Jan 4 16:13:20 2020 +0100 i2c: bcm2835: Store pointer to bus clock The commit bebff81fb8b9 ("i2c: bcm2835: Model Divider in CCF") introduced a NULL pointer dereference on driver unload. It seems that we can't fetch the bus clock via devm_clk_get in bcm2835_i2c_remove. As an alternative approach store a pointer to the bus clock in the private driver structure. Fixes: bebff81fb8b9 ("i2c: bcm2835: Model Divider in CCF") Signed-off-by: Stefan Wahren Signed-off-by: Wolfram Sang commit 42052d96ae59a702a0b71fafde69fe2cbee23a0e Author: Eugen Hristev Date: Mon Dec 9 10:20:07 2019 +0000 dt-bindings: i2c: at91: fix i2c-sda-hold-time-ns documentation for sam9x60 SAM9X60 also supports i2c-sda-hold-time-ns. Fix the documentation accordingly. Fixes: 2034e3f4c9a5 ("dt-bindings: i2c: at91: add new compatible") Signed-off-by: Eugen Hristev Acked-by: Rob Herring Signed-off-by: Wolfram Sang commit b7169a57982383a81d4227712c894e6ec2516e8c Author: Eugen Hristev Date: Mon Dec 9 10:20:02 2019 +0000 i2c: at91: fix clk_offset for sam9x60 In SAM9X60 datasheet, FLEX_TWI_CWGR register description mentions clock offset of 3 cycles (compared to 4 in eg. SAMA5D3). This is the same offset as in SAMA5D2. Fixes: b00277923743 ("i2c: at91: add new platform support for sam9x60") Suggested-by: Codrin Ciubotariu Signed-off-by: Eugen Hristev Acked-by: Ludovic Desroches Reviewed-by: Codrin Ciubotariu Signed-off-by: Wolfram Sang commit 3433bdf98d8e9dd923118577dc582216a143e60d Author: Robin Murphy Date: Sun Dec 29 17:48:05 2019 +0000 arm64: dts: rockchip: Fix IR on Beelink A1 Apparently I wasn't paying enough attention... And nor is the lazy test of `cat /dev/lirc0` sufficiently blunder-proof. Oh well, with the correct polarity, let's also hook up a keymap now that one for the standard Beelink remote has handily appeared. Fixes: 79702ded8c2f ("arm64: dts: rockchip: Add Beelink A1") Signed-off-by: Robin Murphy Link: https://lore.kernel.org/r/44269c08e2a5d75b03ded87d2eb11621762d8249.1577636223.git.robin.murphy@arm.com Signed-off-by: Heiko Stuebner commit fb46f1b7806977e9135a83eb347e5d82e68233a2 Author: Pablo Neira Ayuso Date: Fri Jan 3 18:10:04 2020 +0100 netfilter: flowtable: add nf_flowtable_time_stamp This patch adds nf_flowtable_time_stamp and updates the existing code to use it. This patch is also implicitly fixing up hardware statistic fetching via nf_flow_offload_stats() where casting to u32 is missing. Use nf_flow_timeout_delta() to fix this. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Pablo Neira Ayuso Acked-by: wenxu commit ad931a2d56e35ff69902f5d7299775e80c35c322 Author: Peter Ujfalusi Date: Thu Nov 14 12:17:18 2019 +0200 clk: ti: dra7-atl: Remove pm_runtime_irq_safe() This is not needed for anything, and prevents proper PM transitions for parent devices which is bad in case of ti-sysc; this effectively kills PM completely. Thus, remove the flag. Suggested-by: Tony Lindgren Signed-off-by: Peter Ujfalusi Link: https://lkml.kernel.org/r/20191114101718.20619-1-peter.ujfalusi@ti.com Reviewed-by: Tony Lindgren Signed-off-by: Stephen Boyd commit d89091a4930ee0d80bee3e259a98513f3a2543ec Author: Stephen Boyd Date: Fri Jan 3 16:19:21 2020 -0800 macb: Don't unregister clks unconditionally The only clk init function in this driver that register a clk is fu540_c000_clk_init(), and thus we need to unregister the clk when this driver is removed on that platform. Other init functions, for example macb_clk_init(), don't register clks and therefore we shouldn't unregister the clks when this driver is removed. Convert this registration path to devm so it gets auto-unregistered when this driver is removed and drop the clk_unregister() calls in driver remove (and error paths) so that we don't erroneously remove a clk from the system that isn't registered by this driver. Otherwise we get strange crashes with a use-after-free when the devm_clk_get() call in macb_clk_init() calls clk_put() on a clk pointer that has become invalid because it is freed in clk_unregister(). Cc: Nicolas Ferre Cc: Yash Shah Reported-by: Guenter Roeck Fixes: c218ad559020 ("macb: Add support for SiFive FU540-C000") Signed-off-by: Stephen Boyd Signed-off-by: David S. Miller commit 15a821f050b243459ee84ca539b9c2af08da3c2c Author: Krzysztof Kozlowski Date: Fri Jan 3 18:25:49 2020 +0100 MAINTAINERS: Drop obsolete entries from Samsung sxgbe ethernet driver The emails to ks.giri@samsung.com and vipul.pandya@samsung.com bounce with 550 error code: host mailin.samsung.com[203.254.224.12] said: 550 5.1.1 Recipient address rejected: User unknown (in reply to RCPT TO command)" Drop Girish K S and Vipul Pandya from sxgbe maintainers entry. Cc: Byungho An Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit ce57785bf91b1ceaef4f4bffed8a47dc0919c8da Author: Carl Huang Date: Fri Jan 3 12:50:16 2020 +0800 net: qrtr: fix len of skb_put_padto in qrtr_node_enqueue The len used for skb_put_padto is wrong, it need to add len of hdr. In qrtr_node_enqueue, local variable size_t len is assign with skb->len, then skb_push(skb, sizeof(*hdr)) will add skb->len with sizeof(*hdr), so local variable size_t len is not same with skb->len after skb_push(skb, sizeof(*hdr)). Then the purpose of skb_put_padto(skb, ALIGN(len, 4)) is to add add pad to the end of the skb's data if skb->len is not aligned to 4, but unfortunately it use len instead of skb->len, at this line, skb->len is 32 bytes(sizeof(*hdr)) more than len, for example, len is 3 bytes, then skb->len is 35 bytes(3 + 32), and ALIGN(len, 4) is 4 bytes, so __skb_put_padto will do nothing after check size(35) < len(4), the correct value should be 36(sizeof(*hdr) + ALIGN(len, 4) = 32 + 4), then __skb_put_padto will pass check size(35) < len(36) and add 1 byte to the end of skb's data, then logic is correct. function of skb_push: void *skb_push(struct sk_buff *skb, unsigned int len) { skb->data -= len; skb->len += len; if (unlikely(skb->data < skb->head)) skb_under_panic(skb, len, __builtin_return_address(0)); return skb->data; } function of skb_put_padto static inline int skb_put_padto(struct sk_buff *skb, unsigned int len) { return __skb_put_padto(skb, len, true); } function of __skb_put_padto static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len, bool free_on_error) { unsigned int size = skb->len; if (unlikely(size < len)) { len -= size; if (__skb_pad(skb, len, free_on_error)) return -ENOMEM; __skb_put(skb, len); } return 0; } Signed-off-by: Carl Huang Signed-off-by: Wen Gong Signed-off-by: David S. Miller commit c79f46a282390e0f5b306007bf7b11a46d529538 Author: Linus Torvalds Date: Sun Jan 5 14:23:27 2020 -0800 Linux 5.5-rc5 commit f11421ba4af706cb4f5703de34fa77fba8472776 Author: Fenghua Yu Date: Thu Jan 2 13:27:06 2020 -0800 drivers/net/b44: Change to non-atomic bit operations on pwol_mask Atomic operations that span cache lines are super-expensive on x86 (not just to the current processor, but also to other processes as all memory operations are blocked until the operation completes). Upcoming x86 processors have a switch to cause such operations to generate a #AC trap. It is expected that some real time systems will enable this mode in BIOS. In preparation for this, it is necessary to fix code that may execute atomic instructions with operands that cross cachelines because the #AC trap will crash the kernel. Since "pwol_mask" is local and never exposed to concurrency, there is no need to set bits in pwol_mask using atomic operations. Directly operate on the byte which contains the bit instead of using __set_bit() to avoid any big endian concern due to type cast to unsigned long in __set_bit(). Suggested-by: Peter Zijlstra Signed-off-by: Fenghua Yu Signed-off-by: Tony Luck Signed-off-by: David S. Miller commit 5e82548e26ef62e257dc2ff37c11acb5eb72728e Author: Georgi Djakov Date: Tue Nov 26 17:34:37 2019 +0200 clk: qcom: gcc-sdm845: Add missing flag to votable GDSCs On sdm845 devices, during boot we see the following warnings (unless we have added 'pd_ignore_unused' to the kernel command line): hlos1_vote_mmnoc_mmu_tbu_sf_gdsc status stuck at 'on' hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc status stuck at 'on' hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc status stuck at 'on' hlos1_vote_aggre_noc_mmu_tbu2_gdsc status stuck at 'on' hlos1_vote_aggre_noc_mmu_tbu1_gdsc status stuck at 'on' hlos1_vote_aggre_noc_mmu_pcie_tbu_gdsc status stuck at 'on' hlos1_vote_aggre_noc_mmu_audio_tbu_gdsc status stuck at 'on' As the name of these GDSCs suggests, they are "votable" and in downstream DT, they all have the property "qcom,no-status-check-on-disable", which means that we should not poll the status bit when we disable them. Luckily the VOTABLE flag already exists and it does exactly what we need, so let's make use of it to make the warnings disappear. Fixes: 06391eddb60a ("clk: qcom: Add Global Clock controller (GCC) driver for SDM845") Reported-by: Rob Clark Signed-off-by: Georgi Djakov Link: https://lkml.kernel.org/r/20191126153437.11808-1-georgi.djakov@linaro.org Tested-by: Rob Clark Signed-off-by: Stephen Boyd commit 768fc661d12559b0dbd99d941b3bf28fe92fd365 Merge: 36487907f341 0e194d9da198 Author: Linus Torvalds Date: Sun Jan 5 11:15:31 2020 -0800 Merge tag 'riscv/for-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "Several fixes for RISC-V: - Fix function graph trace support - Prefix the CSR IRQ_* macro names with "RV_", to avoid collisions with macros elsewhere in the Linux kernel tree named "IRQ_TIMER" - Use __pa_symbol() when computing the physical address of a kernel symbol, rather than __pa() - Mark the RISC-V port as supporting GCOV One DT addition: - Describe the L2 cache controller in the FU540 DT file One documentation update: - Add patch acceptance guideline documentation" * tag 'riscv/for-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: Documentation: riscv: add patch acceptance guidelines riscv: prefix IRQ_ macro names with an RV_ namespace clocksource: riscv: add notrace to riscv_sched_clock riscv: ftrace: correct the condition logic in function graph tracer riscv: dts: Add DT support for SiFive L2 cache controller riscv: gcov: enable gcov for RISC-V riscv: mm: use __pa_symbol for kernel symbols commit 5acab91458ceae0e4b15205fda5437631089f7ee Author: Pablo Neira Ayuso Date: Fri Jan 3 14:36:07 2020 +0100 netfilter: nf_tables: unbind callbacks from flowtable destroy path Callback unbinding needs to be done after nf_flow_table_free(), otherwise entries are not removed from the hardware. Update nft_unregister_flowtable_net_hooks() to call nf_unregister_net_hook() instead since the commit/abort paths do not deal with the callback unbinding anymore. Add a comment to nft_flowtable_event() to clarify that flow_offload_netdev_event() already removes the entries before the callback unbinding. Fixes: 8bb69f3b2918 ("netfilter: nf_tables: add flowtable offload control plane") Fixes ff4bf2f42a40 ("netfilter: nf_tables: add nft_unregister_flowtable_hook()") Signed-off-by: Pablo Neira Ayuso Acked-by: wenxu commit 73327d47d2c04214f23217b982a004c22a493c78 Author: wenxu Date: Fri Dec 20 12:14:38 2019 +0800 netfilter: nf_flow_table_offload: fix the nat port mangle. Shift on 32-bit word to define the port number depends on the flow direction. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Fixes: 7acd9378dc652 ("netfilter: nf_flow_table_offload: Correct memcpy size for flow_overload_mangle()") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit f31ad71c44c17e55d9a6fa24f8249a15365cf8b2 Author: wenxu Date: Fri Dec 20 12:14:37 2019 +0800 netfilter: nf_flow_table_offload: check the status of dst_neigh It is better to get the dst_neigh with neigh->lock and check the nud_state is VALID. If there is not neigh previous, the lookup will Create a non NUD_VALID with 00:00:00:00:00:00 mac. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit 1b67e50601fabc9589022e6b5e79fd8596c2338e Author: wenxu Date: Fri Dec 20 12:14:36 2019 +0800 netfilter: nf_flow_table_offload: fix incorrect ethernet dst address Ethernet destination for original traffic takes the source ethernet address in the reply direction. For reply traffic, this takes the source ethernet address of the original direction. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit 8ca79606cdfde2e37ee4f0707b9d1874a6f0eb38 Author: wenxu Date: Fri Dec 20 17:08:46 2019 +0800 netfilter: nft_flow_offload: fix underflow in flowtable reference counter The .deactivate and .activate interfaces already deal with the reference counter. Otherwise, this results in spurious "Device is busy" errors. Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit 0e194d9da198936fe4fb4c1e031de0f7791c09b8 Author: Paul Walmsley Date: Fri Nov 22 18:33:28 2019 -0800 Documentation: riscv: add patch acceptance guidelines Formalize, in kernel documentation, the patch acceptance policy for arch/riscv. In summary, it states that as maintainers, we plan to only accept patches for new modules or extensions that have been frozen or ratified by the RISC-V Foundation. We've been following these guidelines for the past few months. In the meantime, we've received quite a bit of feedback that it would be helpful to have these guidelines formally documented. Based on a suggestion from Matthew Wilcox, we also add a link to this file to Documentation/process/index.rst, to make this document easier to find. The format of this document has also been changed to align to the format outlined in the maintainer entry profiles, in accordance with comments from Jon Corbet and Dan Williams. Signed-off-by: Paul Walmsley Reviewed-by: Palmer Dabbelt Cc: Palmer Dabbelt Cc: Albert Ou Cc: Krste Asanovic Cc: Andrew Waterman Cc: Matthew Wilcox Cc: Dan Williams Cc: Jonathan Corbet commit 2f3035da4019780250658d1ffe486bc324e04805 Author: Paul Walmsley Date: Fri Dec 20 03:09:49 2019 -0800 riscv: prefix IRQ_ macro names with an RV_ namespace "IRQ_TIMER", used in the arch/riscv CSR header file, is a sufficiently generic macro name that it's used by several source files across the Linux code base. Some of these other files ultimately include the arch/riscv CSR include file, causing collisions. Fix by prefixing the RISC-V csr.h IRQ_ macro names with an RV_ prefix. Fixes: a4c3733d32a72 ("riscv: abstract out CSR names for supervisor vs machine mode") Reported-by: Olof Johansson Acked-by: Olof Johansson Signed-off-by: Paul Walmsley commit 9d05c18e8d7de566ff68f221fcae65e78708dd1d Author: Zong Li Date: Mon Dec 23 16:46:14 2019 +0800 clocksource: riscv: add notrace to riscv_sched_clock When enabling ftrace graph tracer, it gets the tracing clock in ftrace_push_return_trace(). Eventually, it invokes riscv_sched_clock() to get the clock value. If riscv_sched_clock() isn't marked with 'notrace', it will call ftrace_push_return_trace() and cause infinite loop. The result of failure as follow: command: echo function_graph >current_tracer [ 46.176787] Unable to handle kernel paging request at virtual address ffffffe04fb38c48 [ 46.177309] Oops [#1] [ 46.177478] Modules linked in: [ 46.177770] CPU: 0 PID: 256 Comm: $d Not tainted 5.5.0-rc1 #47 [ 46.177981] epc: ffffffe00035e59a ra : ffffffe00035e57e sp : ffffffe03a7569b0 [ 46.178216] gp : ffffffe000d29b90 tp : ffffffe03a756180 t0 : ffffffe03a756968 [ 46.178430] t1 : ffffffe00087f408 t2 : ffffffe03a7569a0 s0 : ffffffe03a7569f0 [ 46.178643] s1 : ffffffe00087f408 a0 : 0000000ac054cda4 a1 : 000000000087f411 [ 46.178856] a2 : 0000000ac054cda4 a3 : 0000000000373ca0 a4 : ffffffe04fb38c48 [ 46.179099] a5 : 00000000153e22a8 a6 : 00000000005522ff a7 : 0000000000000005 [ 46.179338] s2 : ffffffe03a756a90 s3 : ffffffe00032811c s4 : ffffffe03a756a58 [ 46.179570] s5 : ffffffe000d29fe0 s6 : 0000000000000001 s7 : 0000000000000003 [ 46.179809] s8 : 0000000000000003 s9 : 0000000000000002 s10: 0000000000000004 [ 46.180053] s11: 0000000000000000 t3 : 0000003fc815749c t4 : 00000000000efc90 [ 46.180293] t5 : ffffffe000d29658 t6 : 0000000000040000 [ 46.180482] status: 0000000000000100 badaddr: ffffffe04fb38c48 cause: 000000000000000f Signed-off-by: Zong Li Reviewed-by: Steven Rostedt (VMware) [paul.walmsley@sifive.com: cleaned up patch description] Fixes: 92e0d143fdef ("clocksource/drivers/riscv_timer: Provide the sched_clock") Cc: stable@vger.kernel.org Signed-off-by: Paul Walmsley commit 36487907f34131c7e3df5b1e6b30b4e3dfcdc0af Merge: a125bcda2d0a 7312b7069925 Author: Linus Torvalds Date: Sat Jan 4 19:38:51 2020 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "17 fixes" * emailed patches from Andrew Morton : hexagon: define ioremap_uc ocfs2: fix the crash due to call ocfs2_get_dlm_debug once less ocfs2: call journal flush to mark journal as empty after journal recovery when mount mm/hugetlb: defer freeing of huge pages if in non-task context mm/gup: fix memory leak in __gup_benchmark_ioctl mm/oom: fix pgtables units mismatch in Killed process message fs/posix_acl.c: fix kernel-doc warnings hexagon: work around compiler crash hexagon: parenthesize registers in asm predicates fs/namespace.c: make to_mnt_ns() static fs/nsfs.c: include headers for missing declarations fs/direct-io.c: include fs/internal.h for missing prototype mm: move_pages: return valid node id in status if the page is already on the target node memcg: account security cred as well to kmemcg kcov: fix struct layout for kcov_remote_arg mm/zsmalloc.c: fix the migrated zspage statistics. mm/memory_hotplug: shrink zones when offlining memory commit a125bcda2d0aee1d98b51c167aca60fb312572aa Merge: c420ddda506b 8c62ed27a12c Author: Linus Torvalds Date: Sat Jan 4 19:28:30 2020 -0800 Merge tag 'apparmor-pr-2020-01-04' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor fixes from John Johansen: - performance regression: only get a label reference if the fast path check fails - fix aa_xattrs_match() may sleep while holding a RCU lock - fix bind mounts aborting with -ENOMEM * tag 'apparmor-pr-2020-01-04' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock apparmor: only get a label reference if the fast path check fails apparmor: fix bind mounts aborting with -ENOMEM commit 57415790f405534e5578d0106d806630c325dcb3 Author: Jens Axboe Date: Fri Jan 3 21:09:35 2020 -0700 block: remove unused mp_bvec_last_segment After commit 85a8ce62c2ea ("block: add bio_truncate to fix guard_bio_eod") this function is unused, remove it. Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 8c62ed27a12c00e3db1c9f04bc0f272bdbb06734 Author: John Johansen Date: Thu Jan 2 05:31:22 2020 -0800 apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock aa_xattrs_match() is unfortunately calling vfs_getxattr_alloc() from a context protected by an rcu_read_lock. This can not be done as vfs_getxattr_alloc() may sleep regardles of the gfp_t value being passed to it. Fix this by breaking the rcu_read_lock on the policy search when the xattr match feature is requested and restarting the search if a policy changes occur. Fixes: 8e51f9087f40 ("apparmor: Add support for attaching profiles via xattr, presence and value") Reported-by: Jia-Ju Bai Reported-by: Al Viro Signed-off-by: John Johansen commit c420ddda506b80ec2686e405698d37fafeea3b7a Merge: 5613970af3f5 bbcc5672b006 Author: Linus Torvalds Date: Sat Jan 4 14:16:57 2020 -0800 Merge tag 'mips_fixes_5.5_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Paul Burton: "A collection of MIPS fixes: - Fill the struct cacheinfo shared_cpu_map field with sensible values, notably avoiding issues with perf which was unhappy in the absence of these values. - A boot fix for Loongson 2E & 2F machines which was fallout from some refactoring performed this cycle. - A Kconfig dependency fix for the Loongson CPU HWMon driver. - A couple of VDSO fixes, ensuring gettimeofday() behaves appropriately for kernel configurations that don't include support for a clocksource the VDSO can use & fixing the calling convention for the n32 & n64 VDSOs which would previously clobber the $gp/$28 register. - A build fix for vmlinuz compressed images which were inappropriately building with -fsanitize-coverage despite not being part of the kernel proper, then failing to link due to the missing __sanitizer_cov_trace_pc() function. - A couple of eBPF JIT fixes, including disabling it for MIPS32 due to a large number of issues with the code generated there & reflecting ISA dependencies in Kconfig to enforce that systems which don't support the JIT must include the interpreter" * tag 'mips_fixes_5.5_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Avoid VDSO ABI breakage due to global register variable MIPS: BPF: eBPF JIT: check for MIPS ISA compliance in Kconfig MIPS: BPF: Disable MIPS32 eBPF JIT MIPS: Prevent link failure with kcov instrumentation MIPS: Kconfig: Use correct form for 'depends on' mips: Fix gettimeofday() in the vdso library MIPS: Fix boot on Fuloong2 systems mips: cacheinfo: report shared CPU map commit 7312b70699252074d753c5005fc67266c547bbe3 Author: Nick Desaulniers Date: Sat Jan 4 13:00:26 2020 -0800 hexagon: define ioremap_uc Similar to commit 38e45d81d14e ("sparc64: implement ioremap_uc") define ioremap_uc for hexagon to avoid errors from -Wimplicit-function-definition. Link: http://lkml.kernel.org/r/20191209222956.239798-2-ndesaulniers@google.com Link: https://github.com/ClangBuiltLinux/linux/issues/797 Fixes: e537654b7039 ("lib: devres: add a helper function for ioremap_uc") Signed-off-by: Nick Desaulniers Suggested-by: Nathan Chancellor Acked-by: Brian Cain Cc: Lee Jones Cc: Andy Shevchenko Cc: Tuowen Zhao Cc: Mika Westerberg Cc: Luis Chamberlain Cc: Greg Kroah-Hartman Cc: Alexios Zavras Cc: Allison Randal Cc: Will Deacon Cc: Richard Fontana Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Boqun Feng Cc: Ingo Molnar Cc: Geert Uytterhoeven Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b73eba2a867e10b9b4477738677341f3307c07bb Author: Gang He Date: Sat Jan 4 13:00:22 2020 -0800 ocfs2: fix the crash due to call ocfs2_get_dlm_debug once less Because ocfs2_get_dlm_debug() function is called once less here, ocfs2 file system will trigger the system crash, usually after ocfs2 file system is unmounted. This system crash is caused by a generic memory corruption, these crash backtraces are not always the same, for exapmle, ocfs2: Unmounting device (253,16) on (node 172167785) general protection fault: 0000 [#1] SMP PTI CPU: 3 PID: 14107 Comm: fence_legacy Kdump: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:__kmalloc+0xa5/0x2a0 Code: 00 00 4d 8b 07 65 4d 8b RSP: 0018:ffffaa1fc094bbe8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: d310a8800d7a3faf RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000dc0 RDI: ffff96e68fc036c0 RBP: d310a8800d7a3faf R08: ffff96e6ffdb10a0 R09: 00000000752e7079 R10: 000000000001c513 R11: 0000000004091041 R12: 0000000000000dc0 R13: 0000000000000039 R14: ffff96e68fc036c0 R15: ffff96e68fc036c0 FS: 00007f699dfba540(0000) GS:ffff96e6ffd80000(0000) knlGS:00000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f3a9d9b768 CR3: 000000002cd1c000 CR4: 00000000000006e0 Call Trace: ext4_htree_store_dirent+0x35/0x100 [ext4] htree_dirblock_to_tree+0xea/0x290 [ext4] ext4_htree_fill_tree+0x1c1/0x2d0 [ext4] ext4_readdir+0x67c/0x9d0 [ext4] iterate_dir+0x8d/0x1a0 __x64_sys_getdents+0xab/0x130 do_syscall_64+0x60/0x1f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f699d33a9fb This regression problem was introduced by commit e581595ea29c ("ocfs: no need to check return value of debugfs_create functions"). Link: http://lkml.kernel.org/r/20191225061501.13587-1-ghe@suse.com Fixes: e581595ea29c ("ocfs: no need to check return value of debugfs_create functions") Signed-off-by: Gang He Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: [5.3+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 397eac17f86f404f5ba31d8c3e39ec3124b39fd3 Author: Kai Li Date: Sat Jan 4 13:00:18 2020 -0800 ocfs2: call journal flush to mark journal as empty after journal recovery when mount If journal is dirty when mount, it will be replayed but jbd2 sb log tail cannot be updated to mark a new start because journal->j_flag has already been set with JBD2_ABORT first in journal_init_common. When a new transaction is committed, it will be recored in block 1 first(journal->j_tail is set to 1 in journal_reset). If emergency restart happens again before journal super block is updated unfortunately, the new recorded trans will not be replayed in the next mount. The following steps describe this procedure in detail. 1. mount and touch some files 2. these transactions are committed to journal area but not checkpointed 3. emergency restart 4. mount again and its journals are replayed 5. journal super block's first s_start is 1, but its s_seq is not updated 6. touch a new file and its trans is committed but not checkpointed 7. emergency restart again 8. mount and journal is dirty, but trans committed in 6 will not be replayed. This exception happens easily when this lun is used by only one node. If it is used by multi-nodes, other node will replay its journal and its journal super block will be updated after recovery like what this patch does. ocfs2_recover_node->ocfs2_replay_journal. The following jbd2 journal can be generated by touching a new file after journal is replayed, and seq 15 is the first valid commit, but first seq is 13 in journal super block. logdump: Block 0: Journal Superblock Seq: 0 Type: 4 (JBD2_SUPERBLOCK_V2) Blocksize: 4096 Total Blocks: 32768 First Block: 1 First Commit ID: 13 Start Log Blknum: 1 Error: 0 Feature Compat: 0 Feature Incompat: 2 block64 Feature RO compat: 0 Journal UUID: 4ED3822C54294467A4F8E87D2BA4BC36 FS Share Cnt: 1 Dynamic Superblk Blknum: 0 Per Txn Block Limit Journal: 0 Data: 0 Block 1: Journal Commit Block Seq: 14 Type: 2 (JBD2_COMMIT_BLOCK) Block 2: Journal Descriptor Seq: 15 Type: 1 (JBD2_DESCRIPTOR_BLOCK) No. Blocknum Flags 0. 587 none UUID: 00000000000000000000000000000000 1. 8257792 JBD2_FLAG_SAME_UUID 2. 619 JBD2_FLAG_SAME_UUID 3. 24772864 JBD2_FLAG_SAME_UUID 4. 8257802 JBD2_FLAG_SAME_UUID 5. 513 JBD2_FLAG_SAME_UUID JBD2_FLAG_LAST_TAG ... Block 7: Inode Inode: 8257802 Mode: 0640 Generation: 57157641 (0x3682809) FS Generation: 2839773110 (0xa9437fb6) CRC32: 00000000 ECC: 0000 Type: Regular Attr: 0x0 Flags: Valid Dynamic Features: (0x1) InlineData User: 0 (root) Group: 0 (root) Size: 7 Links: 1 Clusters: 0 ctime: 0x5de5d870 0x11104c61 -- Tue Dec 3 11:37:20.286280801 2019 atime: 0x5de5d870 0x113181a1 -- Tue Dec 3 11:37:20.288457121 2019 mtime: 0x5de5d870 0x11104c61 -- Tue Dec 3 11:37:20.286280801 2019 dtime: 0x0 -- Thu Jan 1 08:00:00 1970 ... Block 9: Journal Commit Block Seq: 15 Type: 2 (JBD2_COMMIT_BLOCK) The following is journal recovery log when recovering the upper jbd2 journal when mount again. syslog: ocfs2: File system on device (252,1) was not unmounted cleanly, recovering it. fs/jbd2/recovery.c:(do_one_pass, 449): Starting recovery pass 0 fs/jbd2/recovery.c:(do_one_pass, 449): Starting recovery pass 1 fs/jbd2/recovery.c:(do_one_pass, 449): Starting recovery pass 2 fs/jbd2/recovery.c:(jbd2_journal_recover, 278): JBD2: recovery, exit status 0, recovered transactions 13 to 13 Due to first commit seq 13 recorded in journal super is not consistent with the value recorded in block 1(seq is 14), journal recovery will be terminated before seq 15 even though it is an unbroken commit, inode 8257802 is a new file and it will be lost. Link: http://lkml.kernel.org/r/20191217020140.2197-1-li.kai4@h3c.com Signed-off-by: Kai Li Reviewed-by: Joseph Qi Reviewed-by: Changwei Ge Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c77c0a8ac4c522638a8242fcb9de9496e3cdbb2d Author: Waiman Long Date: Sat Jan 4 13:00:15 2020 -0800 mm/hugetlb: defer freeing of huge pages if in non-task context The following lockdep splat was observed when a certain hugetlbfs test was run: ================================ WARNING: inconsistent lock state 4.18.0-159.el8.x86_64+debug #1 Tainted: G W --------- - - -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. swapper/30/0 [HC0[0]:SC1[1]:HE1:SE0] takes: ffffffff9acdc038 (hugetlb_lock){+.?.}, at: free_huge_page+0x36f/0xaa0 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x14f/0x3b0 _raw_spin_lock+0x30/0x70 __nr_hugepages_store_common+0x11b/0xb30 hugetlb_sysctl_handler_common+0x209/0x2d0 proc_sys_call_handler+0x37f/0x450 vfs_write+0x157/0x460 ksys_write+0xb8/0x170 do_syscall_64+0xa5/0x4d0 entry_SYSCALL_64_after_hwframe+0x6a/0xdf irq event stamp: 691296 hardirqs last enabled at (691296): [] _raw_spin_unlock_irqrestore+0x4b/0x60 hardirqs last disabled at (691295): [] _raw_spin_lock_irqsave+0x22/0x81 softirqs last enabled at (691284): [] irq_enter+0xc3/0xe0 softirqs last disabled at (691285): [] irq_exit+0x23e/0x2b0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(hugetlb_lock); lock(hugetlb_lock); *** DEADLOCK *** : Call Trace: __lock_acquire+0x146b/0x48c0 lock_acquire+0x14f/0x3b0 _raw_spin_lock+0x30/0x70 free_huge_page+0x36f/0xaa0 bio_check_pages_dirty+0x2fc/0x5c0 clone_endio+0x17f/0x670 [dm_mod] blk_update_request+0x276/0xe50 scsi_end_request+0x7b/0x6a0 scsi_io_completion+0x1c6/0x1570 blk_done_softirq+0x22e/0x350 __do_softirq+0x23d/0xad8 irq_exit+0x23e/0x2b0 do_IRQ+0x11a/0x200 common_interrupt+0xf/0xf Both the hugetbl_lock and the subpool lock can be acquired in free_huge_page(). One way to solve the problem is to make both locks irq-safe. However, Mike Kravetz had learned that the hugetlb_lock is held for a linear scan of ALL hugetlb pages during a cgroup reparentling operation. So it is just too long to have irq disabled unless we can break hugetbl_lock down into finer-grained locks with shorter lock hold times. Another alternative is to defer the freeing to a workqueue job. This patch implements the deferred freeing by adding a free_hpage_workfn() work function to do the actual freeing. The free_huge_page() call in a non-task context saves the page to be freed in the hpage_freelist linked list in a lockless manner using the llist APIs. The generic workqueue is used to process the work, but a dedicated workqueue can be used instead if it is desirable to have the huge page freed ASAP. Thanks to Kirill Tkhai for suggesting the use of llist APIs which simplfy the code. Link: http://lkml.kernel.org/r/20191217170331.30893-1-longman@redhat.com Signed-off-by: Waiman Long Reviewed-by: Mike Kravetz Acked-by: Davidlohr Bueso Acked-by: Michal Hocko Reviewed-by: Kirill Tkhai Cc: Aneesh Kumar K.V Cc: Matthew Wilcox Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a7c46c0c0e3d62f2764cd08b90934cd2aaaf8545 Author: Navid Emamdoost Date: Sat Jan 4 13:00:12 2020 -0800 mm/gup: fix memory leak in __gup_benchmark_ioctl In the implementation of __gup_benchmark_ioctl() the allocated pages should be released before returning in case of an invalid cmd. Release pages via kvfree(). [akpm@linux-foundation.org: rework code flow, return -EINVAL rather than -1] Link: http://lkml.kernel.org/r/20191211174653.4102-1-navid.emamdoost@gmail.com Fixes: 714a3a1ebafe ("mm/gup_benchmark.c: add additional pinning methods") Signed-off-by: Navid Emamdoost Reviewed-by: Andrew Morton Reviewed-by: Ira Weiny Reviewed-by: John Hubbard Cc: Keith Busch Cc: Kirill A. Shutemov Cc: Dave Hansen Cc: Dan Williams Cc: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 941f762bcb276259a78e7931674668874ccbda59 Author: Ilya Dryomov Date: Sat Jan 4 13:00:09 2020 -0800 mm/oom: fix pgtables units mismatch in Killed process message pr_err() expects kB, but mm_pgtables_bytes() returns the number of bytes. As everything else is printed in kB, I chose to fix the value rather than the string. Before: [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name ... [ 1878] 1000 1878 217253 151144 1269760 0 0 python ... Out of memory: Killed process 1878 (python) total-vm:869012kB, anon-rss:604572kB, file-rss:4kB, shmem-rss:0kB, UID:1000 pgtables:1269760kB oom_score_adj:0 After: [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name ... [ 1436] 1000 1436 217253 151890 1294336 0 0 python ... Out of memory: Killed process 1436 (python) total-vm:869012kB, anon-rss:607516kB, file-rss:44kB, shmem-rss:0kB, UID:1000 pgtables:1264kB oom_score_adj:0 Link: http://lkml.kernel.org/r/20191211202830.1600-1-idryomov@gmail.com Fixes: 70cb6d267790 ("mm/oom: add oom_score_adj and pgtables to Killed process message") Signed-off-by: Ilya Dryomov Reviewed-by: Andrew Morton Acked-by: David Rientjes Acked-by: Michal Hocko Cc: Edward Chron Cc: David Rientjes Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e39e773ad100ac94f8358d862f20101e802ae54c Author: Randy Dunlap Date: Sat Jan 4 13:00:05 2020 -0800 fs/posix_acl.c: fix kernel-doc warnings Fix kernel-doc warnings in fs/posix_acl.c. Also fix one typo (setgit -> setgid). fs/posix_acl.c:647: warning: Function parameter or member 'inode' not described in 'posix_acl_update_mode' fs/posix_acl.c:647: warning: Function parameter or member 'mode_p' not described in 'posix_acl_update_mode' fs/posix_acl.c:647: warning: Function parameter or member 'acl' not described in 'posix_acl_update_mode' Link: http://lkml.kernel.org/r/29b0dc46-1f28-a4e5-b1d0-ba2b65629779@infradead.org Fixes: 073931017b49d ("posix_acl: Clear SGID bit when setting file permissions") Signed-off-by: Randy Dunlap Acked-by: Andreas Gruenbacher Reviewed-by: Jan Kara Cc: Jan Kara Cc: Andreas Gruenbacher Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 63e80314ab7cf4783526d2e44ee57a90514911c9 Author: Nick Desaulniers Date: Sat Jan 4 13:00:02 2020 -0800 hexagon: work around compiler crash Clang cannot translate the string "r30" into a valid register yet. Link: https://github.com/ClangBuiltLinux/linux/issues/755 Link: http://lkml.kernel.org/r/20191028155722.23419-1-ndesaulniers@google.com Signed-off-by: Nick Desaulniers Suggested-by: Sid Manning Reviewed-by: Brian Cain Cc: Allison Randal Cc: Greg Kroah-Hartman Cc: Richard Fontana Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 780a0cfda9006a9a22d6473c2d4c527f5c68eb2e Author: Nick Desaulniers Date: Sat Jan 4 12:59:59 2020 -0800 hexagon: parenthesize registers in asm predicates Hexagon requires that register predicates in assembly be parenthesized. Link: https://github.com/ClangBuiltLinux/linux/issues/754 Link: http://lkml.kernel.org/r/20191209222956.239798-3-ndesaulniers@google.com Signed-off-by: Nick Desaulniers Suggested-by: Sid Manning Acked-by: Brian Cain Cc: Lee Jones Cc: Andy Shevchenko Cc: Tuowen Zhao Cc: Mika Westerberg Cc: Luis Chamberlain Cc: Greg Kroah-Hartman Cc: Alexios Zavras Cc: Allison Randal Cc: Will Deacon Cc: Richard Fontana Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Boqun Feng Cc: Ingo Molnar Cc: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 213921f967cf44a7bceaee5535ff1d0196885076 Author: Eric Biggers Date: Sat Jan 4 12:59:55 2020 -0800 fs/namespace.c: make to_mnt_ns() static Make to_mnt_ns() static to address the following 'sparse' warning: fs/namespace.c:1731:22: warning: symbol 'to_mnt_ns' was not declared. Should it be static? Link: http://lkml.kernel.org/r/20191209234830.156260-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7bebd69ecf10787e6b9559ab780496f54943cc21 Author: Eric Biggers Date: Sat Jan 4 12:59:52 2020 -0800 fs/nsfs.c: include headers for missing declarations Include linux/proc_fs.h and fs/internal.h to address the following 'sparse' warnings: fs/nsfs.c:41:32: warning: symbol 'ns_dentry_operations' was not declared. Should it be static? fs/nsfs.c:145:5: warning: symbol 'open_related_ns' was not declared. Should it be static? Link: http://lkml.kernel.org/r/20191209234822.156179-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b16155a0b01ae999add72b2ad2791b9c66285880 Author: Eric Biggers Date: Sat Jan 4 12:59:49 2020 -0800 fs/direct-io.c: include fs/internal.h for missing prototype Include fs/internal.h to address the following 'sparse' warning: fs/direct-io.c:591:5: warning: symbol 'sb_init_dio_done_wq' was not declared. Should it be static? Link: http://lkml.kernel.org/r/20191209234544.128302-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Reviewed-by: Jan Kara Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e0153fc2c7606f101392b682e720a7a456d6c766 Author: Yang Shi Date: Sat Jan 4 12:59:46 2020 -0800 mm: move_pages: return valid node id in status if the page is already on the target node Felix Abecassis reports move_pages() would return random status if the pages are already on the target node by the below test program: int main(void) { const long node_id = 1; const long page_size = sysconf(_SC_PAGESIZE); const int64_t num_pages = 8; unsigned long nodemask = 1 << node_id; long ret = set_mempolicy(MPOL_BIND, &nodemask, sizeof(nodemask)); if (ret < 0) return (EXIT_FAILURE); void **pages = malloc(sizeof(void*) * num_pages); for (int i = 0; i < num_pages; ++i) { pages[i] = mmap(NULL, page_size, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_POPULATE | MAP_ANONYMOUS, -1, 0); if (pages[i] == MAP_FAILED) return (EXIT_FAILURE); } ret = set_mempolicy(MPOL_DEFAULT, NULL, 0); if (ret < 0) return (EXIT_FAILURE); int *nodes = malloc(sizeof(int) * num_pages); int *status = malloc(sizeof(int) * num_pages); for (int i = 0; i < num_pages; ++i) { nodes[i] = node_id; status[i] = 0xd0; /* simulate garbage values */ } ret = move_pages(0, num_pages, pages, nodes, status, MPOL_MF_MOVE); printf("move_pages: %ld\n", ret); for (int i = 0; i < num_pages; ++i) printf("status[%d] = %d\n", i, status[i]); } Then running the program would return nonsense status values: $ ./move_pages_bug move_pages: 0 status[0] = 208 status[1] = 208 status[2] = 208 status[3] = 208 status[4] = 208 status[5] = 208 status[6] = 208 status[7] = 208 This is because the status is not set if the page is already on the target node, but move_pages() should return valid status as long as it succeeds. The valid status may be errno or node id. We can't simply initialize status array to zero since the pages may be not on node 0. Fix it by updating status with node id which the page is already on. Link: http://lkml.kernel.org/r/1575584353-125392-1-git-send-email-yang.shi@linux.alibaba.com Fixes: a49bd4d71637 ("mm, numa: rework do_pages_move") Signed-off-by: Yang Shi Reported-by: Felix Abecassis Tested-by: Felix Abecassis Suggested-by: Michal Hocko Reviewed-by: John Hubbard Acked-by: Christoph Lameter Acked-by: Michal Hocko Reviewed-by: Vlastimil Babka Cc: Mel Gorman Cc: [4.17+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 84029fd04c201a4c7e0b07ba262664900f47c6f5 Author: Shakeel Butt Date: Sat Jan 4 12:59:43 2020 -0800 memcg: account security cred as well to kmemcg The cred_jar kmem_cache is already memcg accounted in the current kernel but cred->security is not. Account cred->security to kmemcg. Recently we saw high root slab usage on our production and on further inspection, we found a buggy application leaking processes. Though that buggy application was contained within its memcg but we observe much more system memory overhead, couple of GiBs, during that period. This overhead can adversely impact the isolation on the system. One source of high overhead we found was cred->security objects, which have a lifetime of at least the life of the process which allocated them. Link: http://lkml.kernel.org/r/20191205223721.40034-1-shakeelb@google.com Signed-off-by: Shakeel Butt Acked-by: Chris Down Reviewed-by: Roman Gushchin Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a69b83e1ae7f6c5ff2cc310870c1708405d86be2 Author: Andrey Konovalov Date: Sat Jan 4 12:59:39 2020 -0800 kcov: fix struct layout for kcov_remote_arg Make the layout of kcov_remote_arg the same for 32-bit and 64-bit code. This makes it more convenient to write userspace apps that can be compiled into 32-bit or 64-bit binaries and still work with the same 64-bit kernel. Also use proper __u32 types in uapi headers instead of unsigned ints. Link: http://lkml.kernel.org/r/9e91020876029cfefc9211ff747685eba9536426.1575638983.git.andreyknvl@google.com Fixes: eec028c9386ed1a ("kcov: remote coverage support") Signed-off-by: Andrey Konovalov Acked-by: Marco Elver Cc: Greg Kroah-Hartman Cc: Alan Stern Cc: Felipe Balbi Cc: Chunfeng Yun Cc: "Jacky . Cao @ sony . com" Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Marco Elver Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ac8f05da5174c560de122c499ce5dfb5d0dfbee5 Author: Chanho Min Date: Sat Jan 4 12:59:36 2020 -0800 mm/zsmalloc.c: fix the migrated zspage statistics. When zspage is migrated to the other zone, the zone page state should be updated as well, otherwise the NR_ZSPAGE for each zone shows wrong counts including proc/zoneinfo in practice. Link: http://lkml.kernel.org/r/1575434841-48009-1-git-send-email-chanho.min@lge.com Fixes: 91537fee0013 ("mm: add NR_ZSMALLOC to vmstat") Signed-off-by: Chanho Min Signed-off-by: Jinsuk Choi Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: [4.9+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit feee6b2989165631b17ac6d4ccdbf6759254e85a Author: David Hildenbrand Date: Sat Jan 4 12:59:33 2020 -0800 mm/memory_hotplug: shrink zones when offlining memory We currently try to shrink a single zone when removing memory. We use the zone of the first page of the memory we are removing. If that memmap was never initialized (e.g., memory was never onlined), we will read garbage and can trigger kernel BUGs (due to a stale pointer): BUG: unable to handle page fault for address: 000000000000353d #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 7 Comm: kworker/u8:0 Not tainted 5.3.0-rc5-next-20190820+ #317 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.4 Workqueue: kacpi_hotplug acpi_hotplug_work_fn RIP: 0010:clear_zone_contiguous+0x5/0x10 Code: 48 89 c6 48 89 c3 e8 2a fe ff ff 48 85 c0 75 cf 5b 5d c3 c6 85 fd 05 00 00 01 5b 5d c3 0f 1f 840 RSP: 0018:ffffad2400043c98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000200000000 RCX: 0000000000000000 RDX: 0000000000200000 RSI: 0000000000140000 RDI: 0000000000002f40 RBP: 0000000140000000 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000140000 R13: 0000000000140000 R14: 0000000000002f40 R15: ffff9e3e7aff3680 FS: 0000000000000000(0000) GS:ffff9e3e7bb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000353d CR3: 0000000058610000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __remove_pages+0x4b/0x640 arch_remove_memory+0x63/0x8d try_remove_memory+0xdb/0x130 __remove_memory+0xa/0x11 acpi_memory_device_remove+0x70/0x100 acpi_bus_trim+0x55/0x90 acpi_device_hotplug+0x227/0x3a0 acpi_hotplug_work_fn+0x1a/0x30 process_one_work+0x221/0x550 worker_thread+0x50/0x3b0 kthread+0x105/0x140 ret_from_fork+0x3a/0x50 Modules linked in: CR2: 000000000000353d Instead, shrink the zones when offlining memory or when onlining failed. Introduce and use remove_pfn_range_from_zone(() for that. We now properly shrink the zones, even if we have DIMMs whereby - Some memory blocks fall into no zone (never onlined) - Some memory blocks fall into multiple zones (offlined+re-onlined) - Multiple memory blocks that fall into different zones Drop the zone parameter (with a potential dubious value) from __remove_pages() and __remove_section(). Link: http://lkml.kernel.org/r/20191006085646.5768-6-david@redhat.com Fixes: f1dd2cd13c4b ("mm, memory_hotplug: do not associate hotadded memory to zones until online") [visible after d0dc12e86b319] Signed-off-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Michal Hocko Cc: "Matthew Wilcox (Oracle)" Cc: "Aneesh Kumar K.V" Cc: Pavel Tatashin Cc: Greg Kroah-Hartman Cc: Dan Williams Cc: Logan Gunthorpe Cc: [5.0+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5613970af3f5f8372c596b138bd64f3918513515 Merge: 50978df311d8 b0b5ce1010ff Author: Linus Torvalds Date: Sat Jan 4 10:49:15 2020 -0800 Merge tag 'dmaengine-fix-5.5-rc5' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "A bunch of fixes for: - uninitialized dma_slave_caps access - virt-dma use after free in vchan_complete() - driver fixes for ioat, k3dma and jz4780" * tag 'dmaengine-fix-5.5-rc5' of git://git.infradead.org/users/vkoul/slave-dma: ioat: ioat_alloc_ring() failure handling. dmaengine: virt-dma: Fix access after free in vchan_complete() dmaengine: k3dma: Avoid null pointer traversal dmaengine: dma-jz4780: Also break descriptor chains on JZ4725B dmaengine: Fix access to uninitialized dma_slave_caps commit 50978df311d85ebf7e6c46e02745315e1ce63d32 Merge: 3a562aee727a ce644cf3fa06 Author: Linus Torvalds Date: Sat Jan 4 10:41:08 2020 -0800 Merge tag 'media/v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - some fixes at CEC core to comply with HDMI 2.0 specs and fix some border cases - a fix at the transmission logic of the pulse8-cec driver - one alignment fix on a data struct at ipu3 when built with 32 bits * tag 'media/v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: intel-ipu3: Align struct ipu3_uapi_awb_fr_config_s to 32 bytes media: pulse8-cec: fix lost cec_transmit_attempt_done() call media: cec: check 'transmit_in_progress', not 'transmitting' media: cec: avoid decrementing transmit_queue_sz if it is 0 media: cec: CEC 2.0-only bcast messages were ignored commit 51d4efab7865e6ea6a4ebcd25b3f03c019515c4c Author: Takashi Iwai Date: Sat Jan 4 12:09:36 2020 +0100 ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5 Bose Companion 5 (with USB ID 05a7:1020) doesn't seem supporting reading back the sample rate, so the existing quirk is needed. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206063 Cc: Link: https://lore.kernel.org/r/20200104110936.14288-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 6d9ffcff646bbd0ede6c2a59f4cd28414ecec6e0 Author: Kailang Yang Date: Fri Jan 3 16:24:06 2020 +0800 ALSA: hda/realtek - Add new codec supported for ALCS1200A Add ALCS1200A supported. It was similar as ALC900. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/a9bd3cdaa02d4fa197623448d5c51e50@realtek.com Signed-off-by: Takashi Iwai commit f01f4ffdfb703694035870f94b10f6ef2523f8de Author: Alexandre Belloni Date: Sat Jan 4 05:31:10 2020 +0100 rtc: cmos: Revert "rtc: Fix the AltCentury value on AMD/Hygon platform" There are multiple reports of this patch breaking RTC time setting for AMD platforms. This reverts commit 7ad295d5196a58c22abecef62dd4f99e2f86e831. Cc: Jinke Fan Link: https://lore.kernel.org/r/CABXGCsMLob0DC25JS8wwAYydnDoHBSoMh2_YLPfqm3TTvDE-Zw@mail.gmail.com Fixes: 7ad295d5196a ("rtc: Fix the AltCentury value on AMD/Hygon platform") Link: https://lore.kernel.org/r/20200104043110.707810-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 8bee8084ba03d59004103502c3002bb5c05a129f Merge: fd6988496e79 ee8598ae527e Author: Linus Walleij Date: Sat Jan 4 00:13:24 2020 +0100 Merge tag 'gpio-fixes-for-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes gpio fixes for v5.5-rc5 - fix coding style issues introduced in gpio-mockup during merge window commit c4e4fccc5d52d881afaac11d3353265ef4eccb8b Author: Wayne Lin Date: Fri Jan 3 13:50:01 2020 +0800 drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ [Why] According to DP spec, it should shift left 4 digits for NO_STOP_BIT in REMOTE_I2C_READ message. Not 5 digits. In current code, NO_STOP_BIT is always set to zero which means I2C master is always generating a I2C stop at the end of each I2C write transaction while handling REMOTE_I2C_READ sideband message. This issue might have the generated I2C signal not meeting the requirement. Take random read in I2C for instance, I2C master should generate a repeat start to start to read data after writing the read address. This issue will cause the I2C master to generate a stop-start rather than a re-start which is not expected in I2C random read. [How] Correct the shifting value of NO_STOP_BIT for DP_REMOTE_I2C_READ case in drm_dp_encode_sideband_req(). Changes since v1:(https://patchwork.kernel.org/patch/11312667/) * Add more descriptions in commit and cc to stable Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") Reviewed-by: Harry Wentland Signed-off-by: Wayne Lin Cc: stable@vger.kernel.org Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20200103055001.10287-1-Wayne.Lin@amd.com commit b2ff0d510182eb5cc05a65d1b2371af62c4b170c Author: Kaike Wan Date: Thu Dec 19 18:19:20 2019 -0500 IB/hfi1: Adjust flow PSN with the correct resync_psn When a TID RDMA ACK to RESYNC request is received, the flow PSNs for pending TID RDMA WRITE segments will be adjusted with the next flow generation number, based on the resync_psn value extracted from the flow PSN of the TID RDMA ACK packet. The resync_psn value indicates the last flow PSN for which a TID RDMA WRITE DATA packet has been received by the responder and the requester should resend TID RDMA WRITE DATA packets, starting from the next flow PSN. However, if resync_psn points to the last flow PSN for a segment and the next segment flow PSN starts with a new generation number, use of the old resync_psn to adjust the flow PSN for the next segment will lead to miscalculation, resulting in WARN_ON and sge rewinding errors: WARNING: CPU: 4 PID: 146961 at /nfs/site/home/phcvs2/gitrepo/ifs-all/components/Drivers/tmp/rpmbuild/BUILD/ifs-kernel-updates-3.10.0_957.el7.x86_64/hfi1/tid_rdma.c:4764 hfi1_rc_rcv_tid_rdma_ack+0x8f6/0xa90 [hfi1] Modules linked in: ib_ipoib(OE) hfi1(OE) rdmavt(OE) rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfsv3 nfs_acl nfs lockd grace fscache iTCO_wdt iTCO_vendor_support skx_edac intel_powerclamp coretemp intel_rapl iosf_mbi kvm irqbypass crc32_pclmul ghash_clmulni_intel ib_isert iscsi_target_mod target_core_mod aesni_intel lrw gf128mul glue_helper ablk_helper cryptd rpcrdma sunrpc opa_vnic ast ttm ib_iser libiscsi drm_kms_helper scsi_transport_iscsi ipmi_ssif syscopyarea sysfillrect sysimgblt fb_sys_fops drm joydev ipmi_si pcspkr sg drm_panel_orientation_quirks ipmi_devintf lpc_ich i2c_i801 ipmi_msghandler wmi rdma_ucm ib_ucm ib_uverbs acpi_cpufreq acpi_power_meter ib_umad rdma_cm ib_cm iw_cm ip_tables ext4 mbcache jbd2 sd_mod crc_t10dif crct10dif_generic crct10dif_pclmul i2c_algo_bit crct10dif_common crc32c_intel e1000e ib_core ahci libahci ptp libata pps_core nfit libnvdimm [last unloaded: rdmavt] CPU: 4 PID: 146961 Comm: kworker/4:0H Kdump: loaded Tainted: G W OE ------------ 3.10.0-957.el7.x86_64 #1 Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.0X.02.0117.040420182310 04/04/2018 Workqueue: hfi0_0 _hfi1_do_tid_send [hfi1] Call Trace: [] dump_stack+0x19/0x1b [] __warn+0xd8/0x100 [] warn_slowpath_null+0x1d/0x20 [] hfi1_rc_rcv_tid_rdma_ack+0x8f6/0xa90 [hfi1] [] hfi1_kdeth_eager_rcv+0x1dc/0x210 [hfi1] [] ? hfi1_kdeth_expected_rcv+0x1ef/0x210 [hfi1] [] kdeth_process_eager+0x35/0x90 [hfi1] [] handle_receive_interrupt_nodma_rtail+0x17a/0x2b0 [hfi1] [] receive_context_interrupt+0x23/0x40 [hfi1] [] __handle_irq_event_percpu+0x44/0x1c0 [] handle_irq_event_percpu+0x32/0x80 [] handle_irq_event+0x3c/0x60 [] handle_edge_irq+0x7f/0x150 [] handle_irq+0xe4/0x1a0 [] do_IRQ+0x4d/0xf0 [] common_interrupt+0x162/0x162 [] ? swiotlb_map_page+0x49/0x150 [] hfi1_verbs_send_dma+0x291/0xb70 [hfi1] [] ? hfi1_wait_kmem+0xf0/0xf0 [hfi1] [] hfi1_verbs_send+0x126/0x2b0 [hfi1] [] _hfi1_do_tid_send+0x1d3/0x320 [hfi1] [] process_one_work+0x17f/0x440 [] worker_thread+0x126/0x3c0 [] ? manage_workers.isra.25+0x2a0/0x2a0 [] kthread+0xd1/0xe0 [] ? insert_kthread_work+0x40/0x40 [] ret_from_fork_nospec_begin+0x7/0x21 [] ? insert_kthread_work+0x40/0x40 This patch fixes the issue by adjusting the resync_psn first if the flow generation has been advanced for a pending segment. Fixes: 9e93e967f7b4 ("IB/hfi1: Add a function to receive TID RDMA ACK packet") Link: https://lore.kernel.org/r/20191219231920.51069.37147.stgit@awfm-01.aw.intel.com Cc: Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit ca9033ba69c7e3477f207df69867b2ea969197c8 Author: Kaike Wan Date: Thu Dec 19 16:19:41 2019 -0500 IB/hfi1: Don't cancel unused work item In the iowait structure, two iowait_work entries were included to queue a given object: one for normal IB operations, and the other for TID RDMA operations. For non-TID RDMA operations, the iowait_work structure for TID RDMA is initialized to contain a NULL function (not used). When the QP is reset, the function iowait_cancel_work will be called to cancel any pending work. The problem is that this function will call cancel_work_sync() for both iowait_work entries, even though the one for TID RDMA is not used at all. Eventually, the call cascades to __flush_work(), wherein a WARN_ON will be triggered due to the fact that work->func is NULL. The WARN_ON was introduced in commit 4d43d395fed1 ("workqueue: Try to catch flush_work() without INIT_WORK().") This patch fixes the issue by making sure that a work function is present for TID RDMA before calling cancel_work_sync in iowait_cancel_work. Fixes: 4d43d395fed1 ("workqueue: Try to catch flush_work() without INIT_WORK().") Fixes: 5da0fc9dbf89 ("IB/hfi1: Prepare resource waits for dual leg") Link: https://lore.kernel.org/r/20191219211941.58387.39883.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit b54ef37b1ce892fdf6b632d566246d2f2f539910 Author: Liran Alon Date: Fri Jan 3 18:44:59 2020 +0200 net: Google gve: Remove dma_wmb() before ringing doorbell Current code use dma_wmb() to ensure Rx/Tx descriptors are visible to device before writing to doorbell. However, these dma_wmb() are wrong and unnecessary. Therefore, they should be removed. iowrite32be() called from gve_rx_write_doorbell()/gve_tx_put_doorbell() should guaratee that all previous writes to WB/UC memory is visible to device before the write done by iowrite32be(). E.g. On ARM64, iowrite32be() calls __iowmb() which expands to dma_wmb() and only then calls __raw_writel(). Reviewed-by: Si-Wei Liu Signed-off-by: Liran Alon Signed-off-by: David S. Miller commit eed70fd9452fe0fcd1a221731a4333b51a8081f2 Author: Russell King Date: Fri Jan 3 15:13:56 2020 +0000 net: phylink: fix failure to register on x86 systems The kernel test robot reports a boot failure with qemu in 5.5-rc, referencing commit 2203cbf2c8b5 ("net: sfp: move fwnode parsing into sfp-bus layer"). This is caused by phylink_create() being passed a NULL fwnode, causing fwnode_property_get_reference_args() to return -EINVAL. Don't attempt to attach to a SFP bus if we have no fwnode, which avoids this issue. Reported-by: kernel test robot Fixes: 2203cbf2c8b5 ("net: sfp: move fwnode parsing into sfp-bus layer") Signed-off-by: Russell King Reviewed-by: Florian Fainelli Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit e64b274c95e8b59a74f9398b48422cdcab70dd86 Author: Jesper Dangaard Brouer Date: Fri Jan 3 13:36:22 2020 +0100 doc/net: Update git https URLs in netdev-FAQ documentation DaveM's git tree have been moved into a named subdir 'netdev' to deal with allowing Jakub Kicinski to help co-maintain the trees. Link: https://www.kernel.org/doc/html/latest/networking/netdev-FAQ.html Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit cc7e3f63d7299dd1119be39aa187b867d6f8aa17 Author: Hangbin Liu Date: Fri Jan 3 15:41:24 2020 +0800 selftests: loopback.sh: skip this test if the driver does not support The loopback feature is only supported on a few drivers like broadcom, mellanox, etc. The default veth driver has not supported it yet. To avoid returning failed and making the runner feel confused, let's just skip the test on drivers that not support loopback. Fixes: ad11340994d5 ("selftests: Add loopback test") Signed-off-by: Hangbin Liu Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 72879ee0c53e2fc17f443f7b1adcc0d5130cd934 Author: Colin Ian King Date: Sat Dec 21 15:48:25 2019 +0000 tracing: Fix indentation issue There is a declaration that is indented one level too deeply, remove the extraneous tab. Link: http://lkml.kernel.org/r/20191221154825.33073-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Steven Rostedt (VMware) commit 3a562aee727a7bfbb3a37b1aa934118397dad701 Merge: b6b4aafc99d7 de7999afedff Author: Linus Torvalds Date: Fri Jan 3 12:20:21 2020 -0800 Merge tag 'for-5.5-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few fixes for btrfs: - blkcg accounting problem with compression that could stall writes - setting up blkcg bio for compression crashes due to NULL bdev pointer - fix possible infinite loop in writeback for nocow files (here possible means almost impossible, 13 things that need to happen to trigger it)" * tag 'for-5.5-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Btrfs: fix infinite loop during nocow writeback due to race btrfs: fix compressed write bio blkcg attribution btrfs: punt all bios created in btrfs_submit_compressed_write() commit b6b4aafc99d7c8dbf7d9429bf054b591daab1ad0 Merge: bed723519a72 c7d776f85dfe Author: Linus Torvalds Date: Fri Jan 3 12:11:30 2020 -0800 Merge tag 'block-5.5-20200103' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Three fixes in here: - Fix for a missing split on default memory boundary mask (4G) (Ming) - Fix for multi-page read bio truncate (Ming) - Fix for null_blk zone close request handling (Damien)" * tag 'block-5.5-20200103' of git://git.kernel.dk/linux-block: null_blk: Fix REQ_OP_ZONE_CLOSE handling block: fix splitting segments on boundary masks block: add bio_truncate to fix guard_bio_eod commit c5275723580922e5f3264f96751337661a153c7d Author: Selvin Xavier Date: Mon Nov 25 00:39:30 2019 -0800 RDMA/bnxt_re: Fix Send Work Entry state check while polling completions Some adapters need a fence Work Entry to handle retransmission. Currently the driver checks for this condition, only if the Send queue entry is signalled. Implement the condition check, irrespective of the signalled state of the Work queue entries Failure to add the fence can result in access to memory that is already marked as completed, triggering data corruption, transmission failure, IOMMU failures, etc. Fixes: 9152e0b722b2 ("RDMA/bnxt_re: HW workarounds for handling specific conditions") Link: https://lore.kernel.org/r/1574671174-5064-3-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit bed723519a72c0f68fbfaf68ed5bf55d04e46566 Merge: d9c82fd8c897 8ffdc54b6f4c Author: Linus Torvalds Date: Fri Jan 3 11:21:25 2020 -0800 Merge tag 'kbuild-fixes-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - fix build error in usr/gen_initramfs_list.sh - fix libelf-dev dependency in deb-pkg build * tag 'kbuild-fixes-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild/deb-pkg: annotate libelf-dev dependency as :native gen_initramfs_list.sh: fix 'bad variable name' error commit 9a4467a6b282a299b932608ac2c9034f8415359f Author: Selvin Xavier Date: Mon Nov 25 00:39:29 2019 -0800 RDMA/bnxt_re: Avoid freeing MR resources if dereg fails The driver returns an error code for MR dereg, but frees the MR structure. When the MR dereg is retried due to previous error, the system crashes as the structure is already freed. BUG: unable to handle kernel NULL pointer dereference at 00000000000001b8 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 7 PID: 12178 Comm: ib_send_bw Kdump: loaded Not tainted 4.18.0-124.el8.x86_64 #1 Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 1.1.10 03/10/2015 RIP: 0010:__dev_printk+0x2a/0x70 Code: 0f 1f 44 00 00 49 89 d1 48 85 f6 0f 84 f6 2b 00 00 4c 8b 46 70 4d 85 c0 75 04 4c 8b 46 10 48 8b 86 a8 00 00 00 48 85 c0 74 16 <48> 8b 08 0f be 7f 01 48 c7 c2 13 ac ac 83 83 ef 30 e9 10 fe ff ff RSP: 0018:ffffaf7c04607a60 EFLAGS: 00010006 RAX: 00000000000001b8 RBX: ffffa0010c91c488 RCX: 0000000000000246 RDX: ffffaf7c04607a68 RSI: ffffa0010c91caa8 RDI: ffffffff83a788eb RBP: ffffaf7c04607ac8 R08: 0000000000000000 R09: ffffaf7c04607a68 R10: 0000000000000000 R11: 0000000000000001 R12: ffffaf7c04607b90 R13: 000000000000000e R14: 0000000000000000 R15: 00000000ffffa001 FS: 0000146fa1f1cdc0(0000) GS:ffffa0012fac0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001b8 CR3: 000000007680a003 CR4: 00000000001606e0 Call Trace: dev_err+0x6c/0x90 ? dev_printk_emit+0x4e/0x70 bnxt_qplib_rcfw_send_message+0x594/0x660 [bnxt_re] ? dev_err+0x6c/0x90 bnxt_qplib_free_mrw+0x80/0xe0 [bnxt_re] bnxt_re_dereg_mr+0x2e/0xd0 [bnxt_re] ib_dereg_mr+0x2f/0x50 [ib_core] destroy_hw_idr_uobject+0x20/0x70 [ib_uverbs] uverbs_destroy_uobject+0x2e/0x170 [ib_uverbs] __uverbs_cleanup_ufile+0x6e/0x90 [ib_uverbs] uverbs_destroy_ufile_hw+0x61/0x130 [ib_uverbs] ib_uverbs_close+0x1f/0x80 [ib_uverbs] __fput+0xb7/0x230 task_work_run+0x8a/0xb0 do_exit+0x2da/0xb40 ... RIP: 0033:0x146fa113a387 Code: Bad RIP value. RSP: 002b:00007fff945d1478 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff02 RAX: 0000000000000000 RBX: 000055a248908d70 RCX: 0000000000000000 RDX: 0000146fa1f2b000 RSI: 0000000000000001 RDI: 000055a248906488 RBP: 000055a248909630 R08: 0000000000010000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 000055a248906488 R13: 0000000000000001 R14: 0000000000000000 R15: 000055a2489095f0 Do not free the MR structures, when driver returns error to the stack. Fixes: 872f3578241d ("RDMA/bnxt_re: Add support for MRs with Huge pages") Link: https://lore.kernel.org/r/1574671174-5064-2-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit d9c82fd8c89766f2cf1e667f663e8e8c25c12aee Merge: 6f2e9c3d2816 43cf75d96409 Author: Linus Torvalds Date: Fri Jan 3 11:17:14 2020 -0800 Merge tag 'for-linus-2020-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull thread fixes from Christian Brauner: "Here are two fixes: - Panic earlier when global init exits to generate useable coredumps. Currently, when global init and all threads in its thread-group have exited we panic via: do_exit() -> exit_notify() -> forget_original_parent() -> find_child_reaper() This makes it hard to extract a useable coredump for global init from a kernel crashdump because by the time we panic exit_mm() will have already released global init's mm. We now panic slightly earlier. This has been a problem in certain environments such as Android. - Fix a race in assigning and reading taskstats for thread-groups with more than one thread. This patch has been waiting for quite a while since people disagreed on what the correct fix was at first" * tag 'for-linus-2020-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: exit: panic before exit_mm() on global init exit taskstats: fix data-race commit 6f2e9c3d28167b0f27d4be68e9101a9ecf397878 Merge: e35d0165908a 6da3eced8c5f Author: Linus Torvalds Date: Fri Jan 3 11:13:50 2020 -0800 Merge tag 'powerpc-5.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Two more powerpc fixes for 5.5: - One commit to fix a build error when CONFIG_JUMP_LABEL=n, introduced by our recent fix to is_shared_processor(). - A commit marking some SLB related functions as notrace, as tracing them triggers warnings. Thanks to Jason A Donenfeld" * tag 'powerpc-5.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/spinlocks: Include correct header for static key powerpc/mm: Mark get_slice_psize() & slice_addr_is_low() as notrace commit e35d0165908ad2d2bdb76773ef77b551763eedbd Merge: ca78fdeb00fa 48e01504cf53 Author: Linus Torvalds Date: Fri Jan 3 11:10:31 2020 -0800 Merge tag 'sound-5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Nothing to worry at this stage but all nice small changes: - A regression fix for AMD GPU detection in HD-audio - A long-standing sleep-in-atomic fix for an ice1724 device - Usual suspects, the device-specific quirks for HD- and USB-audio" * tag 'sound-5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker ALSA: hda - Apply sync-write workaround to old Intel platforms, too ALSA: hda/hdmi - fix atpx_present when CLASS is not VGA ALSA: usb-audio: fix set_format altsetting sanity check ALSA: hda/realtek - Add headset Mic no shutup for ALC283 ALSA: usb-audio: set the interface format after resume on Dell WD19 commit ca78fdeb00fa656f09afee977750e85da929d259 Merge: 15f0ec941f4f a6204fc7b83c Author: Linus Torvalds Date: Fri Jan 3 11:08:30 2020 -0800 Merge tag 'drm-fixes-2020-01-03' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "New Years fixes! Mostly amdgpu with a light smattering of arm graphics, and two AGP warning fixes. Quiet as expected, hopefully we don't get a post holiday rush. agp: - two unused variable removed amdgpu: - ATPX regression fix - SMU metrics table locking fixes - gfxoff fix for raven - RLC firmware loading stability fix mediatek: - external display fix - dsi timing fix sun4i: - Fix double-free in connector/encoder cleanup (Stefan) maildp: - Make vtable static (Ben)" * tag 'drm-fixes-2020-01-03' of git://anongit.freedesktop.org/drm/drm: agp: remove unused variable arqsz in agp_3_5_enable() agp: remove unused variable mcapndx drm/amdgpu: correct RLC firmwares loading sequence drm/amdgpu: enable gfxoff for raven1 refresh drm/amdgpu/smu: add metrics table lock for vega20 (v2) drm/amdgpu/smu: add metrics table lock for navi (v2) drm/amdgpu/smu: add metrics table lock for arcturus (v2) drm/amdgpu/smu: add metrics table lock Revert "drm/amdgpu: simplify ATPX detection" drm/arm/mali: make malidp_mw_connector_helper_funcs static drm/sun4i: hdmi: Remove duplicate cleanup calls drm/mediatek: reduce the hbp and hfp for phy timing drm/mediatek: Fix can't get component for external display plane. drm/mediatek: Check return value of mtk_drm_ddp_comp_for_plane. commit 15f0ec941f4f908fefa23a30ded8358977cc1cc0 Author: Jan Stancek Date: Fri Jan 3 18:37:18 2020 +0100 mm/hugetlbfs: fix for_each_hstate() loop in init_hugetlbfs_fs() LTP memfd_create04 started failing for some huge page sizes after v5.4-10135-gc3bfc5dd73c6. The problem is the check introduced to for_each_hstate() loop that should skip default_hstate_idx. Since it doesn't update 'i' counter, all subsequent huge page sizes are skipped as well. Fixes: 8fc312b32b25 ("mm/hugetlbfs: fix error handling when setting up mounts") Signed-off-by: Jan Stancek Reviewed-by: Mike Kravetz Signed-off-by: Linus Torvalds commit 50f9ad607ea891a9308e67b81f774c71736d1098 Author: Kaitao Cheng Date: Tue Dec 31 05:35:30 2019 -0800 kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable@vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng Signed-off-by: Steven Rostedt (VMware) commit ee8598ae527ea0408e440c073e0945fc37488fe6 Author: Bartosz Golaszewski Date: Mon Dec 16 17:37:10 2019 +0100 gpio: mockup: fix coding style I have missed two indentation issues in commit 64e7112ee307 ("gpio: mockup: add set_config to support pull up/down"). This commit fixes them. Fixes: 64e7112ee307 ("gpio: mockup: add set_config to support pull up/down") Signed-off-by: Bartosz Golaszewski commit bf44f488e168368cae4139b4b33c3d0aaa11679c Author: Joel Fernandes (Google) Date: Thu Jan 2 14:46:25 2020 -0500 tracing: Change offset type to s32 in preempt/irq tracepoints Discussion in the below link reported that symbols in modules can appear to be before _stext on ARM architecture, causing wrapping with the offsets of this tracepoint. Change the offset type to s32 to fix this. Link: http://lore.kernel.org/r/20191127154428.191095-1-antonio.borneo@st.com Link: http://lkml.kernel.org/r/20200102194625.226436-1-joel@joelfernandes.org Cc: Bjorn Helgaas Cc: David Sterba Cc: Ingo Molnar Cc: Mike Rapoport Cc: "Rafael J. Wysocki" Cc: Sakari Ailus Cc: Antonio Borneo Cc: stable@vger.kernel.org Fixes: d59158162e032 ("tracing: Add support for preempt and irq enable/disable events") Signed-off-by: Joel Fernandes (Google) Signed-off-by: Steven Rostedt (VMware) commit 8ffdc54b6f4cd718a45802e645bb853e3a46a078 Author: Ard Biesheuvel Date: Mon Dec 30 15:07:47 2019 +0100 kbuild/deb-pkg: annotate libelf-dev dependency as :native Cross compiling the x86 kernel on a non-x86 build machine produces the following error when CONFIG_UNWINDER_ORC is enabled, regardless of whether libelf-dev is installed or not. dpkg-checkbuilddeps: error: Unmet build dependencies: libelf-dev dpkg-buildpackage: warning: build dependencies/conflicts unsatisfied; aborting dpkg-buildpackage: warning: (Use -d flag to override.) Since this is a build time dependency for a build tool, we need to depend on the native version of libelf-dev so add the appropriate annotation. Signed-off-by: Ard Biesheuvel Signed-off-by: Masahiro Yamada commit cc976614f59bd8e45de8ce988a6bcb5de711d994 Author: Masahiro Yamada Date: Mon Dec 30 22:20:06 2019 +0900 gen_initramfs_list.sh: fix 'bad variable name' error Prior to commit 858805b336be ("kbuild: add $(BASH) to run scripts with bash-extension"), this shell script was almost always run by bash since bash is usually installed on the system by default. Now, this script is run by sh, which might be a symlink to dash. On such distributions, the following code emits an error: local dev=`LC_ALL=C ls -l "${location}"` You can reproduce the build error, for example by setting CONFIG_INITRAMFS_SOURCE="/dev". GEN usr/initramfs_data.cpio.gz ./usr/gen_initramfs_list.sh: 131: local: 1: bad variable name make[1]: *** [usr/Makefile:61: usr/initramfs_data.cpio.gz] Error 2 This is because `LC_ALL=C ls -l "${location}"` contains spaces. Surrounding it with double-quotes fixes the error. Fixes: 858805b336be ("kbuild: add $(BASH) to run scripts with bash-extension") Reported-by: Jory A. Pratt Signed-off-by: Masahiro Yamada commit ce644cf3fa06504c2c71ab1b794160d54aaccbc0 Author: Sakari Ailus Date: Wed Nov 6 12:57:07 2019 +0100 media: intel-ipu3: Align struct ipu3_uapi_awb_fr_config_s to 32 bytes A struct that needs to be aligned to 32 bytes has a size of 28. Increase the size to 32. This makes elements of arrays of this struct aligned to 32 as well, and other structs where members are aligned to 32 mixing ipu3_uapi_awb_fr_config_s as well as other types. Fixes: commit dca5ef2aa1e6 ("media: staging/intel-ipu3: remove the unnecessary compiler flags") Signed-off-by: Sakari Ailus Tested-by: Bingbu Cao Signed-off-by: Mauro Carvalho Chehab commit 58dcc5bf4030cab548d5c98cd4cd3632a5444d5a Author: Michael Straube Date: Sat Dec 28 15:37:25 2019 +0100 staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21 This device was added to the stand-alone driver on github. Add it to the staging driver as well. Link: https://github.com/lwfinger/rtl8188eu/commit/b9b537aa25a8 Signed-off-by: Michael Straube Cc: stable Link: https://lore.kernel.org/r/20191228143725.24455-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit a9d3a9cedc1330c720e0ddde1978a8e7771da5ab Author: Ian Abbott Date: Fri Dec 27 17:00:54 2019 +0000 staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713 The Advantech PCI-1713 has 32 analog input channels, but an incorrect bit-mask in the definition of the `PCI171X_MUX_CHANH(x)` and PCI171X_MUX_CHANL(x)` macros is causing channels 16 to 31 to be aliases of channels 0 to 15. Change the bit-mask value from 0xf to 0xff to fix it. Note that the channel numbers will have been range checked already, so the bit-mask isn't really needed. Fixes: 92c65e5553ed ("staging: comedi: adv_pci1710: define the mux control register bits") Reported-by: Dmytro Fil Cc: # v4.5+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20191227170054.32051-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit c0bcf9f3f5b661d4ace2a64a79ef661edd2a4dc8 Author: Malcolm Priestley Date: Fri Dec 20 21:15:59 2019 +0000 staging: vt6656: set usb_set_intfdata on driver fail. intfdata will contain stale pointer when the device is detached after failed initialization when referenced in vt6656_disconnect Provide driver access to it here and NULL it. Cc: stable Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/6de448d7-d833-ef2e-dd7b-3ef9992fee0e@gmail.com Signed-off-by: Greg Kroah-Hartman commit 07f59f180ee083c48c32a1e69ae1d0091444d212 Author: Malcolm Priestley Date: Fri Dec 20 21:15:33 2019 +0000 staging: vt6656: remove bool from vnt_radio_power_on ret The driver uses logical only error checking a bool true would flag error. Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/cc52b67c-9ef8-3e57-815a-44d10701919e@gmail.com Signed-off-by: Greg Kroah-Hartman commit 69cc1f925e1aa74b96e2ace67e3453a50d091d2f Author: Malcolm Priestley Date: Fri Dec 20 21:15:24 2019 +0000 staging: vt6656: limit reg output to block size vnt_control_out appears to fail when BBREG is greater than 64 writes. Create new function that will relay an array in no larger than the indicated block size. It appears that this command has always failed but was ignored by driver until the introduction of error checking. Cc: stable # v5.3+ Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/a41f0601-df46-ce6e-ab7c-35e697946e2a@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7de6155c8968a3342d1bef3f7a2084d31ae6e4be Author: Malcolm Priestley Date: Fri Dec 20 21:15:09 2019 +0000 staging: vt6656: correct return of vnt_init_registers. The driver standard error returns remove bool false conditions. Cc: stable # v5.3+ Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/072ec0b3-425f-277e-130c-1e3a116c90d6@gmail.com Signed-off-by: Greg Kroah-Hartman commit 58c3e681b04dd57c70d0dcb7b69fe52d043ff75a Author: Malcolm Priestley Date: Fri Dec 20 21:14:59 2019 +0000 staging: vt6656: Fix non zero logical return of, usb_control_msg Starting with commit 59608cb1de1856 ("staging: vt6656: clean function's error path in usbpipe.c") the usb control functions have returned errors throughout driver with only logical variable checking. However, usb_control_msg return the amount of bytes transferred this means that normal operation causes errors. Correct the return function so only return zero when transfer is successful. Cc: stable # v5.3+ Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/08e88842-6f78-a2e3-a7a0-139fec960b2b@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5a769f6ff439cedc547395a6dc78faa26108f741 Author: Sumit Garg Date: Mon Dec 30 18:52:40 2019 +0530 optee: Fix multi page dynamic shm pool alloc optee_shm_register() expected pages to be passed as an array of page pointers rather than as an array of contiguous pages. So fix that via correctly passing pages as per expectation. Fixes: a249dd200d03 ("tee: optee: Fix dynamic shm pool allocations") Reported-by: Vincent Cao Signed-off-by: Sumit Garg Tested-by: Vincent Cao Signed-off-by: Jens Wiklander commit 1d8f65798240b6577d8c44d20c8ea8f1d429e495 Author: Zong Li Date: Mon Dec 23 16:46:13 2019 +0800 riscv: ftrace: correct the condition logic in function graph tracer The condition should be logical NOT to assign the hook address to parent address. Because the return value 0 of function_graph_enter upon success. Fixes: e949b6db51dc (riscv/function_graph: Simplify with function_graph_enter()) Signed-off-by: Zong Li Reviewed-by: Steven Rostedt (VMware) Cc: stable@vger.kernel.org Signed-off-by: Paul Walmsley commit cfda8617e22a8bf217a613d0b3ba3a38778443ba Author: Yash Shah Date: Fri Jan 3 09:43:20 2020 +0530 riscv: dts: Add DT support for SiFive L2 cache controller Add the L2 cache controller DT node in SiFive FU540 soc-specific DT file Signed-off-by: Yash Shah Reviewed-by: Palmer Dabbelt Signed-off-by: Paul Walmsley commit 0da310e82d3a9bff6ef6b0f2fbf45d1a05cc64fe Author: Zong Li Date: Thu Jan 2 11:09:54 2020 +0800 riscv: gcov: enable gcov for RISC-V This patch enables GCOV code coverage measurement on RISC-V. Lightly tested on QEMU and Hifive Unleashed board, seems to work as expected. Signed-off-by: Zong Li Reviewed-by: Anup Patel Acked-by: Jonathan Corbet Signed-off-by: Paul Walmsley commit ac51e005fe1456a288929a41d71adc6224e912d2 Author: Zong Li Date: Thu Jan 2 11:12:40 2020 +0800 riscv: mm: use __pa_symbol for kernel symbols __pa_symbol is the marcro that should be used for kernel symbols. It is also a pre-requisite for DEBUG_VIRTUAL which will do bounds checking. Signed-off-by: Zong Li Reviewed-by: Anup Patel Signed-off-by: Paul Walmsley commit a6204fc7b83cbe3398f61cf1742b09f66f0ae220 Author: Yunfeng Ye Date: Tue Dec 17 20:22:57 2019 +0800 agp: remove unused variable arqsz in agp_3_5_enable() This patch fix the following warning: drivers/char/agp/isoch.c: In function ‘agp_3_5_enable’: drivers/char/agp/isoch.c:322:13: warning: variable ‘arqsz’ set but not used [-Wunused-but-set-variable] u32 isoch, arqsz; ^~~~~ Signed-off-by: Yunfeng Ye Signed-off-by: Dave Airlie commit 2fec966f593efd076ad1e56d274611cea7d29eec Author: Yunfeng Ye Date: Tue Dec 17 20:21:37 2019 +0800 agp: remove unused variable mcapndx This patch fix the following warning: drivers/char/agp/isoch.c: In function ‘agp_3_5_isochronous_node_enable’: drivers/char/agp/isoch.c:87:5: warning: variable ‘mcapndx’ set but not used [-Wunused-but-set-variable] u8 mcapndx; ^~~~~~~ Signed-off-by: Yunfeng Ye Signed-off-by: Dave Airlie commit e31f7939c1c27faa5d0e3f14519eaf7c89e8a69d Author: Wen Yang Date: Fri Jan 3 11:02:48 2020 +0800 ftrace: Avoid potential division by zero in function profiler The ftrace_profile->counter is unsigned long and do_div truncates it to 32 bits, which means it can test non-zero and be truncated to zero for division. Fix this issue by using div64_ul() instead. Link: http://lkml.kernel.org/r/20200103030248.14516-1-wenyang@linux.alibaba.com Cc: stable@vger.kernel.org Fixes: e330b3bcd8319 ("tracing: Show sample std dev in function profiling") Fixes: 34886c8bc590f ("tracing: add average time in function to function profiler") Signed-off-by: Wen Yang Signed-off-by: Steven Rostedt (VMware) commit b8299d362d0837ae39e87e9019ebe6b736e0f035 Author: Steven Rostedt (VMware) Date: Thu Jan 2 22:02:41 2020 -0500 tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined On some archs with some configurations, MCOUNT_INSN_SIZE is not defined, and this makes the stack tracer fail to compile. Just define it to zero in this case. Link: https://lore.kernel.org/r/202001020219.zvE3vsty%lkp@intel.com Cc: stable@vger.kernel.org Fixes: 4df297129f622 ("tracing: Remove most or all of stack tracer stack size from stack_max_size") Reported-by: kbuild test robot Signed-off-by: Steven Rostedt (VMware) commit d2ccbccb5444e9141b33cf5399927737e9ff1c3d Author: Steven Rostedt (VMware) Date: Thu Jan 2 21:56:44 2020 -0500 tracing: Define MCOUNT_INSN_SIZE when not defined without direct calls In order to handle direct calls along side of function graph tracer, a check is made to see if the address being traced by the function graph tracer is a direct call or not. To get the address used by direct callers, the return address is subtracted by MCOUNT_INSN_SIZE. For some archs with certain configurations, MCOUNT_INSN_SIZE is undefined here. But these should not be using direct calls anyway. Just define MCOUNT_INSN_SIZE to zero in this case. Link: https://lore.kernel.org/r/202001020219.zvE3vsty%lkp@intel.com Reported-by: kbuild test robot Fixes: ff205766dbbee ("ftrace: Fix function_graph tracer interaction with BPF trampoline") Signed-off-by: Steven Rostedt (VMware) commit cd82dbf0d3fdd2474d169fa62631fa8e12e0311c Author: David S. Miller Date: Thu Jan 2 17:45:34 2020 -0800 net: Update GIT url in maintainers. Reported-by: Stephen Rothwell Signed-off-by: David S. Miller commit 7ca4ad5ba886557b67d42242a80f303c3a99ded1 Merge: 90e0a47be934 1f07dcc459d5 Author: Linus Torvalds Date: Thu Jan 2 17:04:43 2020 -0800 Merge tag 'sizeof_field-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull final sizeof_field conversion from Kees Cook: "Remove now unused FIELD_SIZEOF() macro (Kees Cook)" * tag 'sizeof_field-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: kernel.h: Remove unused FIELD_SIZEOF() commit 09b6636cea4f8e419d7cca4155e8695e462535a6 Author: Vignesh Raghavendra Date: Thu Jan 2 15:51:18 2020 +0530 spi: Document Octal mode as valid SPI bus width SPI core supports Octal SPI controllers which have 8 IO lines. Therefore document 8 as a valid option for spi-tx{rx}-bus-width Signed-off-by: Vignesh Raghavendra Link: https://lore.kernel.org/r/20200102102118.23318-1-vigneshr@ti.com Signed-off-by: Mark Brown commit 19b61392c5a852b4e8a0bf35aecb969983c5932d Author: wuxu.wu Date: Wed Jan 1 11:39:41 2020 +0800 spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls dw_spi_irq() and dw_spi_transfer_one concurrent calls. I find a panic in dw_writer(): txw = *(u8 *)(dws->tx), when dw->tx==null, dw->len==4, and dw->tx_end==1. When tpm driver's message overtime dw_spi_irq() and dw_spi_transfer_one may concurrent visit dw_spi, so I think dw_spi structure lack of protection. Otherwise dw_spi_transfer_one set dw rx/tx buffer and then open irq, store dw rx/tx instructions and other cores handle irq load dw rx/tx instructions may out of order. [ 1025.321302] Call trace: ... [ 1025.321319] __crash_kexec+0x98/0x148 [ 1025.321323] panic+0x17c/0x314 [ 1025.321329] die+0x29c/0x2e8 [ 1025.321334] die_kernel_fault+0x68/0x78 [ 1025.321337] __do_kernel_fault+0x90/0xb0 [ 1025.321346] do_page_fault+0x88/0x500 [ 1025.321347] do_translation_fault+0xa8/0xb8 [ 1025.321349] do_mem_abort+0x68/0x118 [ 1025.321351] el1_da+0x20/0x8c [ 1025.321362] dw_writer+0xc8/0xd0 [ 1025.321364] interrupt_transfer+0x60/0x110 [ 1025.321365] dw_spi_irq+0x48/0x70 ... Signed-off-by: wuxu.wu Link: https://lore.kernel.org/r/1577849981-31489-1-git-send-email-wuxu.wu@huawei.com Signed-off-by: Mark Brown commit 6f1ff76154b8b36033efcbf6453a71a3d28f52cd Author: Axel Lin Date: Wed Jan 1 10:24:06 2020 +0800 regulator: bd70528: Remove .set_ramp_delay for bd70528_ldo_ops The .set_ramp_delay should be for bd70528_buck_ops only. Setting .set_ramp_delay for for bd70528_ldo_ops causes problem because BD70528_MASK_BUCK_RAMP (0x10) overlaps with BD70528_MASK_LDO_VOLT (0x1f). So setting ramp_delay for LDOs may change the voltage output, fix it. Fixes: 99ea37bd1e7d ("regulator: bd70528: Support ROHM BD70528 regulator block") Signed-off-by: Axel Lin Acked-by: Matti Vaittinen Link: https://lore.kernel.org/r/20200101022406.15176-1-axel.lin@ingics.com Signed-off-by: Mark Brown commit ff3b57417012fcc963ec281f5705bed837e4b1ac Author: Arnd Bergmann Date: Thu Jan 2 14:52:55 2020 +0100 ASoC: Intel: boards: Fix compile-testing RT1011/RT5682 On non-x86, the new driver results in a build failure: sound/soc/intel/boards/cml_rt1011_rt5682.c:14:10: fatal error: asm/cpu_device_id.h: No such file or directory The asm/cpu_device_id.h header is not actually needed here, so don't include it. Signed-off-by: Arnd Bergmann Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20200102135322.1841053-1-arnd@arndb.de Signed-off-by: Mark Brown commit 90e0a47be934644944e7c6a29b8fc561be168ee1 Merge: bf6dd9a58eba a5b0dc5a46c2 Author: Linus Torvalds Date: Thu Jan 2 16:46:30 2020 -0800 Merge tag 'gcc-plugins-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull gcc-plugins fix from Kees Cook: "Build flexibility fix: allow builds to disable plugins even when plugins available (Arnd Bergmann)" * tag 'gcc-plugins-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: gcc-plugins: make it possible to disable CONFIG_GCC_PLUGINS again commit bf6dd9a58ebaba2608d2aebd2a7a704014121f16 Merge: 278b14eb9203 e4ab5ccc357b Author: Linus Torvalds Date: Thu Jan 2 16:42:10 2020 -0800 Merge tag 'seccomp-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp fixes from Kees Cook: "Fixes for seccomp_notify_ioctl uapi sanity from Sargun Dhillon. The bulk of this is fixing the surrounding samples and selftests so that seccomp can correctly validate the seccomp_notify_ioctl buffer as being initially zeroed. Summary: - Fix samples and selftests to zero passed-in buffer - Enforce zeroed buffer checking - Verify buffer sanity check in selftest" * tag 'seccomp-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests/seccomp: Catch garbage on SECCOMP_IOCTL_NOTIF_RECV seccomp: Check that seccomp_notif is zeroed out by the user selftests/seccomp: Zero out seccomp_notif samples/seccomp: Zero out members based on seccomp_notif_sizes commit bbcc5672b0063b0e9d65dc8787a4f09c3b5bb5cc Author: Paul Burton Date: Wed Jan 1 20:50:38 2020 -0800 MIPS: Avoid VDSO ABI breakage due to global register variable Declaring __current_thread_info as a global register variable has the effect of preventing GCC from saving & restoring its value in cases where the ABI would typically do so. To quote GCC documentation: > If the register is a call-saved register, call ABI is affected: the > register will not be restored in function epilogue sequences after the > variable has been assigned. Therefore, functions cannot safely return > to callers that assume standard ABI. When our position independent VDSO is built for the n32 or n64 ABIs all functions it exposes should be preserving the value of $gp/$28 for their caller, but in the presence of the __current_thread_info global register variable GCC stops doing so & simply clobbers $gp/$28 when calculating the address of the GOT. In cases where the VDSO returns success this problem will typically be masked by the caller in libc returning & restoring $gp/$28 itself, but that is by no means guaranteed. In cases where the VDSO returns an error libc will typically contain a fallback path which will now fail (typically with a bad memory access) if it attempts anything which relies upon the value of $gp/$28 - eg. accessing anything via the GOT. One fix for this would be to move the declaration of __current_thread_info inside the current_thread_info() function, demoting it from global register variable to local register variable & avoiding inadvertently creating a non-standard calling ABI for the VDSO. Unfortunately this causes issues for clang, which doesn't support local register variables as pointed out by commit fe92da0f355e ("MIPS: Changed current_thread_info() to an equivalent supported by both clang and GCC") which introduced the global register variable before we had a VDSO to worry about. Instead, fix this by continuing to use the global register variable for the kernel proper but declare __current_thread_info as a simple extern variable when building the VDSO. It should never be referenced, and will cause a link error if it is. This resolves the calling convention issue for the VDSO without having any impact upon the build of the kernel itself for either clang or gcc. Signed-off-by: Paul Burton Fixes: ebb5e78cc634 ("MIPS: Initial implementation of a VDSO") Reported-by: Jason A. Donenfeld Reviewed-by: Jason A. Donenfeld Tested-by: Jason A. Donenfeld Cc: Arnd Bergmann Cc: Christian Brauner Cc: Vincenzo Frascino Cc: # v4.4+ Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 542d0f607e58927541af3a3a7fc3bc6547c493dd Merge: c72a0bc0aa19 2d77bd61a292 Author: David S. Miller Date: Thu Jan 2 16:40:51 2020 -0800 Merge tag 'linux-can-fixes-for-5.5-20200102' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2020-01-02 this is a pull request of 9 patches for net/master. The first 5 patches target all the tcan4x5x driver. The first 3 patches of them are by Dan Murphy and Sean Nyekjaer and improve the device initialization (power on, reset and get device out of standby before register access). The next patch is by Dan Murphy and disables the INH pin device-state if the GPIO is unavailable. The last patch for the tcan4x5x driver is by Gustavo A. R. Silva and fixes an inconsistent PTR_ERR check in the tcan4x5x_parse_config() function. The next patch is by Oliver Hartkopp and targets the generic CAN device infrastructure. It ensures that an initialized headroom in outgoing CAN sk_buffs (e.g. if injected by AF_PACKET). The last 2 patches are by Johan Hovold and fix the kvaser_usb and gs_usb drivers by always using the current alternate setting not blindly the first one. ==================== Signed-off-by: David S. Miller commit 278b14eb920322255bf5b831e2bcfc1bf5999036 Merge: 74f1a299107b 9e5f1c19800b Author: Linus Torvalds Date: Thu Jan 2 16:39:51 2020 -0800 Merge tag 'pstore-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore bug fixes from Kees Cook: - always reset circular buffer state when writing new dump (Aleksandr Yashkin) - fix rare error-path memory leak (Kees Cook) * tag 'pstore-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: Write new dumps to start of recycled zones pstore/ram: Fix error-path memory leak in persistent_ram_new() callers commit c72a0bc0aa19f49160330a65ab77184b5b7d131b Author: Andrew Lunn Date: Thu Jan 2 15:33:34 2020 +0100 net: freescale: fec: Fix ethtool -d runtime PM In order to dump the FECs registers the clocks have to be ticking, otherwise a data abort occurs. Add calls to runtime PM so they are enabled and later disabled. Fixes: e8fcfcd5684a ("net: fec: optimize the clock management to save power") Reported-by: Chris Healy Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 71130f29979c7c7956b040673e6b9d5643003176 Author: Hangbin Liu Date: Thu Jan 2 17:23:45 2020 +0800 vxlan: fix tos value before xmit Before ip_tunnel_ecn_encap() and udp_tunnel_xmit_skb() we should filter tos value by RT_TOS() instead of using config tos directly. vxlan_get_route() would filter the tos to fl4.flowi4_tos but we didn't return it back, as geneve_get_v4_rt() did. So we have to use RT_TOS() directly in function ip_tunnel_ecn_encap(). Fixes: 206aaafcd279 ("VXLAN: Use IP Tunnels tunnel ENC encap API") Fixes: 1400615d64cf ("vxlan: allow setting ipv6 traffic class") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 68aab823c223646fab311f8a6581994facee66a0 Author: Wen Yang Date: Thu Jan 2 17:21:43 2020 +0800 sch_cake: avoid possible divide by zero in cake_enqueue() The variables 'window_interval' is u64 and do_div() truncates it to 32 bits, which means it can test non-zero and be truncated to zero for division. The unit of window_interval is nanoseconds, so its lower 32-bit is relatively easy to exceed. Fix this issue by using div64_u64() instead. Fixes: 7298de9cd725 ("sch_cake: Add ingress mode") Signed-off-by: Wen Yang Cc: Kevin Darbyshire-Bryant Cc: Toke Høiland-Jørgensen Cc: David S. Miller Cc: Cong Wang Cc: cake@lists.bufferbloat.net Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Acked-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller commit 74f1a299107b9e1a563831a4ba85f769ab577164 Author: Dominik Brodowski Date: Wed Jan 1 20:05:03 2020 +0100 Revert "fs: remove ksys_dup()" This reverts commit 8243186f0cc7 ("fs: remove ksys_dup()") and the subsequent fix for it in commit 2d3145f8d280 ("early init: fix error handling when opening /dev/console"). Trying to use filp_open() and f_dupfd() instead of pseudo-syscalls caused more trouble than what is worth it: it requires accessing vfs internals and it turns out there were other bugs in it too. In particular, the file reference counting was wrong - because unlike the original "open+2*dup" sequence it used "filp_open+3*f_dupfd" and thus had an extra leaked file reference. That in turn then caused odd problems with Androidx86 long after boot becaue of how the extra reference to the console kept the session active even after all file descriptors had been closed. Reported-by: youling 257 Cc: Arvind Sankar Cc: Al Viro Signed-off-by: Dominik Brodowski Signed-off-by: Linus Torvalds commit d8513df2598e5142f8a5c4724f28411936e1dfc7 Author: David S. Miller Date: Thu Jan 2 16:07:38 2020 -0800 net: Correct type of tcp_syncookies sysctl. It can take on the values of '0', '1', and '2' and thus is not a boolean. Signed-off-by: David S. Miller commit 02f4e01ce710fe20d2e5548d52bfdea52efd09d1 Author: Steven Rostedt (VMware) Date: Thu Jan 2 19:04:57 2020 -0500 tracing: Initialize val to zero in parse_entry of inject code gcc produces a variable may be uninitialized warning for "val" in parse_entry(). This is really a false positive, but the code is subtle enough to just initialize val to zero and it's not a fast path to worry about it. Marked for stable to remove the warning in the stable trees as well. Cc: stable@vger.kernel.org Fixes: 6c3edaf9fd6a3 ("tracing: Introduce trace event injection") Reported-by: kbuild test robot Signed-off-by: Steven Rostedt (VMware) commit c9655008e7845bcfdaac10a1ed8554ec167aea88 Author: Pengcheng Yang Date: Mon Dec 30 17:54:41 2019 +0800 tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK When we receive a D-SACK, where the sequence number satisfies: undo_marker <= start_seq < end_seq <= prior_snd_una we consider this is a valid D-SACK and tcp_is_sackblock_valid() returns true, then this D-SACK is discarded as "old stuff", but the variable first_sack_index is not marked as negative in tcp_sacktag_write_queue(). If this D-SACK also carries a SACK that needs to be processed (for example, the previous SACK segment was lost), this SACK will be treated as a D-SACK in the following processing of tcp_sacktag_write_queue(), which will eventually lead to incorrect updates of undo_retrans and reordering. Fixes: fd6dad616d4f ("[TCP]: Earlier SACK block verification & simplify access to them") Signed-off-by: Pengcheng Yang Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit f7a48b68abd9b20ce1ac6298aaaa3c4d158271dd Author: Baruch Siach Date: Thu Dec 19 11:48:22 2019 +0200 net: dsa: mv88e6xxx: force cmode write on 6141/6341 mv88e6xxx_port_set_cmode() relies on cmode stored in struct mv88e6xxx_port to skip cmode update when the requested value matches the cached value. It turns out that mv88e6xxx_port_hidden_write() might change the port cmode setting as a side effect, so we can't rely on the cached value to determine that cmode update in not necessary. Force cmode update in mv88e6341_port_set_cmode(), to make serdes configuration work again. Other mv88e6xxx_port_set_cmode() callers keep the current behaviour. This fixes serdes configuration of the 6141 switch on SolidRun Clearfog GT-8K. Fixes: 7a3007d22e8 ("net: dsa: mv88e6xxx: fully support SERDES on Topaz family") Reported-by: Denis Odintsov Signed-off-by: Baruch Siach Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit a5b0dc5a46c221725c43bd9b01570239a4cd78b1 Author: Arnd Bergmann Date: Wed Dec 11 14:39:28 2019 +0100 gcc-plugins: make it possible to disable CONFIG_GCC_PLUGINS again I noticed that randconfig builds with gcc no longer produce a lot of ccache hits, unlike with clang, and traced this back to plugins now being enabled unconditionally if they are supported. I am now working around this by adding export CCACHE_COMPILERCHECK=/usr/bin/size -A %compiler% to my top-level Makefile. This changes the heuristic that ccache uses to determine whether the plugins are the same after a 'make clean'. However, it also seems that being able to just turn off the plugins is generally useful, at least for build testing it adds noticeable overhead but does not find a lot of bugs additional bugs, and may be easier for ccache users than my workaround. Fixes: 9f671e58159a ("security: Create "kernel hardening" config area") Signed-off-by: Arnd Bergmann Acked-by: Ard Biesheuvel Reviewed-by: Masahiro Yamada Link: https://lore.kernel.org/r/20191211133951.401933-1-arnd@arndb.de Cc: stable@vger.kernel.org Signed-off-by: Kees Cook commit e4ab5ccc357b978999328fadae164e098c26fa40 Author: Sargun Dhillon Date: Mon Dec 30 12:38:11 2019 -0800 selftests/seccomp: Catch garbage on SECCOMP_IOCTL_NOTIF_RECV This adds logic to the user_notification_basic test to set a member of struct seccomp_notif to an invalid value to ensure that the kernel returns EINVAL if any of the struct seccomp_notif members are set to invalid values. Signed-off-by: Sargun Dhillon Suggested-by: Christian Brauner Link: https://lore.kernel.org/r/20191230203811.4996-1-sargun@sargun.me Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook commit 2882d53c9c6f3b8311d225062522f03772cf0179 Author: Sargun Dhillon Date: Sat Dec 28 22:24:50 2019 -0800 seccomp: Check that seccomp_notif is zeroed out by the user This patch is a small change in enforcement of the uapi for SECCOMP_IOCTL_NOTIF_RECV ioctl. Specifically, the datastructure which is passed (seccomp_notif) must be zeroed out. Previously any of its members could be set to nonsense values, and we would ignore it. This ensures all fields are set to their zero value. Signed-off-by: Sargun Dhillon Reviewed-by: Christian Brauner Reviewed-by: Aleksa Sarai Acked-by: Tycho Andersen Link: https://lore.kernel.org/r/20191229062451.9467-2-sargun@sargun.me Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook commit 88c13f8bd71472fbab5338b01d99122908c77e53 Author: Sargun Dhillon Date: Sat Dec 28 22:24:49 2019 -0800 selftests/seccomp: Zero out seccomp_notif The seccomp_notif structure should be zeroed out prior to calling the SECCOMP_IOCTL_NOTIF_RECV ioctl. Previously, the kernel did not check whether these structures were zeroed out or not, so these worked. This patch zeroes out the seccomp_notif data structure prior to calling the ioctl. Signed-off-by: Sargun Dhillon Reviewed-by: Tycho Andersen Reviewed-by: Christian Brauner Link: https://lore.kernel.org/r/20191229062451.9467-1-sargun@sargun.me Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook commit 771b894f2f3dfedc2ba5561731fffa0e39b1bbb6 Author: Sargun Dhillon Date: Mon Dec 30 12:35:03 2019 -0800 samples/seccomp: Zero out members based on seccomp_notif_sizes The sizes by which seccomp_notif and seccomp_notif_resp are allocated are based on the SECCOMP_GET_NOTIF_SIZES ioctl. This allows for graceful extension of these datastructures. If userspace zeroes out the datastructure based on its version, and it is lagging behind the kernel's version, it will end up sending trailing garbage. On the other hand, if it is ahead of the kernel version, it will write extra zero space, and potentially cause corruption. Signed-off-by: Sargun Dhillon Suggested-by: Tycho Andersen Link: https://lore.kernel.org/r/20191230203503.4925-1-sargun@sargun.me Fixes: fec7b6690541 ("samples: add an example of seccomp user trap") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook commit 9e5f1c19800b808a37fb9815a26d382132c26c3d Author: Aleksandr Yashkin Date: Mon Dec 23 18:38:16 2019 +0500 pstore/ram: Write new dumps to start of recycled zones The ram_core.c routines treat przs as circular buffers. When writing a new crash dump, the old buffer needs to be cleared so that the new dump doesn't end up in the wrong place (i.e. at the end). The solution to this problem is to reset the circular buffer state before writing a new Oops dump. Signed-off-by: Aleksandr Yashkin Signed-off-by: Nikolay Merinov Signed-off-by: Ariel Gilman Link: https://lore.kernel.org/r/20191223133816.28155-1-n.merinov@inango-systems.com Fixes: 896fc1f0c4c6 ("pstore/ram: Switch to persistent_ram routines") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook commit 8df955a32a73315055e0cd187cbb1cea5820394b Author: Kees Cook Date: Mon Dec 30 11:48:10 2019 -0800 pstore/ram: Fix error-path memory leak in persistent_ram_new() callers For callers that allocated a label for persistent_ram_new(), if the call fails, they must clean up the allocation. Suggested-by: Navid Emamdoost Fixes: 1227daa43bce ("pstore/ram: Clarify resource reservation labels") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/lkml/20191211191353.14385-1-navid.emamdoost@gmail.com Signed-off-by: Kees Cook commit ab6a2114433a3b5b555983dcb9b752a85255f04b Author: Shakeel Butt Date: Thu Jan 2 08:58:44 2020 -0800 x86/resctrl: Fix potential memory leak set_cache_qos_cfg() is leaking memory when the given level is not RDT_RESOURCE_L3 or RDT_RESOURCE_L2. At the moment, this function is called with only valid levels but move the allocation after the valid level checks in order to make it more robust and future proof. [ bp: Massage commit message. ] Fixes: 99adde9b370de ("x86/intel_rdt: Enable L2 CDP in MSR IA32_L2_QOS_CFG") Signed-off-by: Shakeel Butt Signed-off-by: Borislav Petkov Cc: Fenghua Yu Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Reinette Chatre Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/20200102165844.133133-1-shakeelb@google.com commit c215e48e97d232249a33849fc46fc50311043e11 Author: Douglas Gilbert Date: Sun Dec 29 22:35:44 2019 -0500 USB-PD tcpm: bad warning+size, PPS adapters Augmented Power Delivery Objects (A)PDO_s are used by USB-C PD power adapters to advertize the voltages and currents they support. There can be up to 7 PDO_s but before PPS (programmable power supply) there were seldom more than 4 or 5. Recently Samsung released an optional PPS 45 Watt power adapter (EP-TA485) that has 7 PDO_s. It is for the Galaxy 10+ tablet and charges it quicker than the adapter supplied at purchase. The EP-TA485 causes an overzealous WARN_ON to soil the log plus it miscalculates the number of bytes to read. So this bug has been there for some time but goes undetected for the majority of USB-C PD power adapters on the market today that have 6 or less PDO_s. That may soon change as more USB-C PD adapters with PPS come to market. Tested on a EP-TA485 and an older Lenovo PN: SA10M13950 USB-C 65 Watt adapter (without PPS and has 4 PDO_s) plus several other PD power adapters. Signed-off-by: Douglas Gilbert Reviewed-by: Guenter Roeck Cc: stable Link: https://lore.kernel.org/r/20191230033544.1809-1-dgilbert@interlog.com Signed-off-by: Greg Kroah-Hartman commit 2d77bd61a2927be8f4e00d9478fe6996c47e8d45 Author: Florian Faber Date: Thu Dec 26 19:51:24 2019 +0100 can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode Under load, the RX side of the mscan driver can get stuck while TX still works. Restarting the interface locks up the system. This behaviour could be reproduced reliably on a MPC5121e based system. The patch fixes the return value of the NAPI polling function (should be the number of processed packets, not constant 1) and the condition under which IRQs are enabled again after polling is finished. With this patch, no more lockups were observed over a test period of ten days. Fixes: afa17a500a36 ("net/can: add driver for mscan family & mpc52xx_mscan") Signed-off-by: Florian Faber Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 2f361cd9474ab2c4ab9ac8db20faf81e66c6279b Author: Johan Hovold Date: Tue Dec 10 12:32:31 2019 +0100 can: gs_usb: gs_usb_probe(): use descriptors of current altsetting Make sure to always use the descriptors of the current alternate setting to avoid future issues when accessing fields that may differ between settings. Signed-off-by: Johan Hovold Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Signed-off-by: Marc Kleine-Budde commit 5660493c637c9d83786f1c9297f403eae44177b6 Author: Johan Hovold Date: Tue Dec 10 12:32:30 2019 +0100 can: kvaser_usb: fix interface sanity check Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") Cc: stable # 4.19 Cc: Jimmy Assarsson Cc: Christer Beskow Cc: Nicklas Johansson Cc: Martin Henriksson Signed-off-by: Johan Hovold Signed-off-by: Marc Kleine-Budde commit e7153bf70c3496bac00e7e4f395bb8d8394ac0ea Author: Oliver Hartkopp Date: Sat Dec 7 19:34:18 2019 +0100 can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs KMSAN sysbot detected a read access to an untinitialized value in the headroom of an outgoing CAN related sk_buff. When using CAN sockets this area is filled appropriately - but when using a packet socket this initialization is missing. The problematic read access occurs in the CAN receive path which can only be triggered when the sk_buff is sent through a (virtual) CAN interface. So we check in the sending path whether we need to perform the missing initializations. Fixes: d3b58c47d330d ("can: replace timestamp as unique skb attribute") Reported-by: syzbot+b02ff0707a97e4e79ebb@syzkaller.appspotmail.com Signed-off-by: Oliver Hartkopp Tested-by: Oliver Hartkopp Cc: linux-stable # >= v4.1 Signed-off-by: Marc Kleine-Budde commit 93bdc0eb0b4bb5e7094fd4a95f4a394e4a927e09 Author: Gustavo A. R. Silva Date: Tue Dec 10 09:05:32 2019 -0600 can: tcan4x5x: tcan4x5x_parse_config(): fix inconsistent IS_ERR and PTR_ERR Fix inconsistent IS_ERR and PTR_ERR in tcan4x5x_parse_config(). The proper pointer to be passed as argument is tcan4x5x->device_wake_gpio. This bug was detected with the help of Coccinelle. Fixes: 2de497356955 ("can: tcan45x: Make wake-up GPIO an optional GPIO") Signed-off-by: Gustavo A. R. Silva Acked-by: Dan Murphy Signed-off-by: Marc Kleine-Budde commit 5a1f8f5e5efa8d536d75ab532714ec248dd6da2b Author: Dan Murphy Date: Thu Dec 12 10:15:36 2019 -0600 can: tcan4x5x: tcan4x5x_parse_config(): Disable the INH pin device-state GPIO is unavailable If the device state GPIO is not connected to the host then disable the INH output from the TCAN device per section 8.3.5 of the data sheet. Signed-off-by: Dan Murphy Signed-off-by: Marc Kleine-Budde commit c3083124e6a1c0d6cd4fe3b3f627b488bd3b10c4 Author: Sean Nyekjaer Date: Wed Dec 11 14:58:51 2019 +0100 can: tcan4x5x: tcan4x5x_parse_config(): reset device before register access It's a good idea to reset a ip-block/spi device before using it, this patch will reset the device. And a generic reset function if needed elsewhere. Signed-off-by: Sean Nyekjaer Signed-off-by: Marc Kleine-Budde commit 3814ca3a10be795693e9d95142c69134c6189a9b Author: Dan Murphy Date: Tue Dec 10 10:32:04 2019 -0600 can: tcan4x5x: tcan4x5x_can_probe(): turn on the power before parsing the config The tcan4x5x_parse_config() function now performs action on the device either reading or writing and a reset. If the devive has a switchable power supppy (i.e. regulator is managed) it needs to be turned on. So turn on the regulator if available. If the parsing fails, turn off the regulator. Fixes: 2de497356955 ("can: tcan45x: Make wake-up GPIO an optional GPIO") Signed-off-by: Dan Murphy Signed-off-by: Marc Kleine-Budde commit 3069ce620daed85e4ef2b0c087dca2509f809470 Author: Sean Nyekjaer Date: Wed Dec 11 14:58:52 2019 +0100 can: tcan4x5x: tcan4x5x_can_probe(): get the device out of standby before register access The m_can tries to detect if Non ISO Operation is available while in standby mode, this function results in the following error: | tcan4x5x spi2.0 (unnamed net_device) (uninitialized): Failed to init module | tcan4x5x spi2.0: m_can device registered (irq=84, version=32) | tcan4x5x spi2.0 can2: TCAN4X5X successfully initialized. When the tcan device comes out of reset it goes in standby mode. The m_can driver tries to access the control register but fails due to the device being in standby mode. So this patch will put the tcan device in normal mode before the m_can driver does the initialization. Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") Cc: stable@vger.kernel.org Signed-off-by: Sean Nyekjaer Acked-by: Dan Murphy Signed-off-by: Marc Kleine-Budde commit 02a614499600af836137c3fbc4404cd96365fff2 Author: Markus Theil Date: Tue Dec 3 19:06:44 2019 +0100 mac80211: mesh: restrict airtime metric to peered established plinks The following warning is triggered every time an unestablished mesh peer gets dumped. Checks if a peer link is established before retrieving the airtime link metric. [ 9563.022567] WARNING: CPU: 0 PID: 6287 at net/mac80211/mesh_hwmp.c:345 airtime_link_metric_get+0xa2/0xb0 [mac80211] [ 9563.022697] Hardware name: PC Engines apu2/apu2, BIOS v4.10.0.3 [ 9563.022756] RIP: 0010:airtime_link_metric_get+0xa2/0xb0 [mac80211] [ 9563.022838] Call Trace: [ 9563.022897] sta_set_sinfo+0x936/0xa10 [mac80211] [ 9563.022964] ieee80211_dump_station+0x6d/0x90 [mac80211] [ 9563.023062] nl80211_dump_station+0x154/0x2a0 [cfg80211] [ 9563.023120] netlink_dump+0x17b/0x370 [ 9563.023130] netlink_recvmsg+0x2a4/0x480 [ 9563.023140] ____sys_recvmsg+0xa6/0x160 [ 9563.023154] ___sys_recvmsg+0x93/0xe0 [ 9563.023169] __sys_recvmsg+0x7e/0xd0 [ 9563.023210] do_syscall_64+0x4e/0x140 [ 9563.023217] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Signed-off-by: Markus Theil Link: https://lore.kernel.org/r/20191203180644.70653-1-markus.theil@tu-ilmenau.de [rewrite commit message] Signed-off-by: Johannes Berg commit 20d4e80d255dd7cfecb53743bc550ebcad04549d Author: John Johansen Date: Wed Dec 18 11:04:07 2019 -0800 apparmor: only get a label reference if the fast path check fails The common fast path check can be done under rcu_read_lock() and doesn't need a reference count on the label. Only take a reference count if entering the slow path. Fixes reported hackbench regression - sha1 79e178a57dae ("Merge tag 'apparmor-pr-2019-12-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor") hackbench -l (256000/#grp) -g #grp 128 groups 19.679 ±0.90% - previous sha1 01d1dff64662 ("Merge tag 's390-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux") hackbench -l (256000/#grp) -g #grp 128 groups 3.1689 ±3.04% Reported-by: Vincent Guittot Tested-by: Vincent Guittot Tested-by: Sebastian Andrzej Siewior Fixes: bce4e7e9c45e ("apparmor: reduce rcu_read_lock scope for aa_file_perm mediation") Signed-off-by: John Johansen commit 9c95a278ba7ca3ccc111c165cc74cb23c744fc85 Author: Patrick Steinhardt Date: Wed Dec 11 12:44:08 2019 +0100 apparmor: fix bind mounts aborting with -ENOMEM With commit df323337e507 ("apparmor: Use a memory pool instead per-CPU caches, 2019-05-03"), AppArmor code was converted to use memory pools. In that conversion, a bug snuck into the code that polices bind mounts that causes all bind mounts to fail with -ENOMEM, as we erroneously error out if `aa_get_buffer` returns a pointer instead of erroring out when it does _not_ return a valid pointer. Fix the issue by correctly checking for valid pointers returned by `aa_get_buffer` to fix bind mounts with AppArmor. Fixes: df323337e507 ("apparmor: Use a memory pool instead per-CPU caches") Signed-off-by: Patrick Steinhardt Signed-off-by: John Johansen commit efb3ecdcdb47f28b72e312fdca0ff923aa3d19bb Merge: 5041a58d5ba5 2438c3a19dec Author: Greg Kroah-Hartman Date: Thu Jan 2 12:37:40 2020 +0100 Merge tag 'usb-serial-5.5-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.5-rc5 Here's a couple of new modem device ids, including a new quirk for devices that expect zero-length packets. Due to the holidays, only the first one has been in linux-next and with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-5.5-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add ZLP support for 0x1bc7/0x9010 USB: serial: option: add Telit ME910G1 0x110a composition commit 5041a58d5ba5ec62b8126a729d114430a80c835d Merge: c1ffba305dbc 4f510aa10468 Author: Greg Kroah-Hartman Date: Thu Jan 2 12:36:49 2020 +0100 Merge tag 'phy-for-5.5-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy into usb-linus Kishon writes: phy: for 5.5-rc *) Fix error path in cpcap-usb driver when no host driver is loaded to avoid debug serial console from stop working *) Fix to let USB host idle before switching to UART mode in cpcap-usb driver in order to avoid flakey enumeration next time *) Prevent USB line glitches from waking up modem by enabling the USB lines (GPIO mux) after configuring the cpcap-usb PHY *) Improve host vs docked mode detection in cpcap-usb PHY driver to keep VBUS enabled in host mode *) Fix to prevent cpcap-usb PHY driver from enabling the PHY twice *) Increase PHY ready timeout in qcom-qmp PHY as it takes more than 1ms to initialize *) Round clock rate down to closest 1000 Hz in phy-rockchip-inno-hdmi to prevent wrong pixel clock to be used and result in no-signal when configuring a mode on RK3328 * tag 'phy-for-5.5-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy: phy/rockchip: inno-hdmi: round clock rate down to closest 1000 Hz phy: cpcap-usb: Drop extra write to usb2 register phy: cpcap-usb: Improve host vs docked mode detection phy: cpcap-usb: Prevent USB line glitches from waking up modem phy: mapphone-mdm6600: Fix uninitialized status value regression phy: cpcap-usb: Fix flakey host idling and enumerating of devices phy: qcom-qmp: Increase PHY ready timeout phy: cpcap-usb: Fix error path when no host driver is loaded commit 0c545240aebc2ccb8f661dc54283a14d64659804 Author: Samuel Holland Date: Sat Dec 28 20:59:22 2019 -0600 clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order According to the BSP source code, both the AR100 and R_APB2 clocks have PLL_PERIPH0 as mux index 3, not 2 as it was on previous chips. The pre- divider used for PLL_PERIPH0 should be changed to index 3 to match. This was verified by running a rough benchmark on the AR100 with various clock settings: | mux | pre-divider | iterations/second | clock source | |=====|=============|===================|==============| | 0 | 0 | 19033 (stable) | osc24M | | 2 | 5 | 11466 (unstable) | iosc/osc16M | | 2 | 17 | 11422 (unstable) | iosc/osc16M | | 3 | 5 | 85338 (stable) | pll-periph0 | | 3 | 17 | 27167 (stable) | pll-periph0 | The relative performance numbers all match up (with pll-periph0 running at its default 600MHz). Signed-off-by: Samuel Holland Signed-off-by: Maxime Ripard commit 675a6d467b432c8b4a0703ded02e6ef068e0c7e9 Author: Samuel Holland Date: Sat Dec 28 20:59:21 2019 -0600 clk: sunxi-ng: h6-r: Simplify R_APB1 clock definition Like the APB0 clock on previous chips, this is a simple single-parent clock with an M divider. Use the equivalent helper macro instead of writing out the whole clock description manually. Signed-off-by: Samuel Holland Signed-off-by: Maxime Ripard commit 47d64fef1f3ffbdf960d3330b9865fc9f12fdf84 Author: Samuel Holland Date: Sat Dec 28 20:59:20 2019 -0600 clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock According to the BSP source code, the APB0 clock on the H3 and H5 has a normal M divider, not a power-of-two divider. This matches the hardware in the A83T (as described in both the BSP source code and the manual). Since the A83T and H3/A64 clocks are actually the same, we can merge the definitions. Signed-off-by: Samuel Holland Signed-off-by: Maxime Ripard commit 866bd5eeaf13a8e008fa7b818fb445bacd4dbdb0 Merge: e7cbcb16fa41 969e11529221 Author: Dave Airlie Date: Thu Jan 2 10:16:04 2020 +1000 Merge tag 'amd-drm-fixes-5.5-2020-01-01' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amd-drm-fixes-5.5-2020-01-01: amdgpu: - ATPX regression fix - SMU metrics table locking fixes - gfxoff fix for raven - RLC firmware loading stability fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20200101151307.5242-1-alexander.deucher@amd.com commit e7cbcb16fa416c26e02c181945ba62de580fca7a Merge: 886a0dc04d73 ac2917b01992 Author: Dave Airlie Date: Thu Jan 2 09:40:54 2020 +1000 Merge tag 'drm-misc-fixes-2019-12-31' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes -sun4i: Fix double-free in connector/encoder cleanup (Stefan) -malidp: Make vtable static (Ben) Cc: Ben Dooks Cc: Stefan Mavrodiev Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20191231152503.GA46740@art_vandelay commit 886a0dc04d73f1ff78d206581d3853f3d2ec9435 Merge: fd6988496e79 e18e0f6b7c8f Author: Dave Airlie Date: Thu Jan 2 09:40:03 2020 +1000 Merge tag 'mediatek-drm-fixes-5.5' of https://github.com/ckhu-mediatek/linux.git-tags into drm-fixes Mediatek DRM fixes for Linux 5.5 Signed-off-by: Dave Airlie From: CK Hu Link: https://patchwork.freedesktop.org/patch/msgid/1577762298.23194.2.camel@mtksdaap41 commit 969e11529221a6a2a787cb3b63ccf9402f8d2e37 Author: Evan Quan Date: Mon Dec 23 16:13:48 2019 +0800 drm/amdgpu: correct RLC firmwares loading sequence Per confirmation with RLC firmware team, the RLC should be unhalted after all RLC related firmwares uploaded. However, in fact the RLC is unhalted immediately after RLCG firmware uploaded. And that may causes unexpected PSP hang on loading the succeeding RLC save restore list related firmwares. So, we correct the firmware loading sequence to load RLC save restore list related firmwares before RLCG ucode. That will help to get around this issue. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 738d2902773e30939a982c8df7a7f94293659810 Merge: c5c928c667cd 04b69426d846 Author: Linus Torvalds Date: Tue Dec 31 11:14:58 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Fix big endian overflow in nf_flow_table, from Arnd Bergmann. 2) Fix port selection on big endian in nft_tproxy, from Phil Sutter. 3) Fix precision tracking for unbound scalars in bpf verifier, from Daniel Borkmann. 4) Fix integer overflow in socket rcvbuf check in UDP, from Antonio Messina. 5) Do not perform a neigh confirmation during a pmtu update over a tunnel, from Hangbin Liu. 6) Fix DMA mapping leak in dpaa_eth driver, from Madalin Bucur. 7) Various PTP fixes for sja1105 dsa driver, from Vladimir Oltean. 8) Add missing to dummy definition of of_mdiobus_child_is_phy(), from Geert Uytterhoeven * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (54 commits) hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename() net/sched: add delete_empty() to filters and use it in cls_flower tcp: Fix highest_sack and highest_sack_seq ptp: fix the race between the release of ptp_clock and cdev net: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S Documentation: net: dsa: sja1105: Remove text about taprio base-time limitation net: dsa: sja1105: Remove restriction of zero base-time for taprio offload net: dsa: sja1105: Really make the PTP command read-write net: dsa: sja1105: Take PTP egress timestamp by port, not mgmt slot cxgb4/cxgb4vf: fix flow control display for auto negotiation mlxsw: spectrum: Use dedicated policer for VRRP packets mlxsw: spectrum_router: Skip loopback RIFs during MAC validation net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device net_sched: sch_fq: properly set sk->sk_pacing_status bnx2x: Fix accounting of vlan resources among the PFs bnx2x: Use appropriate define for vlan credit of: mdio: Add missing inline to of_mdiobus_child_is_phy() dummy net: phy: aquantia: add suspend / resume ops for AQR105 dpaa_eth: fix DMA mapping leak ... commit c5c928c667cd1e34cbcac6af5b7c2f9f4512d612 Merge: fd6988496e79 6bd5ce6089b5 Author: Linus Torvalds Date: Tue Dec 31 10:51:27 2019 -0800 Merge tag 'tomoyo-fixes-for-5.5' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1 Pull tomoyo fixes from Tetsuo Handa: "Two bug fixes: - Suppress RCU warning at list_for_each_entry_rcu() - Don't use fancy names on sockets" * tag 'tomoyo-fixes-for-5.5' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1: tomoyo: Suppress RCU warning at list_for_each_entry_rcu(). tomoyo: Don't use nifty names on sockets. commit 4f510aa10468954b1da4e94689c38ac6ea8d3627 Author: Jonas Karlman Date: Mon Dec 23 08:49:19 2019 +0000 phy/rockchip: inno-hdmi: round clock rate down to closest 1000 Hz Commit 287422a95fe2 ("drm/rockchip: Round up _before_ giving to the clock framework") changed what rate clk_round_rate() is called with, an additional 999 Hz added to the requsted mode clock. This has caused a regression on RK3328 and presumably also on RK3228 because the inno-hdmi-phy clock requires an exact match of the requested rate in the pre pll config table. When an exact match is not found the parent clock rate (24MHz) is returned to the clk_round_rate() caller. This cause wrong pixel clock to be used and result in no-signal when configuring a mode on RK3328. Fix this by rounding the rate down to closest 1000 Hz in round_rate func, this allows an exact match to be found in pre pll config table. Fixes: 287422a95fe2 ("drm/rockchip: Round up _before_ giving to the clock framework") Signed-off-by: Jonas Karlman Signed-off-by: Kishon Vijay Abraham I commit 04b69426d846cd04ca9acefff1ea39e1c64d2714 Author: Taehee Yoo Date: Sat Dec 28 16:28:09 2019 +0000 hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename() hsr slave interfaces don't have debugfs directory. So, hsr_debugfs_rename() shouldn't be called when hsr slave interface name is changed. Test commands: ip link add dummy0 type dummy ip link add dummy1 type dummy ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1 ip link set dummy0 name ap Splat looks like: [21071.899367][T22666] ap: renamed from dummy0 [21071.914005][T22666] ================================================================== [21071.919008][T22666] BUG: KASAN: slab-out-of-bounds in hsr_debugfs_rename+0xaa/0xb0 [hsr] [21071.923640][T22666] Read of size 8 at addr ffff88805febcd98 by task ip/22666 [21071.926941][T22666] [21071.927750][T22666] CPU: 0 PID: 22666 Comm: ip Not tainted 5.5.0-rc2+ #240 [21071.929919][T22666] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [21071.935094][T22666] Call Trace: [21071.935867][T22666] dump_stack+0x96/0xdb [21071.936687][T22666] ? hsr_debugfs_rename+0xaa/0xb0 [hsr] [21071.937774][T22666] print_address_description.constprop.5+0x1be/0x360 [21071.939019][T22666] ? hsr_debugfs_rename+0xaa/0xb0 [hsr] [21071.940081][T22666] ? hsr_debugfs_rename+0xaa/0xb0 [hsr] [21071.940949][T22666] __kasan_report+0x12a/0x16f [21071.941758][T22666] ? hsr_debugfs_rename+0xaa/0xb0 [hsr] [21071.942674][T22666] kasan_report+0xe/0x20 [21071.943325][T22666] hsr_debugfs_rename+0xaa/0xb0 [hsr] [21071.944187][T22666] hsr_netdev_notify+0x1fe/0x9b0 [hsr] [21071.945052][T22666] ? __module_text_address+0x13/0x140 [21071.945897][T22666] notifier_call_chain+0x90/0x160 [21071.946743][T22666] dev_change_name+0x419/0x840 [21071.947496][T22666] ? __read_once_size_nocheck.constprop.6+0x10/0x10 [21071.948600][T22666] ? netdev_adjacent_rename_links+0x280/0x280 [21071.949577][T22666] ? __read_once_size_nocheck.constprop.6+0x10/0x10 [21071.950672][T22666] ? lock_downgrade+0x6e0/0x6e0 [21071.951345][T22666] ? do_setlink+0x811/0x2ef0 [21071.951991][T22666] do_setlink+0x811/0x2ef0 [21071.952613][T22666] ? is_bpf_text_address+0x81/0xe0 [ ... ] Reported-by: syzbot+9328206518f08318a5fd@syzkaller.appspotmail.com Fixes: 4c2d5e33dcd3 ("hsr: rename debugfs file when interface name is changed") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit a5b72a083da197b493c7ed1e5730d62d3199f7d6 Author: Davide Caratti Date: Sat Dec 28 16:36:58 2019 +0100 net/sched: add delete_empty() to filters and use it in cls_flower Revert "net/sched: cls_u32: fix refcount leak in the error path of u32_change()", and fix the u32 refcount leak in a more generic way that preserves the semantic of rule dumping. On tc filters that don't support lockless insertion/removal, there is no need to guard against concurrent insertion when a removal is in progress. Therefore, for most of them we can avoid a full walk() when deleting, and just decrease the refcount, like it was done on older Linux kernels. This fixes situations where walk() was wrongly detecting a non-empty filter, like it happened with cls_u32 in the error path of change(), thus leading to failures in the following tdc selftests: 6aa7: (filter, u32) Add/Replace u32 with source match and invalid indev 6658: (filter, u32) Add/Replace u32 with custom hash table and invalid handle 74c2: (filter, u32) Add/Replace u32 filter with invalid hash table id On cls_flower, and on (future) lockless filters, this check is necessary: move all the check_empty() logic in a callback so that each filter can have its own implementation. For cls_flower, it's sufficient to check if no IDRs have been allocated. This reverts commit 275c44aa194b7159d1191817b20e076f55f0e620. Changes since v1: - document the need for delete_empty() when TCF_PROTO_OPS_DOIT_UNLOCKED is used, thanks to Vlad Buslov - implement delete_empty() without doing fl_walk(), thanks to Vlad Buslov - squash revert and new fix in a single patch, to be nice with bisect tests that run tdc on u32 filter, thanks to Dave Miller Fixes: 275c44aa194b ("net/sched: cls_u32: fix refcount leak in the error path of u32_change()") Fixes: 6676d5e416ee ("net: sched: set dedicated tcf_walker flag when tp is empty") Suggested-by: Jamal Hadi Salim Suggested-by: Vlad Buslov Signed-off-by: Davide Caratti Reviewed-by: Vlad Buslov Tested-by: Jamal Hadi Salim Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit 853697504de043ff0bfd815bd3a64de1dce73dc7 Author: Cambda Zhu Date: Fri Dec 27 16:52:37 2019 +0800 tcp: Fix highest_sack and highest_sack_seq >From commit 50895b9de1d3 ("tcp: highest_sack fix"), the logic about setting tp->highest_sack to the head of the send queue was removed. Of course the logic is error prone, but it is logical. Before we remove the pointer to the highest sack skb and use the seq instead, we need to set tp->highest_sack to NULL when there is no skb after the last sack, and then replace NULL with the real skb when new skb inserted into the rtx queue, because the NULL means the highest sack seq is tp->snd_nxt. If tp->highest_sack is NULL and new data sent, the next ACK with sack option will increase tp->reordering unexpectedly. This patch sets tp->highest_sack to the tail of the rtx queue if it's NULL and new data is sent. The patch keeps the rule that the highest_sack can only be maintained by sack processing, except for this only case. Fixes: 50895b9de1d3 ("tcp: highest_sack fix") Signed-off-by: Cambda Zhu Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit a33121e5487b424339636b25c35d3a180eaa5f5e Author: Vladis Dronov Date: Fri Dec 27 03:26:27 2019 +0100 ptp: fix the race between the release of ptp_clock and cdev In a case when a ptp chardev (like /dev/ptp0) is open but an underlying device is removed, closing this file leads to a race. This reproduces easily in a kvm virtual machine: ts# cat openptp0.c int main() { ... fp = fopen("/dev/ptp0", "r"); ... sleep(10); } ts# uname -r 5.5.0-rc3-46cf053e ts# cat /proc/cmdline ... slub_debug=FZP ts# modprobe ptp_kvm ts# ./openptp0 & [1] 670 opened /dev/ptp0, sleeping 10s... ts# rmmod ptp_kvm ts# ls /dev/ptp* ls: cannot access '/dev/ptp*': No such file or directory ts# ...woken up [ 48.010809] general protection fault: 0000 [#1] SMP [ 48.012502] CPU: 6 PID: 658 Comm: openptp0 Not tainted 5.5.0-rc3-46cf053e #25 [ 48.014624] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... [ 48.016270] RIP: 0010:module_put.part.0+0x7/0x80 [ 48.017939] RSP: 0018:ffffb3850073be00 EFLAGS: 00010202 [ 48.018339] RAX: 000000006b6b6b6b RBX: 6b6b6b6b6b6b6b6b RCX: ffff89a476c00ad0 [ 48.018936] RDX: fffff65a08d3ea08 RSI: 0000000000000247 RDI: 6b6b6b6b6b6b6b6b [ 48.019470] ... ^^^ a slub poison [ 48.023854] Call Trace: [ 48.024050] __fput+0x21f/0x240 [ 48.024288] task_work_run+0x79/0x90 [ 48.024555] do_exit+0x2af/0xab0 [ 48.024799] ? vfs_write+0x16a/0x190 [ 48.025082] do_group_exit+0x35/0x90 [ 48.025387] __x64_sys_exit_group+0xf/0x10 [ 48.025737] do_syscall_64+0x3d/0x130 [ 48.026056] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 48.026479] RIP: 0033:0x7f53b12082f6 [ 48.026792] ... [ 48.030945] Modules linked in: ptp i6300esb watchdog [last unloaded: ptp_kvm] [ 48.045001] Fixing recursive fault but reboot is needed! This happens in: static void __fput(struct file *file) { ... if (file->f_op->release) file->f_op->release(inode, file); <<< cdev is kfree'd here if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL && !(mode & FMODE_PATH))) { cdev_put(inode->i_cdev); <<< cdev fields are accessed here Namely: __fput() posix_clock_release() kref_put(&clk->kref, delete_clock) <<< the last reference delete_clock() delete_ptp_clock() kfree(ptp) <<< cdev is embedded in ptp cdev_put module_put(p->owner) <<< *p is kfree'd, bang! Here cdev is embedded in posix_clock which is embedded in ptp_clock. The race happens because ptp_clock's lifetime is controlled by two refcounts: kref and cdev.kobj in posix_clock. This is wrong. Make ptp_clock's sysfs device a parent of cdev with cdev_device_add() created especially for such cases. This way the parent device with its ptp_clock is not released until all references to the cdev are released. This adds a requirement that an initialized but not exposed struct device should be provided to posix_clock_register() by a caller instead of a simple dev_t. This approach was adopted from the commit 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev"). See details of the implementation in the commit 233ed09d7fda ("chardev: add helper function to register char devs with a struct device"). Link: https://lore.kernel.org/linux-fsdevel/20191125125342.6189-1-vdronov@redhat.com/T/#u Analyzed-by: Stephen Johnston Analyzed-by: Vern Lovejoy Signed-off-by: Vladis Dronov Acked-by: Richard Cochran Signed-off-by: David S. Miller commit 54fa49ee88138756df0fcf867cb1849904710a8c Author: Vladimir Oltean Date: Fri Dec 27 03:11:13 2019 +0200 net: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S For first-generation switches (SJA1105E and SJA1105T): - TPID means C-Tag (typically 0x8100) - TPID2 means S-Tag (typically 0x88A8) While for the second generation switches (SJA1105P, SJA1105Q, SJA1105R, SJA1105S) it is the other way around: - TPID means S-Tag (typically 0x88A8) - TPID2 means C-Tag (typically 0x8100) In other words, E/T tags untagged traffic with TPID, and P/Q/R/S with TPID2. So the patch mentioned below fixed VLAN filtering for P/Q/R/S, but broke it for E/T. We strive for a common code path for all switches in the family, so just lie in the static config packing functions that TPID and TPID2 are at swapped bit offsets than they actually are, for P/Q/R/S. This will make both switches understand TPID to be ETH_P_8021Q and TPID2 to be ETH_P_8021AD. The meaning from the original E/T was chosen over P/Q/R/S because E/T is actually the one with public documentation available (UM10944.pdf). Fixes: f9a1a7646c0d ("net: dsa: sja1105: Reverse TPID and TPID2") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 3a323ed7c9c6d60af05bada0efe7a8ef56cf317f Author: Vladimir Oltean Date: Fri Dec 27 03:08:07 2019 +0200 Documentation: net: dsa: sja1105: Remove text about taprio base-time limitation Since commit 86db36a347b4 ("net: dsa: sja1105: Implement state machine for TAS with PTP clock source"), this paragraph is no longer true. So remove it. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit d00bdc0a8839de9a5c9be5af2a79dbf8e0087689 Author: Vladimir Oltean Date: Fri Dec 27 03:03:54 2019 +0200 net: dsa: sja1105: Remove restriction of zero base-time for taprio offload The check originates from the initial implementation which was not based on PTP time but on a standalone clock source. In the meantime we can now program the PTPSCHTM register at runtime with the dynamic base time (actually with a value that is 200 ns smaller, to avoid writing DELTA=0 in the Schedule Entry Points Parameters Table). And we also have logic for moving the actual base time in the future of the PHC's current time base, so the check for zero serves no purpose, since even if the user will specify zero, that's not what will end up in the static config table where the limitation is. Fixes: 86db36a347b4 ("net: dsa: sja1105: Implement state machine for TAS with PTP clock source") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 5a47f588ee2366b2febdc822cdfdcf856cb0a777 Author: Vladimir Oltean Date: Fri Dec 27 03:01:50 2019 +0200 net: dsa: sja1105: Really make the PTP command read-write When activating tc-taprio offload on the switch ports, the TAS state machine will try to check whether it is running or not, but will find both the STARTED and STOPPED bits as false in the sja1105_tas_check_running function. So the function will return -EINVAL (an abnormal situation) and the kernel will keep printing this from the TAS FSM workqueue: [ 37.691971] sja1105 spi0.1: An operation returned -22 The reason is that the underlying function that gets called, sja1105_ptp_commit, does not actually do a SPI_READ, but a SPI_WRITE. So the command buffer remains initialized with zeroes instead of retrieving the hardware state. Fix that. Fixes: 41603d78b362 ("net: dsa: sja1105: Make the PTP command read-write") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 9fcf024dd6fae082f05e8c1fcdae23972b2f6971 Author: Vladimir Oltean Date: Fri Dec 27 02:59:54 2019 +0200 net: dsa: sja1105: Take PTP egress timestamp by port, not mgmt slot The PTP egress timestamp N must be captured from register PTPEGR_TS[n], where n = 2 * PORT + TSREG. There are 10 PTPEGR_TS registers, 2 per port. We are only using TSREG=0. As opposed to the management slots, which are 4 in number (SJA1105_NUM_PORTS, minus the CPU port). Any management frame (which includes PTP frames) can be sent to any non-CPU port through any management slot. When the CPU port is not the last port (#4), there will be a mismatch between the slot and the port number. Luckily, the only mainline occurrence with this switch (arch/arm/boot/dts/ls1021a-tsn.dts) does have the CPU port as #4, so the issue did not manifest itself thus far. Fixes: 47ed985e97f5 ("net: dsa: sja1105: Add logic for TX timestamping") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit ca59d5a51690d5b9340343dc36792a252e9414ae Author: Vladimir Oltean Date: Sat Dec 28 15:55:36 2019 +0200 spi: spi-fsl-dspi: Fix 16-bit word order in 32-bit XSPI mode When used in Extended SPI mode on LS1021A, the DSPI controller wants to have the least significant 16-bit word written first to the TX FIFO. In fact, the LS1021A reference manual says: 33.5.2.4.2 Draining the TX FIFO When Extended SPI Mode (DSPIx_MCR[XSPI]) is enabled, if the frame size of SPI Data to be transmitted is more than 16 bits, then it causes two Data entries to be popped from TX FIFO simultaneously which are transferred to the shift register. The first of the two popped entries forms the 16 least significant bits of the SPI frame to be transmitted. So given the following TX buffer: +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+ | 0x0 | 0x1 | 0x2 | 0x3 | 0x4 | 0x5 | 0x6 | 0x7 | 0x8 | 0x9 | 0xa | 0xb | +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+ | 32-bit word 1 | 32-bit word 2 | 32-bit word 3 | +-----------------------+-----------------------+-----------------------+ The correct way that a little-endian system should transmit it on the wire when bits_per_word is 32 is: 0x03020100 0x07060504 0x0b0a0908 But it is actually transmitted as following, as seen with a scope: 0x01000302 0x05040706 0x09080b0a It appears that this patch has been submitted at least once before: https://lkml.org/lkml/2018/9/21/286 but in that case Chuanhua Han did not manage to explain the problem clearly enough and the patch did not get merged, leaving XSPI mode broken. Fixes: 8fcd151d2619 ("spi: spi-fsl-dspi: XSPI FIFO handling (in TCFQ mode)") Cc: Esben Haabendal Cc: Chuanhua Han Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20191228135536.14284-1-olteanv@gmail.com Signed-off-by: Mark Brown Cc: stable@vger.kernel.org commit 0caeaf6ad532f9be5a768a158627cb31921cc8b7 Author: Rahul Lakkireddy Date: Mon Dec 30 18:14:08 2019 +0530 cxgb4/cxgb4vf: fix flow control display for auto negotiation As per 802.3-2005, Section Two, Annex 28B, Table 28B-2 [1], when _only_ Rx pause is enabled, both symmetric and asymmetric pause towards local device must be enabled. Also, firmware returns the local device's flow control pause params as part of advertised capabilities and negotiated params as part of current link attributes. So, fix up ethtool's flow control pause params fetch logic to read from acaps, instead of linkattr. [1] https://standards.ieee.org/standard/802_3-2005.html Fixes: c3168cabe1af ("cxgb4/cxgbvf: Handle 32-bit fw port capabilities") Signed-off-by: Surendra Mobiya Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit 1f07dcc459d5f2c639f185f6e94829a0c79f2b4c Author: Kees Cook Date: Mon Dec 30 12:01:56 2019 -0800 kernel.h: Remove unused FIELD_SIZEOF() Now that all callers of FIELD_SIZEOF() have been converted to sizeof_field(), remove the unused prior macro. Signed-off-by: Kees Cook commit c1ffba305dbcf3fb9ca969c20a97acbddc38f8e9 Author: Guenter Roeck Date: Thu Dec 26 07:57:54 2019 -0800 usb: chipidea: host: Disable port power only if previously enabled On shutdown, ehci_power_off() is called unconditionally to power off each port, even if it was never called to power on the port. For chipidea, this results in a call to ehci_ci_portpower() with a request to power off ports even if the port was never powered on. This results in the following warning from the regulator code. WARNING: CPU: 0 PID: 182 at drivers/regulator/core.c:2596 _regulator_disable+0x1a8/0x210 unbalanced disables for usb_otg2_vbus Modules linked in: CPU: 0 PID: 182 Comm: init Not tainted 5.4.6 #1 Hardware name: Freescale i.MX7 Dual (Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xe0/0x10c) [] (dump_stack) from [] (__warn+0xf4/0x10c) [] (__warn) from [] (warn_slowpath_fmt+0x78/0xbc) [] (warn_slowpath_fmt) from [] (_regulator_disable+0x1a8/0x210) [] (_regulator_disable) from [] (regulator_disable+0x38/0xe8) [] (regulator_disable) from [] (ehci_ci_portpower+0x38/0xdc) [] (ehci_ci_portpower) from [] (ehci_port_power+0x50/0xa4) [] (ehci_port_power) from [] (ehci_silence_controller+0x5c/0xc4) [] (ehci_silence_controller) from [] (ehci_stop+0x3c/0xcc) [] (ehci_stop) from [] (usb_remove_hcd+0xe0/0x19c) [] (usb_remove_hcd) from [] (host_stop+0x38/0xa8) [] (host_stop) from [] (ci_hdrc_remove+0x44/0xe4) ... Keeping track of the power enable state avoids the warning and traceback. Fixes: c8679a2fb8dec ("usb: chipidea: host: add portpower override") Cc: Michael Grzeschik Cc: Peter Chen Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck Acked-by: Peter Chen Link: https://lore.kernel.org/r/20191226155754.25451-1-linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman commit af58e1fca9840192f14b6f03c59595d64bff9127 Author: Peter Chen Date: Fri Dec 27 17:10:04 2019 +0800 usb: cdns3: should not use the same dev_id for shared interrupt handler Both drd and gadget interrupt handler use the struct cdns3 pointer as dev_id, it causes devm_free_irq at cdns3_gadget_exit doesn't free gadget's interrupt handler, it freed drd's handler. So, when the host interrupt occurs, the gadget's interrupt hanlder is still called, and causes below oops. To fix it, we use gadget's private data priv_dev as interrupt dev_id for gadget. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000380 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000971d79000 [0000000000000380] pgd=0000000971d6f003, pud=0000000971d6e003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: mxc_jpeg_encdec crct10dif_ce fsl_imx8_ddr_perf CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-03486-g69f4e7d9c54a-dirty #254 Hardware name: Freescale i.MX8QM MEK (DT) pstate: 00000085 (nzcv daIf -PAN -UAO) pc : cdns3_device_irq_handler+0x1c/0xb8 lr : __handle_irq_event_percpu+0x78/0x2c0 sp : ffff800010003e30 x29: ffff800010003e30 x28: ffff8000129bb000 x27: ffff8000126e9000 x26: ffff0008f61b5600 x25: ffff800011fe1018 x24: ffff8000126ea120 x23: ffff800010003f04 x22: 0000000000000000 x21: 0000000000000093 x20: ffff0008f61b5600 x19: ffff0008f5061a80 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 003d090000000000 x13: 00003d0900000000 x12: 0000000000000000 x11: 00003d0900000000 x10: 0000000000000040 x9 : ffff800012708cb8 x8 : ffff800012708cb0 x7 : ffff0008f7c7a9d0 x6 : 0000000000000000 x5 : ffff0008f7c7a910 x4 : ffff8008ed359000 x3 : ffff800010003f40 x2 : 0000000000000000 x1 : ffff0008f5061a80 x0 : ffff800010161a60 Call trace: cdns3_device_irq_handler+0x1c/0xb8 __handle_irq_event_percpu+0x78/0x2c0 handle_irq_event_percpu+0x40/0x98 handle_irq_event+0x4c/0xd0 handle_fasteoi_irq+0xbc/0x168 generic_handle_irq+0x34/0x50 __handle_domain_irq+0x6c/0xc0 gic_handle_irq+0xd4/0x174 el1_irq+0xb8/0x180 arch_cpu_idle+0x3c/0x230 default_idle_call+0x38/0x40 do_idle+0x20c/0x298 cpu_startup_entry+0x28/0x48 rest_init+0xdc/0xe8 arch_call_rest_init+0x14/0x1c start_kernel+0x48c/0x4b8 Code: aa0103f3 aa1e03e0 d503201f f9409662 (f941c040) ---[ end trace 091dcf4dee011b0e ]--- Kernel panic - not syncing: Fatal exception in interrupt SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x0002,2100600c Memory Limit: none ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: #v5.4 Signed-off-by: Peter Chen Link: https://lore.kernel.org/r/1577437804-18146-1-git-send-email-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman commit ea0d762775e20aaff7909a3f0866ff1688b1c618 Author: Thinh Nguyen Date: Fri Dec 13 18:40:45 2019 -0800 usb: dwc3: gadget: Fix request complete check We can only check for IN direction if the request had completed. For OUT direction, it's perfectly fine that the host can send less than the setup length. Let's return true fall all cases of OUT direction. Fixes: e0c42ce590fe ("usb: dwc3: gadget: simplify IOC handling") Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen Link: https://lore.kernel.org/r/ac5a3593a94fdaa3d92e6352356b5f7a01ccdc7c.1576291140.git.thinhn@synopsys.com Signed-off-by: Greg Kroah-Hartman commit c80d0f4426c7fdc7efd6ae8d8b021dcfc89b4254 Author: Paul Cercueil Date: Mon Dec 16 10:18:43 2019 -0600 usb: musb: dma: Correct parameter passed to IRQ handler The IRQ handler was passed a pointer to a struct dma_controller, but the argument was then casted to a pointer to a struct musb_dma_controller. Fixes: 427c4f333474 ("usb: struct device - replace bus_id with dev_name(), dev_set_name()") Signed-off-by: Paul Cercueil Tested-by: Artur Rojek Cc: stable@vger.kernel.org Signed-off-by: Bin Liu Link: https://lore.kernel.org/r/20191216161844.772-2-b-liu@ti.com Signed-off-by: Greg Kroah-Hartman commit ce03cbcb4b4fd2a3817f32366001f1ca45d213b8 Author: Paul Cercueil Date: Mon Dec 16 10:24:32 2019 -0600 usb: musb: jz4740: Silence error if code is -EPROBE_DEFER Avoid printing any error message if the error code is -EPROBE_DEFER. Signed-off-by: Paul Cercueil Signed-off-by: Bin Liu Link: https://lore.kernel.org/r/20191216162432.1256-1-b-liu@ti.com Signed-off-by: Greg Kroah-Hartman commit f6ece9b0e52a3ec9fa00281a0d4675a36f8da071 Author: Arnd Bergmann Date: Mon Dec 16 14:18:18 2019 +0100 usb: udc: tegra: select USB_ROLE_SWITCH Without this, this new driver fails to link: drivers/usb/gadget/udc/tegra-xudc.o: In function `tegra_xudc_remove': tegra-xudc.c:(.text+0x19d4): undefined reference to `usb_role_switch_unregister' drivers/usb/gadget/udc/tegra-xudc.o: In function `tegra_xudc_probe': tegra-xudc.c:(.text+0x2a34): undefined reference to `usb_role_switch_register' drivers/usb/gadget/udc/tegra-xudc.o: In function `tegra_xudc_usb_role_sw_work': tegra-xudc.c:(.text+0x4b64): undefined reference to `usb_role_switch_get_role' Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20191216131831.3228566-1-arnd@arndb.de Signed-off-by: Greg Kroah-Hartman commit 3e4f8e21c4f27bcf30a48486b9dcc269512b79ff Author: Johan Hovold Date: Thu Dec 19 17:10:16 2019 +0100 USB: core: fix check for duplicate endpoints Amend the endpoint-descriptor sanity checks to detect all duplicate endpoint addresses in a configuration. Commit 0a8fd1346254 ("USB: fix problems with duplicate endpoint addresses") added a check for duplicate endpoint addresses within a single alternate setting, but did not look for duplicate addresses in other interfaces. The current check would also not detect all duplicate addresses when one endpoint is as a (bi-directional) control endpoint. This specifically avoids overwriting the endpoint entries in struct usb_device when enabling a duplicate endpoint, something which could potentially lead to crashes or leaks, for example, when endpoints are later disabled. Cc: stable Signed-off-by: Johan Hovold Acked-by: Alan Stern Link: https://lore.kernel.org/r/20191219161016.6695-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 273f632912f1b24b642ba5b7eb5022e43a72f3b5 Author: Sudip Mukherjee Date: Fri Dec 27 17:44:34 2019 +0000 tty: always relink the port If the serial device is disconnected and reconnected, it re-enumerates properly but does not link it. fwiw, linking means just saving the port index, so allow it always as there is no harm in saving the same value again even if it tries to relink with the same port. Fixes: fb2b90014d78 ("tty: link tty and port before configuring it as console") Reported-by: Kenneth R. Crudup Signed-off-by: Sudip Mukherjee Cc: stable Link: https://lore.kernel.org/r/20191227174434.12057-1-sudipm.mukherjee@gmail.com Signed-off-by: Greg Kroah-Hartman commit e278af89f1ba0a9ef20947db6afc2c9afa37e85b Author: Qian Cai Date: Tue Dec 10 22:30:42 2019 -0500 x86/resctrl: Fix an imbalance in domain_remove_cpu() A system that supports resource monitoring may have multiple resources while not all of these resources are capable of monitoring. Monitoring related state is initialized only for resources that are capable of monitoring and correspondingly this state should subsequently only be removed from these resources that are capable of monitoring. domain_add_cpu() calls domain_setup_mon_state() only when r->mon_capable is true where it will initialize d->mbm_over. However, domain_remove_cpu() calls cancel_delayed_work(&d->mbm_over) without checking r->mon_capable resulting in an attempt to cancel d->mbm_over on all resources, even those that never initialized d->mbm_over because they are not capable of monitoring. Hence, it triggers a debugobjects warning when offlining CPUs because those timer debugobjects are never initialized: ODEBUG: assert_init not available (active state 0) object type: timer_list hint: 0x0 WARNING: CPU: 143 PID: 789 at lib/debugobjects.c:484 debug_print_object Hardware name: HP Synergy 680 Gen9/Synergy 680 Gen9 Compute Module, BIOS I40 05/23/2018 RIP: 0010:debug_print_object Call Trace: debug_object_assert_init del_timer try_to_grab_pending cancel_delayed_work resctrl_offline_cpu cpuhp_invoke_callback cpuhp_thread_fun smpboot_thread_fn kthread ret_from_fork Fixes: e33026831bdb ("x86/intel_rdt/mbm: Handle counter overflow") Signed-off-by: Qian Cai Signed-off-by: Borislav Petkov Acked-by: Reinette Chatre Cc: Fenghua Yu Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: john.stultz@linaro.org Cc: sboyd@kernel.org Cc: Cc: Thomas Gleixner Cc: tj@kernel.org Cc: Tony Luck Cc: Vikas Shivappa Cc: x86-ml Link: https://lkml.kernel.org/r/20191211033042.2188-1-cai@lca.pw commit c7d776f85dfe5159ebf621ee1e50e555237b1a25 Author: Damien Le Moal Date: Thu Dec 26 15:54:25 2019 +0900 null_blk: Fix REQ_OP_ZONE_CLOSE handling In order to match ZBC defined behavior, closing an empty zone must result in the "empty" zone condition instead of the "closed" condition. Fixes: da644b2cc1a4 ("null_blk: add zone open, close, and finish support") Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 429120f3df2dba2bf3a4a19f4212a53ecefc7102 Author: Ming Lei Date: Sun Dec 29 10:32:30 2019 +0800 block: fix splitting segments on boundary masks We ran into a problem with a mpt3sas based controller, where we would see random (and hard to reproduce) file corruption). The issue seemed specific to this controller, but wasn't specific to the file system. After a lot of debugging, we find out that it's caused by segments spanning a 4G memory boundary. This shouldn't happen, as the default setting for segment boundary masks is 4G. Turns out there are two issues in get_max_segment_size(): 1) The default segment boundary mask is bypassed 2) The segment start address isn't taken into account when checking segment boundary limit Fix these two issues by removing the bypass of the segment boundary check even if the mask is set to the default value, and taking into account the actual start address of the request when checking if a segment needs splitting. Cc: stable@vger.kernel.org # v5.1+ Reviewed-by: Chris Mason Tested-by: Chris Mason Fixes: dcebd755926b ("block: use bio_for_each_bvec() to compute multi-page bvec count") Signed-off-by: Ming Lei Dropped const on the page pointer, ppc page_to_phys() doesn't mark the page as const... Signed-off-by: Jens Axboe commit de7999afedff02c6631feab3ea726a0e8f8c3d40 Author: Filipe Manana Date: Wed Dec 11 09:01:40 2019 +0000 Btrfs: fix infinite loop during nocow writeback due to race When starting writeback for a range that covers part of a preallocated extent, due to a race with writeback for another range that also covers another part of the same preallocated extent, we can end up in an infinite loop. Consider the following example where for inode 280 we have two dirty ranges: range A, from 294912 to 303103, 8192 bytes range B, from 348160 to 438271, 90112 bytes and we have the following file extent item layout for our inode: leaf 38895616 gen 24544 total ptrs 29 free space 13820 owner 5 (...) item 27 key (280 108 200704) itemoff 14598 itemsize 53 extent data disk bytenr 0 nr 0 type 1 (regular) extent data offset 0 nr 94208 ram 94208 item 28 key (280 108 294912) itemoff 14545 itemsize 53 extent data disk bytenr 10433052672 nr 81920 type 2 (prealloc) extent data offset 0 nr 81920 ram 81920 Then the following happens: 1) Writeback starts for range B (from 348160 to 438271), execution of run_delalloc_nocow() starts; 2) The first iteration of run_delalloc_nocow()'s whil loop leaves us at the extent item at slot 28, pointing to the prealloc extent item covering the range from 294912 to 376831. This extent covers part of our range; 3) An ordered extent is created against that extent, covering the file range from 348160 to 376831 (28672 bytes); 4) We adjust 'cur_offset' to 376832 and move on to the next iteration of the while loop; 5) The call to btrfs_lookup_file_extent() leaves us at the same leaf, pointing to slot 29, 1 slot after the last item (the extent item we processed in the previous iteration); 6) Because we are a slot beyond the last item, we call btrfs_next_leaf(), which releases the search path before doing a another search for the last key of the leaf (280 108 294912); 7) Right after btrfs_next_leaf() released the path, and before it did another search for the last key of the leaf, writeback for the range A (from 294912 to 303103) completes (it was previously started at some point); 8) Upon completion of the ordered extent for range A, the prealloc extent we previously found got split into two extent items, one covering the range from 294912 to 303103 (8192 bytes), with a type of regular extent (and no longer prealloc) and another covering the range from 303104 to 376831 (73728 bytes), with a type of prealloc and an offset of 8192 bytes. So our leaf now has the following layout: leaf 38895616 gen 24544 total ptrs 31 free space 13664 owner 5 (...) item 27 key (280 108 200704) itemoff 14598 itemsize 53 extent data disk bytenr 0 nr 0 type 1 extent data offset 0 nr 8192 ram 94208 item 28 key (280 108 208896) itemoff 14545 itemsize 53 extent data disk bytenr 10433142784 nr 86016 type 1 extent data offset 0 nr 86016 ram 86016 item 29 key (280 108 294912) itemoff 14492 itemsize 53 extent data disk bytenr 10433052672 nr 81920 type 1 extent data offset 0 nr 8192 ram 81920 item 30 key (280 108 303104) itemoff 14439 itemsize 53 extent data disk bytenr 10433052672 nr 81920 type 2 extent data offset 8192 nr 73728 ram 81920 9) After btrfs_next_leaf() returns, we have our path pointing to that same leaf and at slot 30, since it has a key we didn't have before and it's the first key greater then the key that was previously the last key of the leaf (key (280 108 294912)); 10) The extent item at slot 30 covers the range from 303104 to 376831 which is in our target range, so we process it, despite having already created an ordered extent against this extent for the file range from 348160 to 376831. This is because we skip to the next extent item only if its end is less than or equals to the start of our delalloc range, and not less than or equals to the current offset ('cur_offset'); 11) As a result we compute 'num_bytes' as: num_bytes = min(end + 1, extent_end) - cur_offset; = min(438271 + 1, 376832) - 376832 = 0 12) We then call create_io_em() for a 0 bytes range starting at offset 376832; 13) Then create_io_em() enters an infinite loop because its calls to btrfs_drop_extent_cache() do nothing due to the 0 length range passed to it. So no existing extent maps that cover the offset 376832 get removed, and therefore calls to add_extent_mapping() return -EEXIST, resulting in an infinite loop. This loop from create_io_em() is the following: do { btrfs_drop_extent_cache(BTRFS_I(inode), em->start, em->start + em->len - 1, 0); write_lock(&em_tree->lock); ret = add_extent_mapping(em_tree, em, 1); write_unlock(&em_tree->lock); /* * The caller has taken lock_extent(), who could race with us * to add em? */ } while (ret == -EEXIST); Also, each call to btrfs_drop_extent_cache() triggers a warning because the start offset passed to it (376832) is smaller then the end offset (376832 - 1) passed to it by -1, due to the 0 length: [258532.052621] ------------[ cut here ]------------ [258532.052643] WARNING: CPU: 0 PID: 9987 at fs/btrfs/file.c:602 btrfs_drop_extent_cache+0x3f4/0x590 [btrfs] (...) [258532.052672] CPU: 0 PID: 9987 Comm: fsx Tainted: G W 5.4.0-rc7-btrfs-next-64 #1 [258532.052673] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 [258532.052691] RIP: 0010:btrfs_drop_extent_cache+0x3f4/0x590 [btrfs] (...) [258532.052695] RSP: 0018:ffffb4be0153f860 EFLAGS: 00010287 [258532.052700] RAX: ffff975b445ee360 RBX: ffff975b44eb3e08 RCX: 0000000000000000 [258532.052700] RDX: 0000000000038fff RSI: 0000000000039000 RDI: ffff975b445ee308 [258532.052700] RBP: 0000000000038fff R08: 0000000000000000 R09: 0000000000000001 [258532.052701] R10: ffff975b513c5c10 R11: 00000000e3c0cfa9 R12: 0000000000039000 [258532.052703] R13: ffff975b445ee360 R14: 00000000ffffffef R15: ffff975b445ee308 [258532.052705] FS: 00007f86a821de80(0000) GS:ffff975b76a00000(0000) knlGS:0000000000000000 [258532.052707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [258532.052708] CR2: 00007fdacf0f3ab4 CR3: 00000001f9d26002 CR4: 00000000003606f0 [258532.052712] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [258532.052717] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [258532.052717] Call Trace: [258532.052718] ? preempt_schedule_common+0x32/0x70 [258532.052722] ? ___preempt_schedule+0x16/0x20 [258532.052741] create_io_em+0xff/0x180 [btrfs] [258532.052767] run_delalloc_nocow+0x942/0xb10 [btrfs] [258532.052791] btrfs_run_delalloc_range+0x30b/0x520 [btrfs] [258532.052812] ? find_lock_delalloc_range+0x221/0x250 [btrfs] [258532.052834] writepage_delalloc+0xe4/0x140 [btrfs] [258532.052855] __extent_writepage+0x110/0x4e0 [btrfs] [258532.052876] extent_write_cache_pages+0x21c/0x480 [btrfs] [258532.052906] extent_writepages+0x52/0xb0 [btrfs] [258532.052911] do_writepages+0x23/0x80 [258532.052915] __filemap_fdatawrite_range+0xd2/0x110 [258532.052938] btrfs_fdatawrite_range+0x1b/0x50 [btrfs] [258532.052954] start_ordered_ops+0x57/0xa0 [btrfs] [258532.052973] ? btrfs_sync_file+0x225/0x490 [btrfs] [258532.052988] btrfs_sync_file+0x225/0x490 [btrfs] [258532.052997] __x64_sys_msync+0x199/0x200 [258532.053004] do_syscall_64+0x5c/0x250 [258532.053007] entry_SYSCALL_64_after_hwframe+0x49/0xbe [258532.053010] RIP: 0033:0x7f86a7dfd760 (...) [258532.053014] RSP: 002b:00007ffd99af0368 EFLAGS: 00000246 ORIG_RAX: 000000000000001a [258532.053016] RAX: ffffffffffffffda RBX: 0000000000000ec9 RCX: 00007f86a7dfd760 [258532.053017] RDX: 0000000000000004 RSI: 000000000000836c RDI: 00007f86a8221000 [258532.053019] RBP: 0000000000021ec9 R08: 0000000000000003 R09: 00007f86a812037c [258532.053020] R10: 0000000000000001 R11: 0000000000000246 R12: 00000000000074a3 [258532.053021] R13: 00007f86a8221000 R14: 000000000000836c R15: 0000000000000001 [258532.053032] irq event stamp: 1653450494 [258532.053035] hardirqs last enabled at (1653450493): [] _raw_spin_unlock_irq+0x29/0x50 [258532.053037] hardirqs last disabled at (1653450494): [] trace_hardirqs_off_thunk+0x1a/0x20 [258532.053039] softirqs last enabled at (1653449852): [] __do_softirq+0x466/0x6bd [258532.053042] softirqs last disabled at (1653449845): [] irq_exit+0xec/0x120 [258532.053043] ---[ end trace 8476fce13d9ce20a ]--- Which results in flooding dmesg/syslog since btrfs_drop_extent_cache() uses WARN_ON() and not WARN_ON_ONCE(). So fix this issue by changing run_delalloc_nocow()'s loop to move to the next extent item when the current extent item ends at at offset less than or equals to the current offset instead of the start offset. Fixes: 80ff385665b7fc ("Btrfs: update nodatacow code v2") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 46bcff2bfc5e6a8c638d3a32e4f6f6fa4bd01461 Author: Dennis Zhou Date: Wed Dec 11 15:20:15 2019 -0800 btrfs: fix compressed write bio blkcg attribution Bio attribution is handled at bio_set_dev() as once we have a device, we have a corresponding request_queue and then can derive the current css. In special cases, we want to attribute to bio to someone else. This can be done by calling bio_associate_blkg_from_css() or kthread_associate_blkcg() depending on the scenario. Btrfs does this for compressed writeback as they are handled by kworkers, so the latter can be done here. Commit 1a41802701ec ("btrfs: drop bio_set_dev where not needed") removes early bio_set_dev() calls prior to submit_stripe_bio(). This breaks the above assumption that we'll have a request_queue when we are doing association. To fix this, switch to using kthread_associate_blkcg(). Without this, we crash in btrfs/024: [ 3052.093088] BUG: kernel NULL pointer dereference, address: 0000000000000510 [ 3052.107013] #PF: supervisor read access in kernel mode [ 3052.107014] #PF: error_code(0x0000) - not-present page [ 3052.107015] PGD 0 P4D 0 [ 3052.107021] Oops: 0000 [#1] SMP [ 3052.138904] CPU: 42 PID: 201270 Comm: kworker/u161:0 Kdump: loaded Not tainted 5.5.0-rc1-00062-g4852d8ac90a9 #712 [ 3052.138905] Hardware name: Quanta Tioga Pass Single Side 01-0032211004/Tioga Pass Single Side, BIOS F08_3A18 12/20/2018 [ 3052.138912] Workqueue: btrfs-delalloc btrfs_work_helper [ 3052.191375] RIP: 0010:bio_associate_blkg_from_css+0x1e/0x3c0 [ 3052.191379] RSP: 0018:ffffc900210cfc90 EFLAGS: 00010282 [ 3052.191380] RAX: 0000000000000000 RBX: ffff88bfe5573c00 RCX: 0000000000000000 [ 3052.191382] RDX: ffff889db48ec2f0 RSI: ffff88bfe5573c00 RDI: ffff889db48ec2f0 [ 3052.191386] RBP: 0000000000000800 R08: 0000000000203bb0 R09: ffff889db16b2400 [ 3052.293364] R10: 0000000000000000 R11: ffff88a07fffde80 R12: ffff889db48ec2f0 [ 3052.293365] R13: 0000000000001000 R14: ffff889de82bc000 R15: ffff889e2b7bdcc8 [ 3052.293367] FS: 0000000000000000(0000) GS:ffff889ffba00000(0000) knlGS:0000000000000000 [ 3052.293368] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3052.293369] CR2: 0000000000000510 CR3: 0000000002611001 CR4: 00000000007606e0 [ 3052.293370] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3052.293371] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3052.293372] PKRU: 55555554 [ 3052.293376] Call Trace: [ 3052.402552] btrfs_submit_compressed_write+0x137/0x390 [ 3052.402558] submit_compressed_extents+0x40f/0x4c0 [ 3052.422401] btrfs_work_helper+0x246/0x5a0 [ 3052.422408] process_one_work+0x200/0x570 [ 3052.438601] ? process_one_work+0x180/0x570 [ 3052.438605] worker_thread+0x4c/0x3e0 [ 3052.438614] kthread+0x103/0x140 [ 3052.460735] ? process_one_work+0x570/0x570 [ 3052.460737] ? kthread_mod_delayed_work+0xc0/0xc0 [ 3052.460744] ret_from_fork+0x24/0x30 Fixes: 1a41802701ec ("btrfs: drop bio_set_dev where not needed") Reported-by: Chris Murphy Signed-off-by: Dennis Zhou Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7b62e66cbbfb463a39bf83e30bdbbb4b9e83fa03 Author: Dennis Zhou Date: Wed Dec 11 16:07:06 2019 -0800 btrfs: punt all bios created in btrfs_submit_compressed_write() Compressed writes happen in the background via kworkers. However, this causes bios to be attributed to root bypassing any cgroup limits from the actual writer. We tag the first bio with REQ_CGROUP_PUNT, which will punt the bio to an appropriate cgroup specific workqueue and attribute the IO properly. However, if btrfs_submit_compressed_write() creates a new bio, we don't tag it the same way. Add the appropriate tagging for subsequent bios. Fixes: ec39f7696ccfa ("Btrfs: use REQ_CGROUP_PUNT for worker thread submitted bios") Reviewed-by: Chris Mason Signed-off-by: Dennis Zhou Reviewed-by: David Sterba Signed-off-by: David Sterba commit dcbce5fbcc69bf2553f650004aad44bf390eca73 Author: Russell King Date: Fri Nov 29 14:51:35 2019 +0000 watchdog: orion: fix platform_get_irq() complaints Fix: orion_wdt f1020300.watchdog: IRQ index 1 not found which is caused by platform_get_irq() now complaining when optional IRQs are not found. Neither interrupt for orion is required, so make them both optional. Signed-off-by: Russell King Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/E1iahcN-0000AT-Co@rmk-PC.armlinux.org.uk Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a76dfb859cd42df6e3d1910659128ffcd2fb6ba2 Author: Andreas Kemnade Date: Fri Dec 13 22:48:02 2019 +0100 watchdog: rn5t618_wdt: fix module aliases Platform device aliases were missing so module autoloading did not work. Signed-off-by: Andreas Kemnade Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191213214802.22268-1-andreas@kemnade.info Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9a6c274ac1c4346f5384f2290caeb42dc674c471 Author: YueHaibing Date: Fri Dec 6 20:42:59 2019 +0800 watchdog: tqmx86_wdt: Fix build error If TQMX86_WDT is y and WATCHDOG_CORE is m, building fails: drivers/watchdog/tqmx86_wdt.o: In function `tqmx86_wdt_probe': tqmx86_wdt.c:(.text+0x46e): undefined reference to `watchdog_init_timeout' tqmx86_wdt.c:(.text+0x4e0): undefined reference to `devm_watchdog_register_device' Select WATCHDOG_CORE to fix this. Reported-by: Hulk Robot Fixes: e3c21e088f89 ("watchdog: tqmx86: Add watchdog driver for the IO controller") Signed-off-by: YueHaibing Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191206124259.25880-1-yuehaibing@huawei.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit da9e3f4e30a53cd420cf1e6961c3b4110f0f21f0 Author: David Engraf Date: Wed Nov 27 09:46:17 2019 +0100 watchdog: max77620_wdt: fix potential build errors max77620_wdt uses watchdog core functions. Enable CONFIG_WATCHDOG_CORE to fix potential build errors. Signed-off-by: David Engraf Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191127084617.16937-1-david.engraf@sysgo.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 91ced83c6eab0d17d845d290c0266ed7ad04fa79 Author: Fabio Estevam Date: Wed Nov 20 11:09:16 2019 -0300 watchdog: imx7ulp: Fix missing conversion of imx7ulp_wdt_enable() Since commit 747d88a1a88c1b ("watchdog: imx7ulp: Pass the wdog instance in imx7ulp_wdt_enable()") imx7ulp_wdt_enable() accepts a watchdog_device structure, so fix one instance that missed such conversion. This also fixes the following sparse warning: drivers/watchdog/imx7ulp_wdt.c:115:31: warning: incorrect type in argument 1 (different address spaces) drivers/watchdog/imx7ulp_wdt.c:115:31: expected struct watchdog_device *wdog drivers/watchdog/imx7ulp_wdt.c:115:31: got void [noderef] *base Fixes: 747d88a1a88c1 ("watchdog: imx7ulp: Pass the wdog instance inimx7ulp_wdt_enable()") Signed-off-by: Fabio Estevam Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191120140916.25001-1-festevam@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit afcd5b9be566e43f4433ebcdd4de2c4e9054fd65 Author: Srikanth Krishnakar Date: Wed Sep 18 21:34:58 2019 +0530 watchdog: w83627hf_wdt: Fix support NCT6116D We should select nct6116 for the new chip, not nct6102. Signed-off-by: Srikanth Krishnakar Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 205608749e1ef394f513888091e613c5bfccbcca Author: Mehmet Akif Tasova Date: Fri Dec 13 23:35:10 2019 +0300 Revert "iwlwifi: mvm: fix scan config command size" Since v5.4-rc1 was released, iwlwifi started throwing errors when scan commands were sent to the firmware with certain devices (depending on the OTP burned in the device, which contains the list of available channels). For instance: iwlwifi 0000:00:14.3: FW error in SYNC CMD SCAN_CFG_CMD This bug was reported in the ArchLinux bug tracker: https://bugs.archlinux.org/task/64703 And also in a specific case in bugzilla, when the lar_disabled option was set: https://bugzilla.kernel.org/show_bug.cgi?id=205193 Revert the commit that introduced this error, by using the number of channels from the OTP instead of the number of channels that is specified in the FW TLV that tells us how many channels it supports. This reverts commit 06eb547c4ae4382e70d556ba213d13c95ca1801b. Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Mehmet Akif Tasova [ Luca: reworded the commit message a bit. ] Signed-off-by: Luca Coelho commit 1b789577f655060d98d20ed0c6f9fbd469d6ba63 Author: Florian Westphal Date: Fri Dec 27 01:33:10 2019 +0100 netfilter: arp_tables: init netns pointer in xt_tgchk_param struct We get crash when the targets checkentry function tries to make use of the network namespace pointer for arptables. When the net pointer got added back in 2010, only ip/ip6/ebtables were changed to initialize it, so arptables has this set to NULL. This isn't a problem for normal arptables because no existing arptables target has a checkentry function that makes use of par->net. However, direct users of the setsockopt interface can provide any target they want as long as its registered for ARP or UNPSEC protocols. syzkaller managed to send a semi-valid arptables rule for RATEEST target which is enough to trigger NULL deref: kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN RIP: xt_rateest_tg_checkentry+0x11d/0xb40 net/netfilter/xt_RATEEST.c:109 [..] xt_check_target+0x283/0x690 net/netfilter/x_tables.c:1019 check_target net/ipv4/netfilter/arp_tables.c:399 [inline] find_check_entry net/ipv4/netfilter/arp_tables.c:422 [inline] translate_table+0x1005/0x1d70 net/ipv4/netfilter/arp_tables.c:572 do_replace net/ipv4/netfilter/arp_tables.c:977 [inline] do_arpt_set_ctl+0x310/0x640 net/ipv4/netfilter/arp_tables.c:1456 Fixes: add67461240c1d ("netfilter: add struct net * to target parameters") Reported-by: syzbot+d7358a458d8a81aee898@syzkaller.appspotmail.com Signed-off-by: Florian Westphal Acked-by: Cong Wang Signed-off-by: Pablo Neira Ayuso commit 6da3eced8c5f3b03340b0c395bacd552c4d52411 Author: Jason A. Donenfeld Date: Mon Dec 23 14:31:47 2019 +0100 powerpc/spinlocks: Include correct header for static key Recently, the spinlock implementation grew a static key optimization, but the jump_label.h header include was left out, leading to build errors: linux/arch/powerpc/include/asm/spinlock.h:44:7: error: implicit declaration of function ‘static_branch_unlikely’ 44 | if (!static_branch_unlikely(&shared_processor)) This commit adds the missing header. mpe: The build break is only seen with CONFIG_JUMP_LABEL=n. Fixes: 656c21d6af5d ("powerpc/shared: Use static key to detect shared processor") Signed-off-by: Jason A. Donenfeld Reviewed-by: Srikar Dronamraju Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191223133147.129983-1-Jason@zx2c4.com commit 060dc911501f6ee222569304f50962172a52b1d6 Author: Mike Rapoport Date: Mon Dec 23 13:00:04 2019 +0200 nds32: fix build failure caused by page table folding updates The commit 7c2763c42326 ("nds32: use pgtable-nopmd instead of 4level-fixup") missed the pmd_off_k() macro which caused the following build error: CC arch/nds32/mm/highmem.o In file included from arch/nds32/include/asm/page.h:57, from include/linux/mm_types_task.h:16, from include/linux/mm_types.h:5, from include/linux/mmzone.h:21, from include/linux/gfp.h:6, from include/linux/xarray.h:14, from include/linux/radix-tree.h:18, from include/linux/fs.h:15, from include/linux/highmem.h:5, from arch/nds32/mm/highmem.c:5: arch/nds32/mm/highmem.c: In function 'kmap_atomic': arch/nds32/include/asm/pgtable.h:360:44: error: passing argument 1 of 'pmd_offset' from incompatible pointer type [-Werror=incompatible-pointer-types] #define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address)) ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ arch/nds32/include/asm/memory.h:33:29: note: in definition of macro '__phys_to_virt' #define __phys_to_virt(x) ((x) - PHYS_OFFSET + PAGE_OFFSET) ^ arch/nds32/include/asm/pgtable.h:193:55: note: in expansion of macro '__va' #define pmd_page_kernel(pmd) ((unsigned long) __va(pmd_val(pmd) & PAGE_MASK)) ^~~~ include/asm-generic/pgtable-nop4d.h:41:24: note: in expansion of macro 'pgd_val' #define p4d_val(x) (pgd_val((x).pgd)) ^~~~~~~ include/asm-generic/pgtable-nopud.h:50:24: note: in expansion of macro 'p4d_val' #define pud_val(x) (p4d_val((x).p4d)) ^~~~~~~ include/asm-generic/pgtable-nopmd.h:49:24: note: in expansion of macro 'pud_val' #define pmd_val(x) (pud_val((x).pud)) ^~~~~~~ arch/nds32/include/asm/pgtable.h:193:60: note: in expansion of macro 'pmd_val' #define pmd_page_kernel(pmd) ((unsigned long) __va(pmd_val(pmd) & PAGE_MASK)) ^~~~~~~ arch/nds32/include/asm/pgtable.h:190:56: note: in expansion of macro 'pmd_page_kernel' #define pte_offset_kernel(dir, address) ((pte_t *)pmd_page_kernel(*(dir)) + pte_index(address)) ^~~~~~~~~~~~~~~ arch/nds32/mm/highmem.c:52:9: note: in expansion of macro 'pte_offset_kernel' ptep = pte_offset_kernel(pmd_off_k(vaddr), vaddr); ^~~~~~~~~~~~~~~~~ arch/nds32/include/asm/pgtable.h:362:33: note: in expansion of macro 'pgd_offset' #define pgd_offset_k(addr) pgd_offset(&init_mm, addr) ^~~~~~~~~~ arch/nds32/include/asm/pgtable.h:198:39: note: in expansion of macro 'pgd_offset_k' #define pmd_off_k(address) pmd_offset(pgd_offset_k(address), address) ^~~~~~~~~~~~ arch/nds32/mm/highmem.c:52:27: note: in expansion of macro 'pmd_off_k' ptep = pte_offset_kernel(pmd_off_k(vaddr), vaddr); ^~~~~~~~~ In file included from arch/nds32/include/asm/pgtable.h:7, from include/linux/mm.h:99, from include/linux/highmem.h:8, from arch/nds32/mm/highmem.c:5: include/asm-generic/pgtable-nopmd.h:44:42: note: expected 'pud_t *' {aka 'struct *'} but argument is of type 'pgd_t *' {aka 'long unsigned int *'} static inline pmd_t * pmd_offset(pud_t * pud, unsigned long address) ~~~~~~~~^~~ In file included from arch/nds32/include/asm/page.h:57, from include/linux/mm_types_task.h:16, from include/linux/mm_types.h:5, from include/linux/mmzone.h:21, from include/linux/gfp.h:6, from include/linux/xarray.h:14, from include/linux/radix-tree.h:18, from include/linux/fs.h:15, from include/linux/highmem.h:5, from arch/nds32/mm/highmem.c:5: Updating the pmd_off_k() macro to use the correct page table unfolding fixes the issue. Fixes: 7c2763c42326 ("nds32: use pgtable-nopmd instead of 4level-fixup") Link: https://lore.kernel.org/lkml/201912212139.yptX8CsV%25lkp@intel.com/ Reported-by: kbuild test robot Signed-off-by: Mike Rapoport Reviewed-by: Greentime Hu Signed-off-by: Arnd Bergmann commit 4f0bd808134d73184054ad09173821c84f31dd5d Author: Mike Rapoport Date: Mon Dec 23 13:00:03 2019 +0200 asm-generic/nds32: don't redefine cacheflush primitives The commit c296d4dc13ae ("asm-generic: fix a compilation warning") changed asm-generic/cachflush.h to use static inlines instead of macros and as a result the nds32 build with CONFIG_CPU_CACHE_ALIASING=n fails: CC init/main.o In file included from arch/nds32/include/asm/cacheflush.h:43, from include/linux/highmem.h:12, from include/linux/pagemap.h:11, from include/linux/blkdev.h:16, from include/linux/blk-cgroup.h:23, from include/linux/writeback.h:14, from init/main.c:44: include/asm-generic/cacheflush.h:50:20: error: static declaration of 'flush_icache_range' follows non-static declaration static inline void flush_icache_range(unsigned long start, unsigned long end) ^~~~~~~~~~~~~~~~~~ In file included from include/linux/highmem.h:12, from include/linux/pagemap.h:11, from include/linux/blkdev.h:16, from include/linux/blk-cgroup.h:23, from include/linux/writeback.h:14, from init/main.c:44: arch/nds32/include/asm/cacheflush.h:11:6: note: previous declaration of 'flush_icache_range' was here void flush_icache_range(unsigned long start, unsigned long end); ^~~~~~~~~~~~~~~~~~ Surround the inline functions in asm-generic/cacheflush.h by ifdef's so that architectures could override them and add the required overrides to nds32. Fixes: c296d4dc13ae ("asm-generic: fix a compilation warning") Link: https://lore.kernel.org/lkml/201912212139.yptX8CsV%25lkp@intel.com/ Reported-by: kbuild test robot Signed-off-by: Mike Rapoport Reviewed-by: Greentime Hu Signed-off-by: Arnd Bergmann commit 48e01504cf5315cbe6de9b7412e792bfcc3dd9e1 Author: Chris Chiu Date: Mon Dec 30 11:11:18 2019 +0800 ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC ASUS reported that there's an bass speaker in addition to internal speaker and it uses DAC 0x02. It was not enabled in the commit 436e25505f34 ("ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC") which only enables the amplifier and the front speaker. This commit enables the bass speaker on top of the aforementioned work to improve the acoustic experience. Fixes: 436e25505f34 ("ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC") Signed-off-by: Chris Chiu Signed-off-by: Jian-Hong Pan Cc: Link: https://lore.kernel.org/r/20191230031118.95076-1-chiu@endlessm.com Signed-off-by: Takashi Iwai commit fd6988496e79a6a4bdb514a4655d2920209eb85d Author: Linus Torvalds Date: Sun Dec 29 15:29:16 2019 -0800 Linux 5.5-rc4 commit 1479a82d82df68dfac29c72c774cb8bdc17d4eb1 Author: Srinivas Pandruvada Date: Fri Dec 27 13:40:57 2019 -0800 HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID Added Tiger Lake PCI device ID to the supported device list. Signed-off-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit 3faf6eda74c236bd87eef8e415d976e5a8cd6a5a Merge: bd6f48546b9c acca789a358c Author: David S. Miller Date: Sun Dec 29 12:29:14 2019 -0800 Merge branch 'mlxsw-fixes' Ido Schimmel says: ==================== mlxsw: Couple of fixes This patch set contains two fixes for mlxsw. Please consider both for stable. Patch #1 from Amit fixes a wrong check during MAC validation when creating router interfaces (RIFs). Given a particular order of configuration this can result in the driver refusing to create new RIFs. Patch #2 fixes a wrong trap configuration in which VRRP packets and routing exceptions were policed by the same policer towards the CPU. In certain situations this can prevent VRRP packets from reaching the CPU. ==================== Signed-off-by: David S. Miller commit acca789a358cc960be3937851d7de6591c79d6c2 Author: Ido Schimmel Date: Sun Dec 29 13:40:23 2019 +0200 mlxsw: spectrum: Use dedicated policer for VRRP packets Currently, VRRP packets and packets that hit exceptions during routing (e.g., MTU error) are policed using the same policer towards the CPU. This means, for example, that misconfiguration of the MTU on a routed interface can prevent VRRP packets from reaching the CPU, which in turn can cause the VRRP daemon to assume it is the Master router. Fix this by using a dedicated policer for VRRP packets. Fixes: 11566d34f895 ("mlxsw: spectrum: Add VRRP traps") Signed-off-by: Ido Schimmel Reported-by: Alex Veber Tested-by: Alex Veber Signed-off-by: David S. Miller commit 314bd842d98e1035cc40b671a71e07f48420e58f Author: Amit Cohen Date: Sun Dec 29 13:40:22 2019 +0200 mlxsw: spectrum_router: Skip loopback RIFs during MAC validation When a router interface (RIF) is created the MAC address of the backing netdev is verified to have the same MSBs as existing RIFs. This is required in order to avoid changing existing RIF MAC addresses that all share the same MSBs. Loopback RIFs are special in this regard as they do not have a MAC address, given they are only used to loop packets from the overlay to the underlay. Without this change, an error is returned when trying to create a RIF after the creation of a GRE tunnel that is represented by a loopback RIF. 'rif->dev->dev_addr' points to the GRE device's local IP, which does not share the same MSBs as physical interfaces. Adding an IP address to any physical interface results in: Error: mlxsw_spectrum: All router interface MAC addresses must have the same prefix. Fix this by skipping loopback RIFs during MAC validation. Fixes: 74bc99397438 ("mlxsw: spectrum_router: Veto unsupported RIF MAC addresses") Signed-off-by: Amit Cohen Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit a99efa00891b66405ebd25e49868efc701fe1546 Merge: d75663868d60 1833e327a5ea Author: Linus Torvalds Date: Sun Dec 29 10:01:27 2019 -0800 Merge tag 'riscv/for-v5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "One important fix for RISC-V: - Redirect any incoming syscall with an ID less than -1 to sys_ni_syscall, rather than allowing them to fall through into the syscall handler. and two minor build fixes: - Export __asm_copy_{from,to}_user() from where they are defined. This fixes a build error triggered by some randconfigs. - Export flush_icache_all(). I'd resisted this before, since historically we didn't want modules to be able to flush the I$ directly; but apparently everyone else is doing it now" * tag 'riscv/for-v5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: export flush_icache_all to modules riscv: reject invalid syscalls below -1 riscv: fix compile failure with EXPORT_SYMBOL() & !MMU commit d75663868d60f74bda33135fd737a7967532c357 Merge: cc2f36ec7188 98ca480a8f22 Author: Linus Torvalds Date: Sun Dec 29 09:50:57 2019 -0800 Merge tag 'locks-v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull /proc/locks formatting fix from Jeff Layton: "This is a trivial fix for a _very_ long standing bug in /proc/locks formatting. Ordinarily, I'd wait for the merge window for something like this, but it is making it difficult to validate some overlayfs fixes. I've also gone ahead and marked this for stable" * tag 'locks-v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: locks: print unsigned ino in /proc/locks commit cc2f36ec7188e48c2afb1428fc3ce18884ad634b Merge: bf8d1cd43865 046aca3c25fd Author: Linus Torvalds Date: Sun Dec 29 09:48:47 2019 -0800 Merge tag '5.5-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "One performance fix for large directory searches, and one minor style cleanup noticed by Clang" * tag '5.5-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Optimize readdir on reparse points cifs: Adjust indentation in smb2_open_file commit 98ca480a8f22fdbd768e3dad07024c8d4856576c Author: Amir Goldstein Date: Sun Dec 22 20:45:28 2019 +0200 locks: print unsigned ino in /proc/locks An ino is unsigned, so display it as such in /proc/locks. Cc: stable@vger.kernel.org Signed-off-by: Amir Goldstein Signed-off-by: Jeff Layton commit 0aec96f5897ac16ad9945f531b4bef9a2edd2ebd Author: Takashi Iwai Date: Wed Dec 18 20:26:06 2019 +0100 ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code Jia-Ju Bai reported a possible sleep-in-atomic scenario in the ice1724 driver with Infrasonic Quartet support code: namely, ice->set_rate callback gets called inside ice->reg_lock spinlock, while the callback in quartet.c holds ice->gpio_mutex. This patch fixes the invalid call: it simply moves the calls of ice->set_rate and ice->set_mclk callbacks outside the spinlock. Reported-by: Jia-Ju Bai Cc: Link: https://lore.kernel.org/r/5d43135e-73b9-a46a-2155-9e91d0dcdf83@gmail.com Link: https://lore.kernel.org/r/20191218192606.12866-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit e0c63812352298efbce2a71483c1dab627d0c288 Author: changzhu Date: Thu Dec 12 13:46:06 2019 +0800 drm/amdgpu: enable gfxoff for raven1 refresh When smu version is larger than 0x41e2b, it will load raven_kicker_rlc.bin.To enable gfxoff for raven_kicker_rlc.bin,it needs to avoid adev->pm.pp_feature &= ~PP_GFXOFF_MASK when it loads raven_kicker_rlc.bin. Signed-off-by: changzhu Reviewed-by: Huang Rui Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 1c455101c6d10c99b310d6bcf613244c97854012 Author: Alex Deucher Date: Tue Dec 17 09:51:40 2019 -0500 drm/amdgpu/smu: add metrics table lock for vega20 (v2) To protect access to the metrics table. v2: unlock on error Bug: https://gitlab.freedesktop.org/drm/amd/issues/900 Reviewed-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit e0e384c398d4638e54b6d2098f0ceaafdab870ee Author: Alex Deucher Date: Tue Dec 17 09:50:42 2019 -0500 drm/amdgpu/smu: add metrics table lock for navi (v2) To protect access to the metrics table. v2: unlock on error Bug: https://gitlab.freedesktop.org/drm/amd/issues/900 Reviewed-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 1da87c9f67c98d552679974dbfc1f0f65b6a0a53 Author: Alex Deucher Date: Tue Dec 17 09:49:52 2019 -0500 drm/amdgpu/smu: add metrics table lock for arcturus (v2) To protect access to the metrics table. v2: unlock on error Bug: https://gitlab.freedesktop.org/drm/amd/issues/900 Reviewed-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 073d5eef9e043c2b7e3ef12bc6c879b1d248e831 Author: Alex Deucher Date: Tue Dec 17 09:35:01 2019 -0500 drm/amdgpu/smu: add metrics table lock This table is used for lots of things, add it's own lock. Bug: https://gitlab.freedesktop.org/drm/amd/issues/900 Reviewed-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 5d30ed3c2c74eb123668d0746e23105c8fc8aed3 Author: Alex Deucher Date: Fri Dec 20 18:57:16 2019 -0500 Revert "drm/amdgpu: simplify ATPX detection" This reverts commit f5fda6d89afe6e9cedaa1c3303903c905262f6e8. You can't use BASE_CLASS in pci_get_class. Bug: https://gitlab.freedesktop.org/drm/amd/issues/995 Acked-by: Evan Quan Signed-off-by: Alex Deucher commit 7ecc6c1d5c8dbc713c647512a5267ca0eafe3e1c Author: Eugeniy Paltsev Date: Fri Dec 27 21:03:43 2019 +0300 ARC: pt_regs: remove hardcoded registers offset Replace hardcoded registers offset numbers by calculated via offsetof. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit 85a8ce62c2eabe28b9d76ca4eecf37922402df93 Author: Ming Lei Date: Sat Dec 28 07:05:48 2019 +0800 block: add bio_truncate to fix guard_bio_eod Some filesystem, such as vfat, may send bio which crosses device boundary, and the worse thing is that the IO request starting within device boundaries can contain more than one segment past EOD. Commit dce30ca9e3b6 ("fs: fix guard_bio_eod to check for real EOD errors") tries to fix this issue by returning -EIO for this situation. However, this way lets fs user code lose chance to handle -EIO, then sync_inodes_sb() may hang for ever. Also the current truncating on last segment is dangerous by updating the last bvec, given bvec table becomes not immutable any more, and fs bio users may not retrieve the truncated pages via bio_for_each_segment_all() in its .end_io callback. Fixes this issue by supporting multi-segment truncating. And the approach is simpler: - just update bio size since block layer can make correct bvec with the updated bio size. Then bvec table becomes really immutable. - zero all truncated segments for read bio Cc: Carlos Maiolino Cc: linux-fsdevel@vger.kernel.org Fixed-by: dce30ca9e3b6 ("fs: fix guard_bio_eod to check for real EOD errors") Reported-by: syzbot+2b9e54155c8c25d8d165@syzkaller.appspotmail.com Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 1833e327a5ea1d1f356fbf6ded0760c9ff4b0594 Author: Olof Johansson Date: Mon Dec 16 20:07:04 2019 -0800 riscv: export flush_icache_all to modules This is needed by LKDTM (crash dump test module), it calls flush_icache_range(), which on RISC-V turns into flush_icache_all(). On other architectures, the actual implementation is exported, so follow that precedence and export it here too. Fixes build of CONFIG_LKDTM that fails with: ERROR: "flush_icache_all" [drivers/misc/lkdtm/lkdtm.ko] undefined! Signed-off-by: Olof Johansson Signed-off-by: Paul Walmsley commit 556f47ac6083d778843e89aa21b1242eee2693ed Author: David Abdurachmanov Date: Wed Dec 18 10:47:56 2019 +0200 riscv: reject invalid syscalls below -1 Running "stress-ng --enosys 4 -t 20 -v" showed a large number of kernel oops with "Unable to handle kernel paging request at virtual address" message. This happens when enosys stressor starts testing random non-valid syscalls. I forgot to redirect any syscall below -1 to sys_ni_syscall. With the patch kernel oops messages are gone while running stress-ng enosys stressor. Signed-off-by: David Abdurachmanov Fixes: 5340627e3fe0 ("riscv: add support for SECCOMP and SECCOMP_FILTER") Signed-off-by: Paul Walmsley commit 4d47ce158efb7b145c680e79cd33e3c6fd773de4 Author: Luc Van Oostenryck Date: Sun Dec 22 10:26:04 2019 +0100 riscv: fix compile failure with EXPORT_SYMBOL() & !MMU When support for !MMU was added, the declaration of __asm_copy_to_user() & __asm_copy_from_user() were #ifdefed out hence their EXPORT_SYMBOL() give an error message like: .../riscv_ksyms.c:13:15: error: '__asm_copy_to_user' undeclared here .../riscv_ksyms.c:14:15: error: '__asm_copy_from_user' undeclared here Since these symbols are not defined with !MMU it's wrong to export them. Same for __clear_user() (even though this one is also declared in include/asm-generic/uaccess.h and thus doesn't give an error message). Fix this by doing the EXPORT_SYMBOL() directly where these symbols are defined: inside lib/uaccess.S itself. Fixes: 6bd33e1ece52 ("riscv: fix compile failure with EXPORT_SYMBOL() & !MMU") Reported-by: kbuild test robot Cc: Christoph Hellwig Cc: Palmer Dabbelt Cc: Paul Walmsley Signed-off-by: Luc Van Oostenryck Signed-off-by: Paul Walmsley commit bf8d1cd4386535004c4afe7f03d37f9864c9940e Merge: 48a8dd171993 e4dc9a4c31fe Author: Linus Torvalds Date: Fri Dec 27 17:28:41 2019 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four fixes and one spelling update, all in drivers: two in lpfc and the rest in mp3sas, cxgbi and target" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: target/iblock: Fix protection error with blocks greater than 512B scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy() scsi: lpfc: fix spelling mistakes of asynchronous scsi: lpfc: fix build failure with DEBUGFS disabled scsi: mpt3sas: Fix double free in attach error handling commit bd6f48546b9cb7a785344fc78058c420923d7ed8 Author: Martin Blumenstingl Date: Thu Dec 26 20:01:01 2019 +0100 net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs GXBB and newer SoCs use the fixed FCLK_DIV2 (1GHz) clock as input for the m250_sel clock. Meson8b and Meson8m2 use MPLL2 instead, whose rate can be adjusted at runtime. So far we have been running MPLL2 with ~250MHz (and the internal m250_div with value 1), which worked enough that we could transfer data with an TX delay of 4ns. Unfortunately there is high packet loss with an RGMII PHY when transferring data (receiving data works fine though). Odroid-C1's u-boot is running with a TX delay of only 2ns as well as the internal m250_div set to 2 - no lost (TX) packets can be observed with that setting in u-boot. Manual testing has shown that the TX packet loss goes away when using the following settings in Linux (the vendor kernel uses the same settings): - MPLL2 clock set to ~500MHz - m250_div set to 2 - TX delay set to 2ns on the MAC side Update the m250_div divider settings to only accept dividers greater or equal 2 to fix the TX delay generated by the MAC. iperf3 results before the change: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 182 MBytes 153 Mbits/sec 514 sender [ 5] 0.00-10.00 sec 182 MBytes 152 Mbits/sec receiver iperf3 results after the change (including an updated TX delay of 2ns): [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-10.00 sec 927 MBytes 778 Mbits/sec 0 sender [ 5] 0.00-10.01 sec 927 MBytes 777 Mbits/sec receiver Fixes: 4f6a71b84e1afd ("net: stmmac: dwmac-meson8b: fix internal RGMII clock configuration") Signed-off-by: Martin Blumenstingl Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 70cf3dc7313207816255b9acb0dffb19dae78144 Author: Shmulik Ladkani Date: Wed Dec 25 10:51:01 2019 +0200 net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device There's no skb_pull performed when a mirred action is set at egress of a mac device, with a target device/action that expects skb->data to point at the network header. As a result, either the target device is errornously given an skb with data pointing to the mac (egress case), or the net stack receives the skb with data pointing to the mac (ingress case). E.g: # tc qdisc add dev eth9 root handle 1: prio # tc filter add dev eth9 parent 1: prio 9 protocol ip handle 9 basic \ action mirred egress redirect dev tun0 (tun0 is a tun device. result: tun0 errornously gets the eth header instead of the iph) Revise the push/pull logic of tcf_mirred_act() to not rely on the skb_at_tc_ingress() vs tcf_mirred_act_wants_ingress() comparison, as it does not cover all "pull" cases. Instead, calculate whether the required action on the target device requires the data to point at the network header, and compare this to whether skb->data points to network header - and make the push/pull adjustments as necessary. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Shmulik Ladkani Tested-by: Jamal Hadi Salim Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit 862dd2a946aa1417f013fb748e2aa0f4349b405b Author: Vladimir Oltean Date: Fri Dec 27 03:24:17 2019 +0200 spi: Don't look at TX buffer for PTP system timestamping The API for PTP system timestamping (associating a SPI transaction with the system time at which it was transferred) is flawed: it assumes that the xfer->tx_buf pointer will always be present. This is, of course, not always the case. So introduce a "progress" variable that denotes how many word have been transferred. Fix the Freescale DSPI driver, the only user of the API so far, in the same patch. Fixes: b42faeee718c ("spi: Add a PTP system timestamp to the transfer structure") Fixes: d6b71dfaeeba ("spi: spi-fsl-dspi: Implement the PTP system timestamping for TCFQ mode") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20191227012417.1057-1-olteanv@gmail.com Signed-off-by: Mark Brown commit 48a8dd171993569cb77dee0882a47abad47d2837 Merge: f4b3974602a5 e31d941c7dd7 Author: Linus Torvalds Date: Fri Dec 27 13:21:06 2019 -0800 Merge tag 'drm-fixes-2019-12-28' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Post-xmas food coma recovery fixes. Only three fixes for i915 since I expect most people are holidaying. i915: - power management rc6 fix - framebuffer tracking fix - display power management ratelimit fix" * tag 'drm-fixes-2019-12-28' of git://anongit.freedesktop.org/drm/drm: drm/i915: Hold reference to intel_frontbuffer as we track activity drm/i915/gt: Ratelimit display power w/a drm/i915/pmu: Ensure monotonic rc6 commit f4b3974602a5b527b22c3a0dc61ba71190ea2aa5 Merge: 1413c361328c 2a1f40adfb54 Author: Linus Torvalds Date: Fri Dec 27 11:30:26 2019 -0800 Merge tag 'linux-kselftest-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: - rseq build failures fixes related to glibc 2.30 compatibility from Mathieu Desnoyers - Kunit fixes and cleanups from SeongJae Park - Fixes to filesystems/epoll, firmware, and livepatch build failures and skip handling. * tag 'linux-kselftest-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: rseq/selftests: Clarify rseq_prepare_unload() helper requirements rseq/selftests: Fix: Namespace gettid() for compatibility with glibc 2.30 rseq/selftests: Turn off timeout setting kunit/kunit_tool_test: Test '--build_dir' option run kunit: Rename 'kunitconfig' to '.kunitconfig' kunit: Place 'test.log' under the 'build_dir' kunit: Create default config in '--build_dir' kunit: Remove duplicated defconfig creation docs/kunit/start: Use in-tree 'kunit_defconfig' selftests: livepatch: Fix it to do root uid check and skip selftests: firmware: Fix it to do root uid check and skip selftests: filesystems/epoll: fix build error commit 1413c361328c3ecd2cfe1e331f7b7d222d0712bc Merge: 534121d289e0 2cb7bfc1ca9a Author: Linus Torvalds Date: Fri Dec 27 11:26:54 2019 -0800 Merge tag 'pm-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "Fix compile test of the Tegra devfreq driver (Arnd Bergmann) and remove redundant Kconfig dependencies from multiple devfreq drivers (Leonard Crestez)" * tag 'pm-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM / devfreq: tegra: Add COMMON_CLK dependency PM / devfreq: Drop explicit selection of PM_OPP commit 534121d289e06827ee84c9262267ca5ebf1d9fd9 Merge: 0f710a5572ea fd1c4bc6e9b3 Author: Linus Torvalds Date: Fri Dec 27 11:17:08 2019 -0800 Merge tag 'io_uring-5.5-20191226' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: - Removal of now unused busy wqe list (Hillf) - Add cond_resched() to io-wq work processing (Hillf) - And then the series that I hinted at from last week, which removes the sqe from the io_kiocb and keeps all sqe handling on the prep side. This guarantees that an opcode can't do the wrong thing and read the sqe more than once. This is unchanged from last week, no issues have been observed with this in testing. Hence I really think we should fold this into 5.5. * tag 'io_uring-5.5-20191226' of git://git.kernel.dk/linux-block: io-wq: add cond_resched() to worker thread io-wq: remove unused busy list from io_sqe io_uring: pass in 'sqe' to the prep handlers io_uring: standardize the prep methods io_uring: read 'count' for IORING_OP_TIMEOUT in prep handler io_uring: move all prep state for IORING_OP_{SEND,RECV}_MGS to prep handler io_uring: move all prep state for IORING_OP_CONNECT to prep handler io_uring: add and use struct io_rw for read/writes io_uring: use u64_to_user_ptr() consistently commit 0f710a5572ea3a0fec36ad0b613f72144d99e830 Merge: 8ae40a6951a7 bf0e5013bc2d Author: Linus Torvalds Date: Fri Dec 27 11:13:18 2019 -0800 Merge tag 'libata-5.5-20191226' of git://git.kernel.dk/linux-block Pull libata fixes from Jens Axboe: "Two things in here: - First half of a series that fixes ahci_brcm, also marked for stable. The other part of the series is going into 5.6 (Florian) - sata_nv regression fix that is also marked for stable (Sascha)" * tag 'libata-5.5-20191226' of git://git.kernel.dk/linux-block: ata: ahci_brcm: Add missing clock management during recovery ata: ahci_brcm: BCM7425 AHCI requires AHCI_HFLAG_DELAY_ENGINE ata: ahci_brcm: Fix AHCI resources management ata: libahci_platform: Export again ahci_platform_able_phys() libata: Fix retrieving of active qcs commit 8ae40a6951a72c59f2f6a0b721ce0e43bbcffcab Merge: a305bd7c9c22 b2c0fcd28772 Author: Linus Torvalds Date: Fri Dec 27 11:09:04 2019 -0800 Merge tag 'block-5.5-20191226' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Only thing here are the changes from Arnd from last week, which now have the appropriate header include to ensure they actually compile if COMPAT is enabled" * tag 'block-5.5-20191226' of git://git.kernel.dk/linux-block: compat_ioctl: block: handle Persistent Reservations compat_ioctl: block: handle add zone open, close and finish ioctl compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE pktcdvd: fix regression on 64-bit architectures commit a305bd7c9c22e2f127b0674104acfa8133e3cd26 Merge: 46cf053efec6 286e7beaa4cc Author: Linus Torvalds Date: Fri Dec 27 11:02:48 2019 -0800 Merge tag 'gpio-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "A set of fixes for the v5.5 series: - Fix the build for the Xtensa driver. - Make sure to set up the parent device for mpc8xxx. - Clarify the look-up error message. - Fix the usage of the line direction in the mockup device. - Fix a type warning on the Aspeed driver. - Remove the pointless __exit annotation on the xgs-iproc which is causing a compilation problem. - Fix up emultation of open drain outputs .get_direction() - Fix the IRQ callbacks on the PCA953xx to use bitops and work properly. - Fix the Kconfig on the Tegra driver" * tag 'gpio-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: tegra186: Allow building on Tegra194-only configurations gpio: pca953x: Switch to bitops in IRQ callbacks gpiolib: fix up emulated open drain outputs MAINTAINERS: Append missed file to the database gpio: xgs-iproc: remove __exit annotation for iproc_gpio_remove gpio: aspeed: avoid return type warning gpio: mockup: Fix usage of new GPIO_LINE_DIRECTION gpio: Fix error message on out-of-range GPIO in lookup table gpio: mpc8xxx: Add platform device to gpiochip->parent gpio: xtensa: fix driver build commit e79c22695abd3b75a6aecf4ea4b9607e8d82c49c Author: Kailang Yang Date: Thu Dec 19 14:12:15 2019 +0800 ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker Dell has new platform which has dual speaker connecting. They want dual speaker which use same dac for output. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/229c7efa2b474a16b7d8a916cd096b68@realtek.com Signed-off-by: Takashi Iwai commit b0b5ce1010ffc50015eaec72b0028aaae3f526bb Author: Alexander.Barabash@dell.com Date: Wed Dec 25 17:55:30 2019 +0000 ioat: ioat_alloc_ring() failure handling. If dma_alloc_coherent() returns NULL in ioat_alloc_ring(), ring allocation must not proceed. Until now, if the first call to dma_alloc_coherent() in ioat_alloc_ring() returned NULL, the processing could proceed, failing with NULL-pointer dereferencing further down the line. Signed-off-by: Alexander Barabash Acked-by: Dave Jiang Link: https://lore.kernel.org/r/75e9c0e84c3345d693c606c64f8b9ab5@x13pwhopdag1307.AMER.DELL.COM Signed-off-by: Vinod Koul commit e31d941c7dd797df37ea94958638a88723325c30 Merge: 46cf053efec6 e85ade1f50aa Author: Dave Airlie Date: Fri Dec 27 13:13:06 2019 +1000 Merge tag 'drm-intel-fixes-2019-12-23' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes i915 power and frontbuffer tracking fixes Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87r20vdlrs.fsf@intel.com commit bb3d0b8bf5be61ab1d6f472c43cbf34de17e796b Author: Eric Dumazet Date: Mon Dec 23 11:13:24 2019 -0800 net_sched: sch_fq: properly set sk->sk_pacing_status If fq_classify() recycles a struct fq_flow because a socket structure has been reallocated, we do not set sk->sk_pacing_status immediately, but later if the flow becomes detached. This means that any flow requiring pacing (BBR, or SO_MAX_PACING_RATE) might fallback to TCP internal pacing, which requires a per-socket high resolution timer, and therefore more cpu cycles. Fixes: 218af599fa63 ("tcp: internal implementation for pacing") Signed-off-by: Eric Dumazet Cc: Soheil Hassas Yeganeh Cc: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller commit 4e55a11aa30fd9a6ee1e7f536ee562e1b0b22512 Merge: 3c2f450e553c 5cdc40c7820f Author: David S. Miller Date: Thu Dec 26 15:27:15 2019 -0800 Merge branch 'bnx2x-Bug-fixes' Manish Chopra says: ==================== bnx2x: Bug fixes This series has changes in the area of vlan resources management APIs to fix fw assert issue reported in max vlan configuration testing over the PF. ==================== Signed-off-by: David S. Miller commit 5cdc40c7820ff66c2271e0884bd8ee8f7cfd769b Author: Manish Chopra Date: Mon Dec 23 10:23:09 2019 -0800 bnx2x: Fix accounting of vlan resources among the PFs While testing max vlan configuration on the PF, firmware gets assert as driver was configuring number of vlans more than what is supported per port/engine, it was figured out that there is an implicit vlan (hidden default vlan consuming hardware cam entry resource) which is configured default for all the clients (PF/VFs) on client_init ramrod by the adapter implicitly, so when allocating resources among the PFs this implicit vlan should be considered or total vlan entries should be reduced by one to accommodate that default/implicit vlan entry. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 0444716a5dd563526e53ae686115987d5d4c249e Author: Manish Chopra Date: Mon Dec 23 10:23:08 2019 -0800 bnx2x: Use appropriate define for vlan credit Although it has same value as MAX_MAC_CREDIT_E2, use MAX_VLAN_CREDIT_E2 appropriately. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 3c2f450e553ce47fcb0d6141807a8858e3213c9c Merge: 7df2281a174b fa633a0f8919 Author: David S. Miller Date: Thu Dec 26 15:25:04 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-12-23 The following pull-request contains BPF updates for your *net* tree. We've added 2 non-merge commits during the last 1 day(s) which contain a total of 4 files changed, 34 insertions(+), 31 deletions(-). The main changes are: 1) Fix libbpf build when building on a read-only filesystem with O=dir option, from Namhyung Kim. 2) Fix a precision tracking bug for unknown scalars, from Daniel Borkmann. ==================== Signed-off-by: David S. Miller commit 7df2281a174bd0fdbb2211a26914e5440740fcde Author: Geert Uytterhoeven Date: Mon Dec 23 11:03:21 2019 +0100 of: mdio: Add missing inline to of_mdiobus_child_is_phy() dummy If CONFIG_OF_MDIO=n: drivers/net/phy/mdio_bus.c:23: include/linux/of_mdio.h:58:13: warning: ‘of_mdiobus_child_is_phy’ defined but not used [-Wunused-function] static bool of_mdiobus_child_is_phy(struct device_node *child) ^~~~~~~~~~~~~~~~~~~~~~~ Fix this by adding the missing "inline" keyword. Fixes: 0aa4d016c043d16a ("of: mdio: export of_mdiobus_child_is_phy") Signed-off-by: Geert Uytterhoeven Reviewed-by: Andrew Lunn Acked-by: Borislav Petkov Signed-off-by: David S. Miller commit 1c93fb45761e79b3c00080e71523886cefaf351c Author: Madalin Bucur Date: Mon Dec 23 10:06:10 2019 +0200 net: phy: aquantia: add suspend / resume ops for AQR105 The suspend/resume code for AQR107 works on AQR105 too. This patch fixes issues with the partner not seeing the link down when the interface using AQR105 is brought down. Fixes: bee8259dd31f ("net: phy: add driver for aquantia phy") Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit c27569fcd6e1b11bd24361346504f2995a256e4e Author: Madalin Bucur Date: Mon Dec 23 09:39:22 2019 +0200 dpaa_eth: fix DMA mapping leak On the error path some fragments remain DMA mapped. Adding a fix that unmaps all the fragments. Rework cleanup path to be simpler. Fixes: 8151ee88bad5 ("dpaa_eth: use page backed rx buffers") Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 12ead77432f2ce32dea797742316d15c5800cb32 Author: Guenter Roeck Date: Wed Dec 25 08:34:29 2019 -0800 clk: Don't try to enable critical clocks if prepare failed The following traceback is seen if a critical clock fails to prepare. bcm2835-clk 3f101000.cprman: plld: couldn't lock PLL ------------[ cut here ]------------ Enabling unprepared plld_per WARNING: CPU: 1 PID: 1 at drivers/clk/clk.c:1014 clk_core_enable+0xcc/0x2c0 ... Call trace: clk_core_enable+0xcc/0x2c0 __clk_register+0x5c4/0x788 devm_clk_hw_register+0x4c/0xb0 bcm2835_register_pll_divider+0xc0/0x150 bcm2835_clk_probe+0x134/0x1e8 platform_drv_probe+0x50/0xa0 really_probe+0xd4/0x308 driver_probe_device+0x54/0xe8 device_driver_attach+0x6c/0x78 __driver_attach+0x54/0xd8 ... Check return values from clk_core_prepare() and clk_core_enable() and bail out if any of those functions returns an error. Cc: Jerome Brunet Fixes: 99652a469df1 ("clk: migrate the count of orphaned clocks at init") Signed-off-by: Guenter Roeck Link: https://lkml.kernel.org/r/20191225163429.29694-1-linux@roeck-us.net Signed-off-by: Stephen Boyd commit ec34c0157580a68c10dccbdd18c7701f0b317172 Merge: a5bcd72e054a 8cb4ec44de42 Author: David S. Miller Date: Thu Dec 26 13:11:40 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix endianness issue in flowtable TCP flags dissector, from Arnd Bergmann. 2) Extend flowtable test script with dnat rules, from Florian Westphal. 3) Reject padding in ebtables user entries and validate computed user offset, reported by syzbot, from Florian Westphal. 4) Fix endianness in nft_tproxy, from Phil Sutter. ==================== Signed-off-by: David S. Miller commit a5bcd72e054aabb93ddc51ed8cde36a5bfc50271 Author: Vladyslav Tarasiuk Date: Thu Dec 26 10:41:56 2019 +0200 net/mlxfw: Fix out-of-memory error in mfa2 flash burning The burning process requires to perform internal allocations of large chunks of memory. This memory doesn't need to be contiguous and can be safely allocated by vzalloc() instead of kzalloc(). This patch changes such allocation to avoid possible out-of-memory failure. Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process") Signed-off-by: Vladyslav Tarasiuk Reviewed-by: Aya Levin Signed-off-by: Leon Romanovsky Tested-by: Ido Schimmel Signed-off-by: David S. Miller commit ea137a89b5ddeb0061df8eef9b8ceca3d04f48b1 Author: Tony Lindgren Date: Sun Dec 22 10:17:04 2019 -0800 phy: cpcap-usb: Drop extra write to usb2 register We are currently writing the same register twice. Let's enable the USB PHY only at the end of the function. Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Acked-by: Pavel Machek Signed-off-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I commit 9492535ecd9b6df89e483ddd05740b3f3d547600 Author: Tony Lindgren Date: Sun Dec 22 10:17:03 2019 -0800 phy: cpcap-usb: Improve host vs docked mode detection When docked to a Motorola lapdock or media dock, we're in USB A-host mode with VBUS provided by the dock. When in regular USB A-host mode, we're providing the VBUS. And in regular USB A-host mode we must also keep kicking the VBUS to keep it active. Let's wait a bit before configuring the USB PHY to allow some time between the ID and VBUS changes. And let's add vbus_provider flag so we can detect docked mode and regularo USB A-host mode better. With better USB A-host mode detection, we can now also just kick the VBUS to keep it enabled and leave out the unnecessary line muxing. We only need to set and clear vbus_provider in the delayed work so no locking is needed for it currently. Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Acked-by: Pavel Machek Signed-off-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I commit 63078b6ba09e842f09df052c5728857389fddcd2 Author: Tony Lindgren Date: Sun Dec 22 10:17:02 2019 -0800 phy: cpcap-usb: Prevent USB line glitches from waking up modem The micro-USB connector on Motorola Mapphone devices can be muxed between the SoC and the mdm6600 modem. But even when used for the SoC, configuring the PHY with ID pin grounded will wake up the modem from idle state. Looks like the issue is probably caused by line glitches. We can prevent the glitches by using a previously unknown mode of the GPIO mux to prevent the USB lines from being connected to the moden while configuring the USB PHY, and enable the USB lines after configuring the PHY. Note that this only prevents waking up mdm6600 as regular USB A-host mode, and does not help when connected to a lapdock. The lapdock specific issue still needs to be debugged separately. Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Acked-by: Pavel Machek Signed-off-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I commit af5d44de571811a151510bfd1236407b7f551cd9 Author: Tony Lindgren Date: Fri Aug 30 14:43:12 2019 -0700 phy: mapphone-mdm6600: Fix uninitialized status value regression Only the used bits get cleared with bitmap_zero() when we call gpiod_get_array_value_cansleep(). We must mask only the bits we're using for ddata->status as the other bits in the bitmap may not be initialized. And let's also drop useless debug code accidentally left over while at it. Fixes: b9762bebc633 ("gpiolib: Pass bitmaps, not integer arrays, to get/set array") Cc: Jacopo Mondi Cc: Janusz Krzysztofik Cc: Linus Walleij Cc: Marcel Partap Cc: Merlijn Wajer Cc: Michael Scott Cc: NeKit Cc: Pavel Machek Cc: Sebastian Reichel Signed-off-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I commit 049226b9fd7442149dcbcf55f15408f5973cceda Author: Tony Lindgren Date: Sun Dec 22 10:00:19 2019 -0800 phy: cpcap-usb: Fix flakey host idling and enumerating of devices We must let the USB host idle things properly before we switch to debug UART mode. Otherwise the USB host may never idle after disconnecting devices, and that causes the next enumeration to be flakey. Cc: Jacopo Mondi Cc: Marcel Partap Cc: Merlijn Wajer Cc: Michael Scott Cc: NeKit Cc: Pavel Machek Cc: Sebastian Reichel Acked-by: Pavel Machek Fixes: 6d6ce40f63af ("phy: cpcap-usb: Add CPCAP PMIC USB support") Signed-off-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I commit bf0e5013bc2dcac205417e1252205dca39dfc005 Author: Florian Fainelli Date: Tue Dec 10 10:53:47 2019 -0800 ata: ahci_brcm: Add missing clock management during recovery The downstream implementation of ahci_brcm.c did contain clock management recovery, but until recently, did that outside of the libahci_platform helpers and this was unintentionally stripped out while forward porting the patch upstream. Add the missing clock management during recovery and sleep for 10 milliseconds per the design team recommendations to ensure the SATA PHY controller and AFE have been fully quiesced. Fixes: eb73390ae241 ("ata: ahci_brcm: Recover from failures to identify devices") Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Signed-off-by: Florian Fainelli Signed-off-by: Jens Axboe commit 1a3d78cb6e20779a19388315bd8efefbd8d4a656 Author: Florian Fainelli Date: Tue Dec 10 10:53:46 2019 -0800 ata: ahci_brcm: BCM7425 AHCI requires AHCI_HFLAG_DELAY_ENGINE Set AHCI_HFLAG_DELAY_ENGINE for the BCM7425 AHCI controller thus making it conforming to the 'strict' AHCI implementation which this controller is based on. This solves long link establishment with specific hard drives (e.g.: Seagate ST1000VM002-9ZL1 SC12) that would otherwise have to complete the error recovery handling before finally establishing a succesful SATA link at the desired speed. We re-order the hpriv->flags assignment to also remove the NONCQ quirk since we can set the flag directly. Fixes: 9586114cf1e9 ("ata: ahci_brcmstb: add support MIPS-based platforms") Fixes: 423be77daabe ("ata: ahci_brcmstb: add quirk for broken ncq") Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Signed-off-by: Florian Fainelli Signed-off-by: Jens Axboe commit c0cdf2ac4b5bf3e5ef2451ea29fb4104278cdabc Author: Florian Fainelli Date: Tue Dec 10 10:53:45 2019 -0800 ata: ahci_brcm: Fix AHCI resources management The AHCI resources management within ahci_brcm.c is a little convoluted, largely because it historically had a dedicated clock that was managed within this file in the downstream tree. Once brough upstream though, the clock was left to be managed by libahci_platform.c which is entirely appropriate. This patch series ensures that the AHCI resources are fetched and enabled before any register access is done, thus avoiding bus errors on platforms which clock gate the controller by default. As a result we need to re-arrange the suspend() and resume() functions in order to avoid accessing registers after the clocks have been turned off respectively before the clocks have been turned on. Finally, we can refactor brcm_ahci_get_portmask() in order to fetch the number of ports from hpriv->mmio which is now accessible without jumping through hoops like we used to do. The commit pointed in the Fixes tag is both old and new enough not to require major headaches for backporting of this patch. Fixes: eba68f829794 ("ata: ahci_brcmstb: rename to support across Broadcom SoC's") Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Signed-off-by: Florian Fainelli Signed-off-by: Jens Axboe commit 84b032dbfdf1c139cd2b864e43959510646975f8 Author: Florian Fainelli Date: Tue Dec 10 10:53:44 2019 -0800 ata: libahci_platform: Export again ahci_platform_able_phys() This reverts commit 6bb86fefa086faba7b60bb452300b76a47cde1a5 ("libahci_platform: Staticize ahci_platform_able_phys()") we are going to need ahci_platform_{enable,disable}_phys() in a subsequent commit for ahci_brcm.c in order to properly control the PHY initialization order. Also make sure the function prototypes are declared in include/linux/ahci_platform.h as a result. Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Signed-off-by: Florian Fainelli Signed-off-by: Jens Axboe commit 095e90e080a502e8737b8694c15f03f16d4df6ab Merge: 57b948e2c9ce 3ed0a1d56390 Author: David S. Miller Date: Wed Dec 25 16:35:35 2019 -0800 Merge branch 'hsr-fix-several-bugs-in-hsr-module' Taehee Yoo says: ==================== hsr: fix several bugs in hsr module 1. The first patch fixes debugfs warning when it's opened when hsr module is being removed. debugfs file is opened, it tries to hold .owner module, but it would print warning messages if it couldn't hold .owner module. In order to avoid the warning message, this patch makes hsr module does not set .owner. Unsetting .owner is safe because these are protected by inode_lock(). 2. The second patch fixes wrong error handling of hsr_dev_finalize() a) hsr_dev_finalize() calls debugfs_create_{dir/file} to create debugfs. it checks NULL pointer but debugfs don't return NULL so it's wrong code. b) hsr_dev_finalize() calls register_netdevice(). so if it fails after register_netdevice(), it should call unregister_netdevice(). But it doesn't. c) debugfs doesn't affect any actual logic of hsr module. So, the failure of creating of debugfs could be ignored. 3. The third patch adds hsr root debugfs directory. When hsr interface is created, it creates debugfs directory in /sys/kernel/debug/. It's a little bit faulty path because if an interface is the same with another directory name in the same path, it will fail. If hsr root directory is existing, the possibility of failure of creating debugfs file will be reduced. 4. The fourth patch adds debugfs rename routine. debugfs directory name is the same with hsr interface name. So hsr interface name is changed, debugfs directory name should be changed too. 5. The fifth patch fixes a race condition in node list add and del. hsr nodes are protected by RCU and there is no write side lock. But node insertions and deletions could be being operated concurrently. So write side locking is needed. 6. The Sixth patch resets network header Tap routine is enabled, below message will be printed. [ 175.852292][ C3] protocol 88fb is buggy, dev veth0 hsr module doesn't set network header for supervision frame. But tap routine validates network header. If network header wasn't set, it resets and warns about it. ==================== Signed-off-by: David S. Miller commit 3ed0a1d563903bdb4b4c36c58c4d9c1bcb23a6e6 Author: Taehee Yoo Date: Sun Dec 22 11:27:08 2019 +0000 hsr: reset network header when supervision frame is created The supervision frame is L2 frame. When supervision frame is created, hsr module doesn't set network header. If tap routine is enabled, dev_queue_xmit_nit() is called and it checks network_header. If network_header pointer wasn't set(or invalid), it resets network_header and warns. In order to avoid unnecessary warning message, resetting network_header is needed. Test commands: ip netns add nst ip link add veth0 type veth peer name veth1 ip link add veth2 type veth peer name veth3 ip link set veth1 netns nst ip link set veth3 netns nst ip link set veth0 up ip link set veth2 up ip link add hsr0 type hsr slave1 veth0 slave2 veth2 ip a a 192.168.100.1/24 dev hsr0 ip link set hsr0 up ip netns exec nst ip link set veth1 up ip netns exec nst ip link set veth3 up ip netns exec nst ip link add hsr1 type hsr slave1 veth1 slave2 veth3 ip netns exec nst ip a a 192.168.100.2/24 dev hsr1 ip netns exec nst ip link set hsr1 up tcpdump -nei veth0 Splat looks like: [ 175.852292][ C3] protocol 88fb is buggy, dev veth0 Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 92a35678ec075100ce666a2fb6969151affb0e5d Author: Taehee Yoo Date: Sun Dec 22 11:26:54 2019 +0000 hsr: fix a race condition in node list insertion and deletion hsr nodes are protected by RCU and there is no write side lock. But node insertions and deletions could be being operated concurrently. So write side locking is needed. Test commands: ip netns add nst ip link add veth0 type veth peer name veth1 ip link add veth2 type veth peer name veth3 ip link set veth1 netns nst ip link set veth3 netns nst ip link set veth0 up ip link set veth2 up ip link add hsr0 type hsr slave1 veth0 slave2 veth2 ip a a 192.168.100.1/24 dev hsr0 ip link set hsr0 up ip netns exec nst ip link set veth1 up ip netns exec nst ip link set veth3 up ip netns exec nst ip link add hsr1 type hsr slave1 veth1 slave2 veth3 ip netns exec nst ip a a 192.168.100.2/24 dev hsr1 ip netns exec nst ip link set hsr1 up for i in {0..9} do for j in {0..9} do for k in {0..9} do for l in {0..9} do arping 192.168.100.2 -I hsr0 -s 00:01:3$i:4$j:5$k:6$l -c1 & done done done done Splat looks like: [ 236.066091][ T3286] list_add corruption. next->prev should be prev (ffff8880a5940300), but was ffff8880a5940d0. [ 236.069617][ T3286] ------------[ cut here ]------------ [ 236.070545][ T3286] kernel BUG at lib/list_debug.c:25! [ 236.071391][ T3286] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 236.072343][ T3286] CPU: 0 PID: 3286 Comm: arping Tainted: G W 5.5.0-rc1+ #209 [ 236.073463][ T3286] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 236.074695][ T3286] RIP: 0010:__list_add_valid+0x74/0xd0 [ 236.075499][ T3286] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 b [ 236.078277][ T3286] RSP: 0018:ffff8880aaa97648 EFLAGS: 00010286 [ 236.086991][ T3286] RAX: 0000000000000075 RBX: ffff8880d4624c20 RCX: 0000000000000000 [ 236.088000][ T3286] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed1015552ebf [ 236.098897][ T3286] RBP: ffff88809b53d200 R08: ffffed101b3c04f9 R09: ffffed101b3c04f9 [ 236.099960][ T3286] R10: 00000000308769a1 R11: ffffed101b3c04f8 R12: ffff8880d4624c28 [ 236.100974][ T3286] R13: ffff8880d4624c20 R14: 0000000040310100 R15: ffff8880ce17ee02 [ 236.138967][ T3286] FS: 00007f23479fa680(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000 [ 236.144852][ T3286] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 236.145720][ T3286] CR2: 00007f4a14bab210 CR3: 00000000a61c6001 CR4: 00000000000606f0 [ 236.146776][ T3286] Call Trace: [ 236.147222][ T3286] hsr_add_node+0x314/0x490 [hsr] [ 236.153633][ T3286] hsr_forward_skb+0x2b6/0x1bc0 [hsr] [ 236.154362][ T3286] ? rcu_read_lock_sched_held+0x90/0xc0 [ 236.155091][ T3286] ? rcu_read_lock_bh_held+0xa0/0xa0 [ 236.156607][ T3286] hsr_dev_xmit+0x70/0xd0 [hsr] [ 236.157254][ T3286] dev_hard_start_xmit+0x160/0x740 [ 236.157941][ T3286] __dev_queue_xmit+0x1961/0x2e10 [ 236.158565][ T3286] ? netdev_core_pick_tx+0x2e0/0x2e0 [ ... ] Reported-by: syzbot+3924327f9ad5f4d2b343@syzkaller.appspotmail.com Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 4c2d5e33dcd3a6333a7895be3b542ff3d373177c Author: Taehee Yoo Date: Sun Dec 22 11:26:39 2019 +0000 hsr: rename debugfs file when interface name is changed hsr interface has own debugfs file, which name is same with interface name. So, interface name is changed, debugfs file name should be changed too. Fixes: fc4ecaeebd26 ("net: hsr: add debugfs support for display node list") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit c6c4ccd7f96993e106dfea7ef18127f972f2db5e Author: Taehee Yoo Date: Sun Dec 22 11:26:27 2019 +0000 hsr: add hsr root debugfs directory In current hsr code, when hsr interface is created, it creates debugfs directory /sys/kernel/debug/. If there is same directory or file name in there, it fails. In order to reduce possibility of failure of creation of debugfs, this patch adds root directory. Test commands: ip link add dummy0 type dummy ip link add dummy1 type dummy ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1 Before this patch: /sys/kernel/debug/hsr0/node_table After this patch: /sys/kernel/debug/hsr/hsr0/node_table Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 1d19e2d53e8ed9e4c98fc95e0067492cda7288b0 Author: Taehee Yoo Date: Sun Dec 22 11:26:15 2019 +0000 hsr: fix error handling routine in hsr_dev_finalize() hsr_dev_finalize() is called to create new hsr interface. There are some wrong error handling codes. 1. wrong checking return value of debugfs_create_{dir/file}. These function doesn't return NULL. If error occurs in there, it returns error pointer. So, it should check error pointer instead of NULL. 2. It doesn't unregister interface if it fails to setup hsr interface. If it fails to initialize hsr interface after register_netdevice(), it should call unregister_netdevice(). 3. Ignore failure of creation of debugfs If creating of debugfs dir and file is failed, creating hsr interface will be failed. But debugfs doesn't affect actual logic of hsr module. So, ignoring this is more correct and this behavior is more general. Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 84bb59d773853bc2dda2ac1ef8474c40eb33a3c6 Author: Taehee Yoo Date: Sun Dec 22 11:25:27 2019 +0000 hsr: avoid debugfs warning message when module is remove When hsr module is being removed, debugfs_remove() is called to remove both debugfs directory and file. When module is being removed, module state is changed to MODULE_STATE_GOING then exit() is called. At this moment, module couldn't be held so try_module_get() will be failed. debugfs's open() callback tries to hold the module if .owner is existing. If it fails, warning message is printed. CPU0 CPU1 delete_module() try_stop_module() hsr_exit() open() <-- WARNING debugfs_remove() In order to avoid the warning message, this patch makes hsr module does not set .owner. Unsetting .owner is safe because these are protected by inode_lock(). Test commands: #SHELL1 ip link add dummy0 type dummy ip link add dummy1 type dummy while : do ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1 modprobe -rv hsr done #SHELL2 while : do cat /sys/kernel/debug/hsr0/node_table done Splat looks like: [ 101.223783][ T1271] ------------[ cut here ]------------ [ 101.230309][ T1271] debugfs file owner did not clean up at exit: node_table [ 101.230380][ T1271] WARNING: CPU: 3 PID: 1271 at fs/debugfs/file.c:309 full_proxy_open+0x10f/0x650 [ 101.233153][ T1271] Modules linked in: hsr(-) dummy veth openvswitch nsh nf_conncount nf_nat nf_conntrack nf_d] [ 101.237112][ T1271] CPU: 3 PID: 1271 Comm: cat Tainted: G W 5.5.0-rc1+ #204 [ 101.238270][ T1271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 101.240379][ T1271] RIP: 0010:full_proxy_open+0x10f/0x650 [ 101.241166][ T1271] Code: 48 c1 ea 03 80 3c 02 00 0f 85 c1 04 00 00 49 8b 3c 24 e8 04 86 7e ff 84 c0 75 2d 4c 8 [ 101.251985][ T1271] RSP: 0018:ffff8880ca22fa38 EFLAGS: 00010286 [ 101.273355][ T1271] RAX: dffffc0000000008 RBX: ffff8880cc6e6200 RCX: 0000000000000000 [ 101.274466][ T1271] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8880c4dd5c14 [ 101.275581][ T1271] RBP: 0000000000000000 R08: fffffbfff2922f5d R09: 0000000000000000 [ 101.276733][ T1271] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffffc0551bc0 [ 101.277853][ T1271] R13: ffff8880c4059a48 R14: ffff8880be50a5e0 R15: ffffffff941adaa0 [ 101.278956][ T1271] FS: 00007f8871cda540(0000) GS:ffff8880da800000(0000) knlGS:0000000000000000 [ 101.280216][ T1271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 101.282832][ T1271] CR2: 00007f88717cfd10 CR3: 00000000b9440005 CR4: 00000000000606e0 [ 101.283974][ T1271] Call Trace: [ 101.285328][ T1271] do_dentry_open+0x63c/0xf50 [ 101.286077][ T1271] ? open_proxy_open+0x270/0x270 [ 101.288271][ T1271] ? __x64_sys_fchdir+0x180/0x180 [ 101.288987][ T1271] ? inode_permission+0x65/0x390 [ 101.289682][ T1271] path_openat+0x701/0x2810 [ 101.290294][ T1271] ? path_lookupat+0x880/0x880 [ 101.290957][ T1271] ? check_chain_key+0x236/0x5d0 [ 101.291676][ T1271] ? __lock_acquire+0xdfe/0x3de0 [ 101.292358][ T1271] ? sched_clock+0x5/0x10 [ 101.292962][ T1271] ? sched_clock_cpu+0x18/0x170 [ 101.293644][ T1271] ? find_held_lock+0x39/0x1d0 [ 101.305616][ T1271] do_filp_open+0x17a/0x270 [ 101.306061][ T1271] ? may_open_dev+0xc0/0xc0 [ ... ] Fixes: fc4ecaeebd26 ("net: hsr: add debugfs support for display node list") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 57b948e2c9ce58e4fcb687bc285b5b5a2cc66640 Author: Netanel Belgazal Date: Sun Dec 22 09:47:59 2019 +0000 MAINTAINERS: Add additional maintainers to ENA Ethernet driver Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller commit 8385d756e114f2df8568e508902d5f9850817ffb Author: Sascha Hauer Date: Fri Dec 13 09:04:08 2019 +0100 libata: Fix retrieving of active qcs ata_qc_complete_multiple() is called with a mask of the still active tags. mv_sata doesn't have this information directly and instead calculates the still active tags from the started tags (ap->qc_active) and the finished tags as (ap->qc_active ^ done_mask) Since 28361c40368 the hw_tag and tag are no longer the same and the equation is no longer valid. In ata_exec_internal_sg() ap->qc_active is initialized as 1ULL << ATA_TAG_INTERNAL, but in hardware tag 0 is started and this will be in done_mask on completion. ap->qc_active ^ done_mask becomes 0x100000000 ^ 0x1 = 0x100000001 and thus tag 0 used as the internal tag will never be reported as completed. This is fixed by introducing ata_qc_get_active() which returns the active hardware tags and calling it where appropriate. This is tested on mv_sata, but sata_fsl and sata_nv suffer from the same problem. There is another case in sata_nv that most likely needs fixing as well, but this looks a little different, so I wasn't confident enough to change that. Fixes: 28361c403683 ("libata: add extra internal command") Cc: stable@vger.kernel.org Tested-by: Pali Rohár Signed-off-by: Sascha Hauer Add missing export of ata_qc_get_active(), as per Pali. Signed-off-by: Jens Axboe commit 71dd2fe5dec171b34b71603a81bb46c24c498fde Author: Axel Lin Date: Sat Dec 21 16:10:49 2019 +0800 regulator: axp20x: Fix axp20x_set_ramp_delay Current code set incorrect bits when set ramp_delay for AXP20X_DCDC2, fix it. Fixes: d29f54df8b16 ("regulator: axp20x: add support for set_ramp_delay for AXP209") Signed-off-by: Axel Lin Link: https://lore.kernel.org/r/20191221081049.32490-1-axel.lin@ingics.com Signed-off-by: Mark Brown commit 2cb7bfc1ca9a34ca148ed77f5f6f07373312bb0a Merge: 46cf053efec6 5fdb0684b5b0 Author: Rafael J. Wysocki Date: Wed Dec 25 15:15:55 2019 +0100 Merge tag 'devfreq-fixes-for-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux Pull devfreq fixes for 5.5-rc4 from Chanwoo Choi: "1. Fix the build error of tegra*-devfreq.c when COMPILE_TEST is enabled. 2. Drop unneeded PM_OPP dependency from each driver in Kconfig." * tag 'devfreq-fixes-for-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux: PM / devfreq: tegra: Add COMMON_CLK dependency PM / devfreq: Drop explicit selection of PM_OPP commit 4911ee401b7ceff8f38e0ac597cbf503d71e690c Author: Ard Biesheuvel Date: Tue Dec 24 14:29:09 2019 +0100 x86/efistub: Disable paging at mixed mode entry The EFI mixed mode entry code goes through the ordinary startup_32() routine before jumping into the kernel's EFI boot code in 64-bit mode. The 32-bit startup code must be entered with paging disabled, but this is not documented as a requirement for the EFI handover protocol, and so we should disable paging explicitly when entering the kernel from 32-bit EFI firmware. Signed-off-by: Ard Biesheuvel Cc: Cc: Arvind Sankar Cc: Hans de Goede Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: https://lkml.kernel.org/r/20191224132909.102540-4-ardb@kernel.org Signed-off-by: Ingo Molnar commit 818c7ce724770fbcdcd43725c81f2b3535f82b76 Author: Hans de Goede Date: Tue Dec 24 14:29:08 2019 +0100 efi/libstub/random: Initialize pointer variables to zero for mixed mode Commit: 0d95981438c3 ("x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table") causes the drivers/efi/libstub/random.c code to get used on x86 for the first time. But this code was not written with EFI mixed mode in mind (running a 64 bit kernel on 32 bit EFI firmware), this causes the kernel to crash during early boot when running in mixed mode. The problem is that in mixed mode pointers are 64 bit, but when running on a 32 bit firmware, EFI calls which return a pointer value by reference only fill the lower 32 bits of the passed pointer, leaving the upper 32 bits uninitialized which leads to crashes. This commit fixes this by initializing pointers which are passed by reference to EFI calls to NULL before passing them, so that the upper 32 bits are initialized to 0. Signed-off-by: Hans de Goede Signed-off-by: Ard Biesheuvel Cc: Arvind Sankar Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 0d95981438c3 ("x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table") Link: https://lkml.kernel.org/r/20191224132909.102540-3-ardb@kernel.org Signed-off-by: Ingo Molnar commit d92b54570d24d017d2630e314b525ed792f5aa6c Author: Arvind Sankar Date: Tue Dec 24 14:29:07 2019 +0100 efi/earlycon: Fix write-combine mapping on x86 On x86, until PAT is initialized, WC translates into UC-. Since we calculate and store pgprot_writecombine(PAGE_KERNEL) when earlycon is initialized, this means we actually use UC- mappings instead of WC mappings, which makes scrolling very slow. Instead store a boolean flag to indicate whether we want to use writeback or write-combine mappings, and recalculate the actual pgprot_t we need on every mapping. Once PAT is initialized, we will start using write-combine mappings, which speeds up the scrolling considerably. Signed-off-by: Arvind Sankar Signed-off-by: Ard Biesheuvel Cc: Hans de Goede Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 69c1f396f25b ("efi/x86: Convert x86 EFI earlyprintk into generic earlycon implementation") Link: https://lkml.kernel.org/r/20191224132909.102540-2-ardb@kernel.org Signed-off-by: Ingo Molnar commit d91f3057263ceb691ef527e71b41a56b17f6c869 Author: Waiman Long Date: Fri Dec 20 08:51:28 2019 -0500 locking/lockdep: Fix buffer overrun problem in stack_trace[] If the lockdep code is really running out of the stack_trace entries, it is likely that buffer overrun can happen and the data immediately after stack_trace[] will be corrupted. If there is less than LOCK_TRACE_SIZE_IN_LONGS entries left before the call to save_trace(), the max_entries computation will leave it with a very large positive number because of its unsigned nature. The subsequent call to stack_trace_save() will then corrupt the data after stack_trace[]. Fix that by changing max_entries to a signed integer and check for negative value before calling stack_trace_save(). Signed-off-by: Waiman Long Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Bart Van Assche Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 12593b7467f9 ("locking/lockdep: Reduce space occupied by stack traces") Link: https://lkml.kernel.org/r/20191220135128.14876-1-longman@redhat.com Signed-off-by: Ingo Molnar commit 463f550fb47bede3a5d7d5177f363a6c3b45d50b Author: Mathieu Desnoyers Date: Wed Dec 11 11:17:12 2019 -0500 rseq: Unregister rseq for clone CLONE_VM It has been reported by Google that rseq is not behaving properly with respect to clone when CLONE_VM is used without CLONE_THREAD. It keeps the prior thread's rseq TLS registered when the TLS of the thread has moved, so the kernel can corrupt the TLS of the parent. The approach of clearing the per task-struct rseq registration on clone with CLONE_THREAD flag is incomplete. It does not cover the use-case of clone with CLONE_VM set, but without CLONE_THREAD. Here is the rationale for unregistering rseq on clone with CLONE_VM flag set: 1) CLONE_THREAD requires CLONE_SIGHAND, which requires CLONE_VM to be set. Therefore, just checking for CLONE_VM covers all CLONE_THREAD uses. There is no point in checking for both CLONE_THREAD and CLONE_VM, 2) There is the possibility of an unlikely scenario where CLONE_SETTLS is used without CLONE_VM. In order to be an issue, it would require that the rseq TLS is in a shared memory area. I do not plan on adding CLONE_SETTLS to the set of clone flags which unregister RSEQ, because it would require that we also unregister RSEQ on set_thread_area(2) and arch_prctl(2) ARCH_SET_FS for completeness. So rather than doing a partial solution, it appears better to let user-space explicitly perform rseq unregistration across clone if needed in scenarios where CLONE_VM is not set. Signed-off-by: Mathieu Desnoyers Signed-off-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191211161713.4490-3-mathieu.desnoyers@efficios.com Signed-off-by: Ingo Molnar commit 66528a4575eee9f5a5270219894ab6178f146e84 Author: Mathieu Desnoyers Date: Wed Dec 11 11:17:11 2019 -0500 rseq: Reject unknown flags on rseq unregister It is preferrable to reject unknown flags within rseq unregistration rather than to ignore them. It is an oversight caused by the fact that the check for unknown flags is after the rseq unregister flag check. Signed-off-by: Mathieu Desnoyers Signed-off-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191211161713.4490-2-mathieu.desnoyers@efficios.com Signed-off-by: Ingo Molnar commit 7f936f2ae4f751697b5bcbd9ba9deab1dcc88450 Merge: 47d0b2fe23d8 0b698c838e84 Author: David S. Miller Date: Tue Dec 24 22:41:07 2019 -0800 Merge branch 's390-qeth-fixes' Julian Wiedmann says: ==================== s390/qeth: fixes 2019-12-23 please apply the following patch series for qeth to your net tree. This brings two fixes for errors during device initialization, deals with several issues in the vnicc control code, and adds a missing lock. ==================== Signed-off-by: David S. Miller commit 0b698c838e84149b690c7e979f78cccb6f8aa4b9 Author: Julian Wiedmann Date: Mon Dec 23 15:03:26 2019 +0100 s390/qeth: fix initialization on old HW I stumbled over an old OSA model that claims to support DIAG_ASSIST, but then rejects the cmd to query its DIAG capabilities. In the old code this was ok, as the returned raw error code was > 0. Now that we translate the raw codes to errnos, the "rc < 0" causes us to fail the initialization of the device. The fix is trivial: don't bail out when the DIAG query fails. Such an error is not critical, we can still use the device (with a slightly reduced set of features). Fixes: 742d4d40831d ("s390/qeth: convert remaining legacy cmd callbacks") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit d1b9ae1864fc3c000e0eb4af8482d78c63e0915a Author: Alexandra Winter Date: Mon Dec 23 15:03:25 2019 +0100 s390/qeth: vnicc Fix init to default During vnicc_init wanted_char should be compared to cur_char and not to QETH_VNICC_DEFAULT. Without this patch there is no way to enforce the default values as desired values. Note, that it is expected, that a card comes online with default values. This patch was tested with private card firmware. Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support") Signed-off-by: Alexandra Winter Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit e8a66d800471e2df7f0b484e2e46898b21d1fa82 Author: Alexandra Winter Date: Mon Dec 23 15:03:24 2019 +0100 s390/qeth: Fix vnicc_is_in_use if rx_bcast not set Symptom: After vnicc/rx_bcast has been manually set to 0, bridge_* sysfs parameters can still be set or written. Only occurs on HiperSockets, as OSA doesn't support changing rx_bcast. Vnic characteristics and bridgeport settings are mutually exclusive. rx_bcast defaults to 1, so manually setting it to 0 should disable bridge_* parameters. Instead it makes sense here to check the supported mask. If the card does not support vnicc at all, bridge commands are always allowed. Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support") Signed-off-by: Alexandra Winter Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 68c57bfd52836e31bff33e5e1fc64029749d2c35 Author: Alexandra Winter Date: Mon Dec 23 15:03:23 2019 +0100 s390/qeth: fix false reporting of VNIC CHAR config failure Symptom: Error message "Configuring the VNIC characteristics failed" in dmesg whenever an OSA interface on z15 is set online. The VNIC characteristics get re-programmed when setting a L2 device online. This follows the selected 'wanted' characteristics - with the exception that the INVISIBLE characteristic unconditionally gets switched off. For devices that don't support INVISIBLE (ie. OSA), the resulting IO failure raises a noisy error message ("Configuring the VNIC characteristics failed"). For IQD, INVISIBLE is off by default anyways. So don't unnecessarily special-case the INVISIBLE characteristic, and thereby suppress the misleading error message on OSA devices. Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support") Signed-off-by: Alexandra Winter Reviewed-by: Julian Wiedmann Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 5b6c7b55cfe26224b0f41b1c226d3534c542787f Author: Julian Wiedmann Date: Mon Dec 23 15:03:22 2019 +0100 s390/qeth: lock the card while changing its hsuid qeth_l3_dev_hsuid_store() initially checks the card state, but doesn't take the conf_mutex to ensure that the card stays in this state while being reconfigured. Rework the code to take this lock, and drop a redundant state check in a helper function. Fixes: b333293058aa ("qeth: add support for af_iucv HiperSockets transport") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 8b5026bc16938920e4780b9094c3bf20e1e0939d Author: Julian Wiedmann Date: Mon Dec 23 15:03:21 2019 +0100 s390/qeth: fix qdio teardown after early init error qeth_l?_set_online() goes through a number of initialization steps, and on any error uses qeth_l?_stop_card() to tear down the residual state. The first initialization step is qeth_core_hardsetup_card(). When this fails after having established a QDIO context on the device (ie. somewhere after qeth_mpc_initialize()), qeth_l?_stop_card() doesn't shut down this QDIO context again (since the card state hasn't progressed from DOWN at this stage). Even worse, we then call qdio_free() as final teardown step to free the QDIO data structures - while some of them are still hooked into wider QDIO infrastructure such as the IRQ list. This is inevitably followed by use-after-frees and other nastyness. Fix this by unconditionally calling qeth_qdio_clear_card() to shut down the QDIO context, and also to halt/clear any pending activity on the various IO channels. Remove the naive attempt at handling the teardown in qeth_mpc_initialize(), it clearly doesn't suffice and we're handling it properly now in the wider teardown code. Fixes: 4a71df50047f ("qeth: new qeth device driver") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 47d0b2fe23d840ecbfc187d9ef0ee9e1a229a332 Merge: ff43ae4bd5aa f081042d128a Author: David S. Miller Date: Tue Dec 24 22:28:55 2019 -0800 Merge branch 'disable-neigh-update-for-tunnels-during-pmtu-update' Hangbin Liu says: ==================== disable neigh update for tunnels during pmtu update When we setup a pair of gretap, ping each other and create neighbour cache. Then delete and recreate one side. We will never be able to ping6 to the new created gretap. The reason is when we ping6 remote via gretap, we will call like gre_tap_xmit() - ip_tunnel_xmit() - tnl_update_pmtu() - skb_dst_update_pmtu() - ip6_rt_update_pmtu() - __ip6_rt_update_pmtu() - dst_confirm_neigh() - ip6_confirm_neigh() - __ipv6_confirm_neigh() - n->confirmed = now As the confirmed time updated, in neigh_timer_handler() the check for NUD_DELAY confirm time will pass and the neigh state will back to NUD_REACHABLE. So the old/wrong mac address will be used again. If we do not update the confirmed time, the neigh state will go to neigh->nud_state = NUD_PROBE; then go to NUD_FAILED and re-create the neigh later, which is what IPv4 does. We couldn't remove the ip6_confirm_neigh() directly as we still need it for TCP flows. To fix it, we have to pass a bool parameter to dst_ops.update_pmtu() and only disable neighbor update for tunnels. v5: No code change, upate some commits description v4: No code change, upate some commits description v3: Do not remove dst_confirm_neigh, but add a new bool parameter in dst_ops.update_pmtu to control whether we should do neighbor confirm. Also split the big patch to small ones for each area. v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu. ==================== Signed-off-by: David S. Miller commit f081042d128a0c7acbd67611def62e1b52e2d294 Author: Hangbin Liu Date: Sun Dec 22 10:51:16 2019 +0800 net/dst: do not confirm neighbor for vxlan and geneve pmtu update When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end, we should not call dst_confirm_neigh() as there is no two-way communication. So disable the neigh confirm for vxlan and geneve pmtu update. v5: No change. v4: No change. v3: Do not remove dst_confirm_neigh, but add a new bool parameter in dst_ops.update_pmtu to control whether we should do neighbor confirm. Also split the big patch to small ones for each area. v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu. Fixes: a93bf0ff4490 ("vxlan: update skb dst pmtu on tx path") Fixes: 52a589d51f10 ("geneve: update skb dst pmtu on tx path") Reviewed-by: Guillaume Nault Tested-by: Guillaume Nault Acked-by: David Ahern Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 4d42df46d6372ece4cb4279870b46c2ea7304a47 Author: Hangbin Liu Date: Sun Dec 22 10:51:15 2019 +0800 sit: do not confirm neighbor when do pmtu update When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end, we should not call dst_confirm_neigh() as there is no two-way communication. v5: No change. v4: No change. v3: Do not remove dst_confirm_neigh, but add a new bool parameter in dst_ops.update_pmtu to control whether we should do neighbor confirm. Also split the big patch to small ones for each area. v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu. Reviewed-by: Guillaume Nault Acked-by: David Ahern Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 8247a79efa2f28b44329f363272550c1738377de Author: Hangbin Liu Date: Sun Dec 22 10:51:14 2019 +0800 vti: do not confirm neighbor when do pmtu update When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end, we should not call dst_confirm_neigh() as there is no two-way communication. Although vti and vti6 are immune to this problem because they are IFF_NOARP interfaces, as Guillaume pointed. There is still no sense to confirm neighbour here. v5: Update commit description. v4: No change. v3: Do not remove dst_confirm_neigh, but add a new bool parameter in dst_ops.update_pmtu to control whether we should do neighbor confirm. Also split the big patch to small ones for each area. v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu. Reviewed-by: Guillaume Nault Acked-by: David Ahern Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 7a1592bcb15d71400a98632727791d1e68ea0ee8 Author: Hangbin Liu Date: Sun Dec 22 10:51:13 2019 +0800 tunnel: do not confirm neighbor when do pmtu update When do tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end, we should not call dst_confirm_neigh() as there is no two-way communication. v5: No Change. v4: Update commit description v3: Do not remove dst_confirm_neigh, but add a new bool parameter in dst_ops.update_pmtu to control whether we should do neighbor confirm. Also split the big patch to small ones for each area. v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu. Fixes: 0dec879f636f ("net: use dst_confirm_neigh for UDP, RAW, ICMP, L2TP") Reviewed-by: Guillaume Nault Tested-by: Guillaume Nault Acked-by: David Ahern Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 07dc35c6e3cc3c001915d05f5bf21f80a39a0970 Author: Hangbin Liu Date: Sun Dec 22 10:51:12 2019 +0800 net/dst: add new function skb_dst_update_pmtu_no_confirm Add a new function skb_dst_update_pmtu_no_confirm() for callers who need update pmtu but should not do neighbor confirm. v5: No change. v4: No change. v3: Do not remove dst_confirm_neigh, but add a new bool parameter in dst_ops.update_pmtu to control whether we should do neighbor confirm. Also split the big patch to small ones for each area. v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu. Reviewed-by: Guillaume Nault Acked-by: David Ahern Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 6e9105c73f8d2163d12d5dfd762fd75483ed30f5 Author: Hangbin Liu Date: Sun Dec 22 10:51:11 2019 +0800 gtp: do not confirm neighbor when do pmtu update When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end, we should not call dst_confirm_neigh() as there is no two-way communication. Although GTP only support ipv4 right now, and __ip_rt_update_pmtu() does not call dst_confirm_neigh(), we still set it to false to keep consistency with IPv6 code. v5: No change. v4: No change. v3: Do not remove dst_confirm_neigh, but add a new bool parameter in dst_ops.update_pmtu to control whether we should do neighbor confirm. Also split the big patch to small ones for each area. v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu. Reviewed-by: Guillaume Nault Acked-by: David Ahern Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 675d76ad0ad5bf41c9a129772ef0aba8f57ea9a7 Author: Hangbin Liu Date: Sun Dec 22 10:51:10 2019 +0800 ip6_gre: do not confirm neighbor when do pmtu update When we do ipv6 gre pmtu update, we will also do neigh confirm currently. This will cause the neigh cache be refreshed and set to REACHABLE before xmit. But if the remote mac address changed, e.g. device is deleted and recreated, we will not able to notice this and still use the old mac address as the neigh cache is REACHABLE. Fix this by disable neigh confirm when do pmtu update v5: No change. v4: No change. v3: Do not remove dst_confirm_neigh, but add a new bool parameter in dst_ops.update_pmtu to control whether we should do neighbor confirm. Also split the big patch to small ones for each area. v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu. Reported-by: Jianlin Shi Reviewed-by: Guillaume Nault Acked-by: David Ahern Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit bd085ef678b2cc8c38c105673dfe8ff8f5ec0c57 Author: Hangbin Liu Date: Sun Dec 22 10:51:09 2019 +0800 net: add bool confirm_neigh parameter for dst_ops.update_pmtu The MTU update code is supposed to be invoked in response to real networking events that update the PMTU. In IPv6 PMTU update function __ip6_rt_update_pmtu() we called dst_confirm_neigh() to update neighbor confirmed time. But for tunnel code, it will call pmtu before xmit, like: - tnl_update_pmtu() - skb_dst_update_pmtu() - ip6_rt_update_pmtu() - __ip6_rt_update_pmtu() - dst_confirm_neigh() If the tunnel remote dst mac address changed and we still do the neigh confirm, we will not be able to update neigh cache and ping6 remote will failed. So for this ip_tunnel_xmit() case, _EVEN_ if the MTU is changed, we should not be invoking dst_confirm_neigh() as we have no evidence of successful two-way communication at this point. On the other hand it is also important to keep the neigh reachability fresh for TCP flows, so we cannot remove this dst_confirm_neigh() call. To fix the issue, we have to add a new bool parameter for dst_ops.update_pmtu to choose whether we should do neigh update or not. I will add the parameter in this patch and set all the callers to true to comply with the previous way, and fix the tunnel code one by one on later patches. v5: No change. v4: No change. v3: Do not remove dst_confirm_neigh, but add a new bool parameter in dst_ops.update_pmtu to control whether we should do neighbor confirm. Also split the big patch to small ones for each area. v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu. Suggested-by: David Miller Reviewed-by: Guillaume Nault Acked-by: David Ahern Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit ff43ae4bd5aab8acd3a4a9cf49a2a99cbb1719fb Merge: 7c3125f0a6eb 063c60d39180 Author: David S. Miller Date: Tue Dec 24 16:12:47 2019 -0800 Merge tag 'rxrpc-fixes-20191220' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== rxrpc: Fixes Here are a couple of bugfixes plus a patch that makes one of the bugfixes easier: (1) Move the ping and mutex unlock on a new call from rxrpc_input_packet() into rxrpc_new_incoming_call(), which it calls. This means the lock-unlock section is entirely within the latter function. This simplifies patch (2). (2) Don't take the call->user_mutex at all in the softirq path. Mutexes aren't allowed to be taken or released there and a patch was merged that caused a warning to be emitted every time this happened. Looking at the code again, it looks like that taking the mutex isn't actually necessary, as the value of call->state will block access to the call. (3) Fix the incoming call path to check incoming calls earlier to reject calls to RPC services for which we don't have a security key of the appropriate class. This avoids an assertion failure if YFS tries making a secure call to the kafs cache manager RPC service. ==================== Signed-off-by: David S. Miller commit 7c3125f0a6ebc17846c5908ad7d6056d66c1c426 Author: Florian Fainelli Date: Fri Dec 20 11:24:21 2019 -0800 net: dsa: bcm_sf2: Fix IP fragment location and behavior The IP fragment is specified through user-defined field as the first bit of the first user-defined word. We were previously trying to extract it from the user-defined mask which could not possibly work. The ip_frag is also supposed to be a boolean, if we do not cast it as such, we risk overwriting the next fields in CFP_DATA(6) which would render the rule inoperative. Fixes: 7318166cacad ("net: dsa: bcm_sf2: Add support for ethtool::rxnfc") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 61d5d4062876e21331c3d0ba4b02dbd50c06a658 Author: Marcelo Ricardo Leitner Date: Fri Dec 20 15:03:44 2019 -0300 sctp: fix err handling of stream initialization The fix on 951c6db954a1 fixed the issued reported there but introduced another. When the allocation fails within sctp_stream_init() it is okay/necessary to free the genradix. But it is also called when adding new streams, from sctp_send_add_streams() and sctp_process_strreset_addstrm_in() and in those situations it cannot just free the genradix because by then it is a fully operational association. The fix here then is to only free the genradix in sctp_stream_init() and on those other call sites move on with what it already had and let the subsequent error handling to handle it. Tested with the reproducers from this report and the previous one, with lksctp-tools and sctp-tests. Reported-by: syzbot+9a1bc632e78a1a98488b@syzkaller.appspotmail.com Fixes: 951c6db954a1 ("sctp: fix memleak on err handling of stream initialization") Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit 9cd34efbd3012171c102910ce17ee632a3cccb44 Author: Kunihiko Hayashi Date: Tue Dec 24 09:58:23 2019 +0900 spi: uniphier: Fix FIFO threshold Rx threshold means the value to inform the receiver when the number of words in Rx FIFO is equal to or more than the value. Similarly, Tx threshold means the value to inform the sender when the number of words in Tx FIFO is equal to or less than the value. The controller triggers the driver to start the transfer. In case of Rx, the driver wants to detect that the specified number of words N are in Rx FIFO, so the value of Rx threshold should be N. In case of Tx, the driver wants to detect that the same number of spaces as Rx are in Tx FIFO, so the value of Tx threshold should be (FIFO size - N). For example, in order for the driver to receive at least 3 words from Rx FIFO, set 3 to Rx threshold. +-+-+-+-+-+-+-+-+ | | | | | |*|*|*| +-+-+-+-+-+-+-+-+ In order for the driver to send at least 3 words to Tx FIFO, because it needs at least 3 spaces, set 8(FIFO size) - 3 = 5 to Tx threshold. +-+-+-+-+-+-+-+-+ |*|*|*|*|*| | | | +-+-+-+-+-+-+-+-+ This adds new function uniphier_spi_set_fifo_threshold() to set threshold value to the register. And more, FIFO counts by 'words', so this renames 'fill_bytes' with 'fill_words', and fixes the calculation using bytes_per_words. Fixes: 37ffab817098 ("spi: uniphier: introduce polling mode") Cc: Keiji Hayashibara Signed-off-by: Kunihiko Hayashi Link: https://lore.kernel.org/r/1577149107-30670-2-git-send-email-hayashi.kunihiko@socionext.com Signed-off-by: Mark Brown commit dcf08d0f8f09081b16f69071dd55d51d5e964e84 Author: Daniel Baluta Date: Fri Dec 20 11:05:31 2019 -0600 ASoC: SOF: imx8: Fix dsp_box offset dsp_box is used to keep DSP initiated messages. The value of dsp_offset is set by the DSP with the first message, so we need a way to bootstrap it in order to get the first message. We do this by setting the correct default dsp_box offset which on i.MX8 is not zero. Very interesting is why it has worked until now. On i.MX8, DSP communicates with ARM core using a shared SDRAM memory area. Actually, there are two shared areas: * SDRAM0 - starting at 0x92400000, size 0x800000 * SDRAM1 - starting at 0x92C00000, size 0x800000 SDRAM0 keeps the data sections, starting with .rodata. By chance fw_ready structure was placed at the beginning of .rodata. dsp_box_base is defined as SDRAM0 + dsp_box_offset and it is placed at the beginning of SDRAM1 (dsp_box_offset should be 0x800000). But because it is zero initialized by default it points to SDRAM0 where by chance the fw_ready was placed in the SOF firmware. Anyhow, SOF commit 7466bee378dd811b ("clk: make freq arrays constant") fw_ready is no longer at the beginning of SDRAM0 and everything shows how lucky we were until now. Fix this by properly setting the default dsp_box offset. Fixes: 202acc565a1f050 ("ASoC: SOF: imx: Add i.MX8 HW support") Signed-off-by: Daniel Baluta Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191220170531.10423-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit dd836ddf4e4e1c7f1eb2ae44783ccd70872ef24e Author: Dragos Tarcatu Date: Wed Dec 4 15:04:47 2019 -0600 ASoC: topology: Prevent use-after-free in snd_soc_get_pcm_runtime() remove_link() is currently calling snd_soc_remove_dai_link() after it has already freed the memory for the link name. But this is later read from snd_soc_get_pcm_runtime() causing a KASAN use-after-free warning. Reorder the cleanups to fix this issue. Reviewed-by: Ranjani Sridharan Signed-off-by: Dragos Tarcatu Signed-off-by: Pierre-Louis Bossart Reviewed-by: Kuninori Morimoto Link: https://lore.kernel.org/r/20191204210447.11701-4-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 77fffa742285f2b587648d6c72b5c705633f146f Author: Chuhong Yuan Date: Tue Dec 3 19:13:03 2019 +0800 ASoC: fsl_audmix: add missed pm_runtime_disable The driver forgets to call pm_runtime_disable in probe failure and remove. Add the missed calls to fix it. Signed-off-by: Chuhong Yuan Acked-by: Nicolin Chen Link: https://lore.kernel.org/r/20191203111303.12933-1-hslester96@gmail.com Signed-off-by: Mark Brown commit 3b7658679d88b5628939f9bdc8e613f79cd821f9 Author: Olivier Moysan Date: Wed Dec 4 16:43:33 2019 +0100 ASoC: stm32: spdifrx: fix input pin state management Changing input state in iec capture control is not safe, as the pin state may be changed concurrently by ASoC framework. Remove pin state handling in iec capture control. Note: This introduces a restriction on capture control, when pin sleep state is defined in device tree. In this case channel status can be captured only when an audio stream capture is active. Fixes: f68c2a682d44 ("ASoC: stm32: spdifrx: add power management") Signed-off-by: Olivier Moysan Link: https://lore.kernel.org/r/20191204154333.7152-4-olivier.moysan@st.com Signed-off-by: Mark Brown commit 86e1956af4c863d653136fd6e5694adf2054dbaa Author: Olivier Moysan Date: Wed Dec 4 16:43:32 2019 +0100 ASoC: stm32: spdifrx: fix race condition in irq handler When snd_pcm_stop() is called in interrupt routine, substream context may have already been released. Add protection on substream context. Fixes: 03e4d5d56fa5 ("ASoC: stm32: Add SPDIFRX support") Signed-off-by: Olivier Moysan Link: https://lore.kernel.org/r/20191204154333.7152-3-olivier.moysan@st.com Signed-off-by: Mark Brown commit 2859b1784031b5709446af8f6039c467f136e67d Author: Olivier Moysan Date: Wed Dec 4 16:43:31 2019 +0100 ASoC: stm32: spdifrx: fix inconsistent lock state In current spdifrx driver locks may be requested as follows: - request lock on iec capture control, when starting synchronization. - request lock in interrupt context, when spdifrx stop is called from IRQ handler. Take lock with IRQs disabled, to avoid the possible deadlock. Lockdep report: [ 74.278059] ================================ [ 74.282306] WARNING: inconsistent lock state [ 74.290120] -------------------------------- ... [ 74.314373] CPU0 [ 74.314377] ---- [ 74.314381] lock(&(&spdifrx->lock)->rlock); [ 74.314396] [ 74.314400] lock(&(&spdifrx->lock)->rlock); Fixes: 03e4d5d56fa5 ("ASoC: stm32: Add SPDIFRX support") Signed-off-by: Olivier Moysan Link: https://lore.kernel.org/r/20191204154333.7152-2-olivier.moysan@st.com Signed-off-by: Mark Brown commit 07d22a9bb623714dc3199099c5cce3df6aef496c Author: Takashi Iwai Date: Wed Dec 4 16:14:54 2019 +0100 ASoC: core: Fix access to uninitialized list heads The error path of soc_new_pcm_runtime() invokes soc_free_pcm_runtime() that may cause a few problems. First off, it calls list_del() for rtd->list that may not be initialized. Similarly, snd_soc_pcm_component_free() traverses over the component list that may not be initialized, either. Such access to the uninitialized list head would lead to either a BUG_ON() or a memory corruption. This patch fixes the access to uninitialized list heads by initializing the list heads properly at the beginning before those error paths. Signed-off-by: Takashi Iwai Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191204151454.21643-1-tiwai@suse.de Signed-off-by: Mark Brown commit 218fe9b7ec7f32c10a07539365488d80af7b0084 Author: Daniel Baluta Date: Wed Dec 4 17:13:33 2019 +0200 ASoC: soc-core: Set dpcm_playback / dpcm_capture When converting a normal link to a DPCM link we need to set dpcm_playback / dpcm_capture otherwise playback/capture streams will not be created resulting in errors like this: [ 36.039111] sai1-wm8960-hifi: ASoC: no backend playback stream Fixes: a655de808cbde ("ASoC: core: Allow topology to override machine driver FE DAI link config") Signed-off-by: Daniel Baluta Link: https://lore.kernel.org/r/20191204151333.26625-1-daniel.baluta@nxp.com Signed-off-by: Mark Brown commit 98910e1d61384430a080b4bcf986c3b0cf3fdf46 Author: Colin Ian King Date: Wed Dec 4 12:48:16 2019 +0000 ASoC: SOF: imx8: fix memory allocation failure check on priv->pd_dev The memory allocation failure check for priv->pd_dev is incorrectly pointer checking priv instead of priv->pd_dev. Fix this. Addresses-Coverity: ("Logically dead code") Fixes: 202acc565a1f ("ASoC: SOF: imx: Add i.MX8 HW support") Signed-off-by: Colin Ian King Reviewed-by: Daniel Baluta Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191204124816.1415359-1-colin.king@canonical.com Signed-off-by: Mark Brown commit feed8a4fc9d46c3126fb9fcae0e9248270c6321a Author: Antonio Messina Date: Thu Dec 19 15:08:03 2019 +0100 udp: fix integer overflow while computing available space in sk_rcvbuf When the size of the receive buffer for a socket is close to 2^31 when computing if we have enough space in the buffer to copy a packet from the queue to the buffer we might hit an integer overflow. When an user set net.core.rmem_default to a value close to 2^31 UDP packets are dropped because of this overflow. This can be visible, for instance, with failure to resolve hostnames. This can be fixed by casting sk_rcvbuf (which is an int) to unsigned int, similarly to how it is done in TCP. Signed-off-by: Antonio Messina Signed-off-by: David S. Miller commit fd1c4bc6e9b34a5e4fe7a3130a49380ef9d7037c Author: Hillf Danton Date: Tue Dec 24 09:14:29 2019 -0700 io-wq: add cond_resched() to worker thread Reschedule the current IO worker to cut the risk that it is becoming a cpu hog. Signed-off-by: Hillf Danton Signed-off-by: Jens Axboe commit fc666936f3f0faeebe32b5f0b0fc49a6d0087c6c Author: Dmitry Osipenko Date: Tue Dec 10 05:05:12 2019 +0300 clk: tegra: Fix double-free in tegra_clk_init() It's unlikely to happen in practice ever, but makes static checkers happy. Fixes: 535f296d47de ("clk: tegra: Add suspend and resume support on Tegra210") Reported-by: Stephen Boyd Signed-off-by: Dmitry Osipenko Link: https://lkml.kernel.org/r/20191210020512.6088-1-digetx@gmail.com Acked-by: Thierry Reding Signed-off-by: Stephen Boyd commit 67f96ff7c8f073648696eab50fd23ded23441067 Author: Marek Szyprowski Date: Mon Dec 16 14:14:07 2019 +0100 clk: samsung: exynos5420: Keep top G3D clocks enabled In Exynos542x/5800 SoCs, the G3D leaf clocks are located in the G3D power domain. This is similar to the other hardware modules and their power domains. However there is one thing specific to G3D clocks hierarchy. Unlike other hardware modules, the G3D clocks hierarchy doesn't have any gate clock between the TOP part of the hierarchy and the part located in the power domain and some SoC internal busses are sourced directly from the TOP muxes. The consequence of this design if the fact that the TOP part of the hierarchy has to be enabled permanently to ensure proper operation of the SoC power related components (G3D power domain and Exynos Power Management Unit for system suspend/resume). This patch adds an explicit call to clk_prepare_enable() on the last MUX in the TOP part of G3D clock hierarchy to keep it enabled permanently to ensure that the internal busses get their clock regardless of the main G3D clock enablement status. This fixes following imprecise abort issue observed on Odroid XU3/XU4 after enabling Panfrost driver by commit 1a5a85c56402 "ARM: dts: exynos: Add Mali/GPU node on Exynos5420 and enable it on Odroid XU3/4"): panfrost 11800000.gpu: clock rate = 400000000 panfrost 11800000.gpu: failed to get regulator: -517 panfrost 11800000.gpu: regulator init failed -517 Power domain G3D disable failed ... panfrost 11800000.gpu: clock rate = 400000000 8<--- cut here --- Unhandled fault: imprecise external abort (0x1406) at 0x00000000 pgd = (ptrval) [00000000] *pgd=00000000 Internal error: : 1406 [#1] PREEMPT SMP ARM Modules linked in: CPU: 7 PID: 53 Comm: kworker/7:1 Not tainted 5.4.0-rc8-next-20191119-00032-g56f1001191a6 #6923 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) Workqueue: events deferred_probe_work_func PC is at panfrost_gpu_soft_reset+0x94/0x110 LR is at ___might_sleep+0x128/0x2dc ... [] (panfrost_gpu_soft_reset) from [] (panfrost_gpu_init+0x10/0x67c) [] (panfrost_gpu_init) from [] (panfrost_device_init+0x158/0x2cc) [] (panfrost_device_init) from [] (panfrost_probe+0x80/0x178) [] (panfrost_probe) from [] (platform_drv_probe+0x48/0x9c) [] (platform_drv_probe) from [] (really_probe+0x1c4/0x474) [] (really_probe) from [] (driver_probe_device+0x78/0x1bc) [] (driver_probe_device) from [] (bus_for_each_drv+0x74/0xb8) [] (bus_for_each_drv) from [] (__device_attach+0xd4/0x16c) [] (__device_attach) from [] (bus_probe_device+0x88/0x90) [] (bus_probe_device) from [] (deferred_probe_work_func+0x4c/0xd0) [] (deferred_probe_work_func) from [] (process_one_work+0x300/0x864) [] (process_one_work) from [] (worker_thread+0x58/0x5a0) [] (worker_thread) from [] (kthread+0x12c/0x160) [] (kthread) from [] (ret_from_fork+0x14/0x20) Exception stack(0xee03dfb0 to 0xee03dff8) ... Code: e594300c e5933020 e3130c01 1a00000f (ebefff50). ---[ end trace badde2b74a65a540 ]--- In the above case, the Panfrost driver disables G3D clocks after failure of getting the needed regulator and return with -EPROVE_DEFER code. This causes G3D power domain disable failure and then, during second probe an imprecise abort is triggered due to undefined power domain state. Fixes: 45f10dabb56b ("clk: samsung: exynos5420: Add SET_RATE_PARENT flag to clocks on G3D path") Fixes: c9f7567aff31 ("clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU") Signed-off-by: Marek Szyprowski Link: https://lkml.kernel.org/r/20191216131407.17225-1-m.szyprowski@samsung.com Acked-by: Krzysztof Kozlowski Acked-by: Chanwoo Choi Acked-by: Sylwester Nawrocki Signed-off-by: Stephen Boyd commit fb3c06cfda0db68f6082f05c43d63c1fb1761af0 Author: Luca Coelho Date: Mon Dec 23 13:00:59 2019 +0200 iwlwifi: fw: make pos static in iwl_sar_get_ewrd_table() loop In the for loop where we are supposed to go through the entire table, we are using a non-static local to keep the pos index. This makes each iteration start with 3, so we always access the first item on the table. Fix this by moving the variable outside of the loo so it doesn't lose its value at every iteration. Reported-by: Colin Ian King Signed-off-by: Luca Coelho Fixes: ba3224db7803 ("iwlwifi: mvm: fix an out-of-bound access") Signed-off-by: Luca Coelho commit f06021a18fcf8d8a1e79c5e0a8ec4eb2b038e153 Author: Luca Coelho Date: Mon Dec 16 22:23:15 2019 +0200 iwlwifi: remove lar_disable module parameter This is an old parameter that was used supposed to be used only when LAR was still under development. It should not be used anymore, but, since it's available, end-users have been mangling with it unnecessarily. In some cases it can cause problems because when LAR is supported the driver and the firmware do not expect it to be disabled. Signed-off-by: Luca Coelho commit 990aba28f5001f6e90fdd84e13612b560a75deda Author: Shahar S Matityahu Date: Sun Dec 15 20:06:22 2019 +0200 iwlwifi: dbg: force stop the debug monitor HW The driver is required to stop the debug monitor HW recording regardless of the debug configuration since the driver is responsible to halt the FW DBGC. Signed-off-by: Shahar S Matityahu Signed-off-by: Luca Coelho commit cc894b85abf70d40e9920976c7fadd6ded757c60 Author: Luca Coelho Date: Tue Dec 10 15:18:16 2019 +0200 iwlwifi: pcie: always disable L0S states L0S states have been found to be unstable with our devices and in newer hardware they are not supported at all, so we must always set the L0S_DISABLED bit. Previously we were only disabling L0S states if L1 was supported, because the assumption was that transitions from L0S to L1 state was the problematic case. But now we should never use L0S, so do it regardless of whether L1 is supported or not. Signed-off-by: Luca Coelho commit 3d1b28fd30ab8b87c0935584aff6f9b433939d2c Author: Luca Coelho Date: Tue Dec 10 15:11:36 2019 +0200 iwlwifi: pcie: rename L0S_ENABLED bit to L0S_DISABLED This bit has been misnamed since the initial implementation of the driver. The correct semantics is that setting this bit disables L0S states, and we already clearly use it as such in the code. Rename it to avoid confusion. Signed-off-by: Luca Coelho commit df2378ab0f2a9dd4cf4501268af1902cc4ebacd8 Author: Johannes Berg Date: Wed Dec 11 10:15:52 2019 +0100 iwlwifi: mvm: fix potential SKB leak on TXQ TX When we transmit after TXQ dequeue, we aren't paying attention to the return value of the transmit functions, leading to a potential SKB leak. Refactor the code a bit (and rename ..._tx to ..._tx_sta) to check for this happening. Signed-off-by: Johannes Berg Fixes: cfbc6c4c5b91 ("iwlwifi: mvm: support mac80211 TXQs model") Signed-off-by: Luca Coelho commit b9f726c94224e863d4d3458dfec2e7e1284a39ce Author: Johannes Berg Date: Wed Dec 11 10:09:56 2019 +0100 iwlwifi: mvm: fix SKB leak on invalid queue It used to be the case that if we got here, we wouldn't warn but instead allocate the queue (DQA). With using the mac80211 TXQs model this changed, and we really have nothing to do with the frame here anymore, hence the warning now. However, clearly we missed in coding & review that this is now a pure error path and leaks the SKB if we return 0 instead of an indication that the SKB needs to be freed. Fix this. Signed-off-by: Johannes Berg Fixes: cfbc6c4c5b91 ("iwlwifi: mvm: support mac80211 TXQs model") Signed-off-by: Luca Coelho commit c366b3dbbab14b28d044b94eb9ce77c23482ea35 Author: Takashi Iwai Date: Mon Dec 23 23:18:16 2019 +0100 ALSA: hda - Apply sync-write workaround to old Intel platforms, too Klaus Ethgen reported occasional high CPU usages in his system that seem caused by HD-audio driver. The perf output revealed that it's in the unsolicited event handling in the workqueue, and the problem seems triggered by some communication stall between the controller and the codec at the runtime or system resume. Actually a similar phenomenon was seen in the past for other Intel platforms, and we already applied the workaround to enforce sync-write for CORB/RIRB verbs for Skylake and newer chipsets (commit 2756d9143aa5 "ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips"). Fortunately, the same workaround is applicable to the old chipset, and the experiment showed the positive effect. Based on the experiment result, this patch enables the sync-write workaround for all Intel chipsets. The only reason I hesitated to apply this workaround was about the possibly slightly higher CPU usage. But if the lack of sync causes a much severer problem even for quite old chip, we should think this would be necessary for all Intel chips. Reported-by: Klaus Ethgen Cc: Link: https://lore.kernel.org/r/20191223171833.GA17053@chua Link: https://lore.kernel.org/r/20191223221816.32572-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b9fb2de0115bbacab36da31fd10483ea66d9cfab Merge: 46cf053efec6 55347ec340af Author: Ingo Molnar Date: Mon Dec 23 22:27:44 2019 +0100 Merge tag 'perf-urgent-for-mingo-5.5-20191223' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: perf report/top: Arnaldo Carvalho de Melo: - Fix popup menu for entries in main kernel maps other than the main one, e.g. ".init.text", where a non-initialized pointer was causing segfaults. Jin Yao: - Fix incorrectly added dimensions when switching perf.data file to another via the popup menu. libtraceevent: Hewenliang: - Fix memory leakage in filter_event(). perf hists: Yuya Fujita: - Fix variable name's inconsistency in hists__for_each() macro. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 2a1f40adfb54ca65dc4c93bad444dd23b800a76e Author: Mathieu Desnoyers Date: Fri Dec 20 15:33:18 2019 -0500 rseq/selftests: Clarify rseq_prepare_unload() helper requirements The rseq.h UAPI now documents that the rseq_cs field must be cleared before reclaiming memory that contains the targeted struct rseq_cs, but also that the rseq_cs field must be cleared before reclaiming memory of the code pointed to by the rseq_cs start_ip and post_commit_offset fields. While we can expect that use of dlclose(3) will typically unmap both struct rseq_cs and its associated code at once, nothing would theoretically prevent a JIT from reclaiming the code without reclaiming the struct rseq_cs, which would erroneously allow the kernel to consider new code which is not a rseq critical section as a rseq critical section following a code reclaim. Suggested-by: Florian Weimer Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: Florian Weimer Cc: Thomas Gleixner Cc: Peter Zijlstra (Intel) Cc: "Paul E. McKenney" Cc: Boqun Feng Cc: "H . Peter Anvin" Cc: Paul Turner Cc: Dmitry Vyukov Signed-off-by: Shuah Khan commit 8df34c56321479bfa1ec732c675b686c2b4df412 Author: Mathieu Desnoyers Date: Wed Dec 11 11:17:13 2019 -0500 rseq/selftests: Fix: Namespace gettid() for compatibility with glibc 2.30 glibc 2.30 introduces gettid() in public headers, which clashes with the internal static definition within rseq selftests. Rename gettid() to rseq_gettid() to eliminate this symbol name clash. Reported-by: Tommi T. Rantala Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: Tommi T. Rantala Cc: Thomas Gleixner Cc: Peter Zijlstra (Intel) Cc: "Paul E. McKenney" Cc: Boqun Feng Cc: "H . Peter Anvin" Cc: Paul Turner Cc: Dmitry Vyukov Cc: # v4.18+ Signed-off-by: Shuah Khan commit af9cb29c5488381083b0b5ccdfb3cd931063384a Author: Mathieu Desnoyers Date: Wed Dec 11 11:28:57 2019 -0500 rseq/selftests: Turn off timeout setting As the rseq selftests can run for a long period of time, disable the timeout that the general selftests have. Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: Thomas Gleixner Cc: Peter Zijlstra (Intel) Cc: "Paul E. McKenney" Cc: Boqun Feng Cc: "H . Peter Anvin" Cc: Paul Turner Cc: Dmitry Vyukov Signed-off-by: Shuah Khan commit b1b35201bcf411191986eefdef5f5fb5f41cd879 Author: SeongJae Park Date: Fri Dec 20 05:14:08 2019 +0000 kunit/kunit_tool_test: Test '--build_dir' option run This commit adds kunit tool test for the '--build_dir' option. Signed-off-by: SeongJae Park Reviewed-by: Brendan Higgins Tested-by: Brendan Higgins Signed-off-by: Shuah Khan commit 14ee5cfd4512ee3d1e0047d8751450dcc6544070 Author: SeongJae Park Date: Fri Dec 20 05:14:07 2019 +0000 kunit: Rename 'kunitconfig' to '.kunitconfig' This commit renames 'kunitconfig' to '.kunitconfig' so that it can be automatically ignored by git and do not disturb people who want to type 'kernel/' by pressing only the 'k' and then 'tab' key. Signed-off-by: SeongJae Park Reviewed-by: Brendan Higgins Tested-by: Brendan Higgins Signed-off-by: Shuah Khan commit 609952c2afc9542b336cf9a72d4a09606e05fa2a Author: SeongJae Park Date: Fri Dec 20 05:14:06 2019 +0000 kunit: Place 'test.log' under the 'build_dir' 'kunit' writes the 'test.log' under the kernel source directory even though a 'build_dir' option is given. As users who use the option might expect the outputs to be placed under the specified directory, this commit modifies the logic to write the log file under the 'build_dir'. Signed-off-by: SeongJae Park Reviewed-by: Brendan Higgins Tested-by: Brendan Higgins Signed-off-by: Shuah Khan commit e3212513a8f07786cb262cf78dfe9c4d0c1b1786 Author: SeongJae Park Date: Fri Dec 20 05:14:05 2019 +0000 kunit: Create default config in '--build_dir' If both '--build_dir' and '--defconfig' are given, the handling of '--defconfig' ignores '--build_dir' option. This commit modifies the behavior to respect '--build_dir' option. Reported-by: Brendan Higgins Suggested-by: Brendan Higgins Signed-off-by: SeongJae Park Reviewed-by: Brendan Higgins Tested-by: Brendan Higgins Signed-off-by: Shuah Khan commit 8c0140facb380da5740182d189be0b0d9deadb3d Author: SeongJae Park Date: Fri Dec 20 05:14:04 2019 +0000 kunit: Remove duplicated defconfig creation '--defconfig' option is handled by the 'main() of the 'kunit.py' but again handled in following 'run_tests()'. This commit removes this duplicated handling of the option in the 'run_tests()'. Signed-off-by: SeongJae Park Reviewed-by: Brendan Higgins Tested-by: Brendan Higgins Signed-off-by: Shuah Khan commit 1c68cbadf09f685e1ffc6cc4c9094e67131f9a2f Author: SeongJae Park Date: Fri Dec 20 05:14:03 2019 +0000 docs/kunit/start: Use in-tree 'kunit_defconfig' The kunit doc suggests users to get the default `kunitconfig` from an external git tree. However, the file is already located under the `arch/um/configs/` of the kernel tree. Because the local file is easier to access and maintain, this commit updates the doc to use it. Signed-off-by: SeongJae Park Reviewed-by: Brendan Higgins Tested-by: Brendan Higgins Signed-off-by: Shuah Khan commit 05564c29fc943c467abb1f60ef1f0a68c4c424e9 Author: Shuah Khan Date: Mon Dec 16 12:18:40 2019 -0700 selftests: livepatch: Fix it to do root uid check and skip livepatch test configures the system and debug environment to run tests. Some of these actions fail without root access and test dumps several permission denied messages before it exits. Fix test-state.sh to call setup_config instead of set_dynamic_debug as suggested by Petr Mladek Fix it to check root uid and exit with skip code instead. Signed-off-by: Shuah Khan Acked-by: Joe Lawrence Reviewed-by: Petr Mladek Signed-off-by: Shuah Khan commit c65e41538b04e0d64a673828745a00cb68a24371 Author: Shuah Khan Date: Thu Dec 12 18:56:06 2019 -0700 selftests: firmware: Fix it to do root uid check and skip firmware attempts to load test modules that require root access and fail. Fix it to check for root uid and exit with skip code instead. Before this fix: selftests: firmware: fw_run_tests.sh modprobe: ERROR: could not insert 'test_firmware': Operation not permitted You must have the following enabled in your kernel: CONFIG_TEST_FIRMWARE=y CONFIG_FW_LOADER=y CONFIG_FW_LOADER_USER_HELPER=y CONFIG_IKCONFIG=y CONFIG_IKCONFIG_PROC=y not ok 1 selftests: firmware: fw_run_tests.sh # SKIP With this fix: selftests: firmware: fw_run_tests.sh skip all tests: must be run as root not ok 1 selftests: firmware: fw_run_tests.sh # SKIP Signed-off-by: Shuah Khan Reviwed-by: Greg Kroah-Hartman Signed-off-by: Shuah Khan commit 7648dd9fc981cec52df8a635fa2eefc249e138b9 Author: Shuah Khan Date: Tue Dec 10 17:12:33 2019 -0700 selftests: filesystems/epoll: fix build error epoll build fails to find pthread lib. Fix Makefile to use LDLIBS instead of LDFLAGS. LDLIBS is the right flag to use here with -l option when invoking ld. gcc -I../../../../../usr/include/ -lpthread epoll_wakeup_test.c -o .../tools/testing/selftests/filesystems/epoll/epoll_wakeup_test /usr/bin/ld: /tmp/ccaZvJUl.o: in function `kill_timeout': epoll_wakeup_test.c:(.text+0x4dd): undefined reference to `pthread_kill' /usr/bin/ld: epoll_wakeup_test.c:(.text+0x4f2): undefined reference to `pthread_kill' /usr/bin/ld: /tmp/ccaZvJUl.o: in function `epoll9': epoll_wakeup_test.c:(.text+0x6382): undefined reference to `pthread_create' /usr/bin/ld: epoll_wakeup_test.c:(.text+0x64d2): undefined reference to `pthread_create' /usr/bin/ld: epoll_wakeup_test.c:(.text+0x6626): undefined reference to `pthread_join' /usr/bin/ld: epoll_wakeup_test.c:(.text+0x684c): undefined reference to `pthread_tryjoin_np' /usr/bin/ld: epoll_wakeup_test.c:(.text+0x6864): undefined reference to `pthread_kill' /usr/bin/ld: epoll_wakeup_test.c:(.text+0x6878): undefined reference to `pthread_join' Signed-off-by: Shuah Khan commit 1f424e8bd18754d27b15f49359004b0cea344fb5 Author: Hillf Danton Date: Sun Dec 22 22:46:54 2019 +0800 io-wq: remove unused busy list from io_sqe Commit e61df66c69b1 ("io-wq: ensure free/busy list browsing see all items") added a list for io workers in addition to the free and busy lists, not only making worker walk cleaner, but leaving the busy list unused. Let's remove it. Signed-off-by: Hillf Danton Signed-off-by: Jens Axboe commit 046aca3c25fd28da591f59a2dc1a01848e81e0b2 Author: Paulo Alcantara (SUSE) Date: Wed Dec 18 18:11:37 2019 -0300 cifs: Optimize readdir on reparse points When listing a directory with thounsands of files and most of them are reparse points, we simply marked all those dentries for revalidation and then sending additional (compounded) create/getinfo/close requests for each of them. Instead, upon receiving a response from an SMB2_QUERY_DIRECTORY (FileIdFullDirectoryInformation) command, the directory entries that have a file attribute of FILE_ATTRIBUTE_REPARSE_POINT will contain an EaSize field with a reparse tag in it, so we parse it and mark the dentry for revalidation only if it is a DFS or a symlink. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Pavel Shilovsky Signed-off-by: Steve French commit 7935799e041ae10d380d04ea23868240f082bd11 Author: Nathan Chancellor Date: Tue Dec 17 20:04:51 2019 -0700 cifs: Adjust indentation in smb2_open_file Clang warns: ../fs/cifs/smb2file.c:70:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation] if (oparms->tcon->use_resilient) { ^ ../fs/cifs/smb2file.c:66:2: note: previous statement is here if (rc) ^ 1 warning generated. This warning occurs because there is a space after the tab on this line. Remove it so that the indentation is consistent with the Linux kernel coding style and clang no longer warns. Fixes: 592fafe644bf ("Add resilienthandles mount parm") Link: https://github.com/ClangBuiltLinux/linux/issues/826 Signed-off-by: Nathan Chancellor Signed-off-by: Steve French commit fa633a0f89192379828103957874682d389eae83 Author: Namhyung Kim Date: Mon Dec 23 15:13:26 2019 +0900 libbpf: Fix build on read-only filesystems I got the following error when I tried to build perf on a read-only filesystem with O=dir option. $ cd /some/where/ro/linux/tools/perf $ make O=$HOME/build/perf ... CC /home/namhyung/build/perf/lib.o /bin/sh: bpf_helper_defs.h: Read-only file system make[3]: *** [Makefile:184: bpf_helper_defs.h] Error 1 make[2]: *** [Makefile.perf:778: /home/namhyung/build/perf/libbpf.a] Error 2 make[2]: *** Waiting for unfinished jobs.... LD /home/namhyung/build/perf/libperf-in.o AR /home/namhyung/build/perf/libperf.a PERF_VERSION = 5.4.0 make[1]: *** [Makefile.perf:225: sub-make] Error 2 make: *** [Makefile:70: all] Error 2 It was becaused bpf_helper_defs.h was generated in current directory. Move it to OUTPUT directory. Signed-off-by: Namhyung Kim Signed-off-by: Daniel Borkmann Tested-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191223061326.843366-1-namhyung@kernel.org commit e85ade1f50aae464ce196672faa7a099fd1721ed Author: Chris Wilson Date: Wed Dec 18 10:40:43 2019 +0000 drm/i915: Hold reference to intel_frontbuffer as we track activity Since obj->frontbuffer is no longer protected by the struct_mutex, as we are processing the execbuf, it may be removed. Mark the intel_frontbuffer as rcu protected, and so acquire a reference to the struct as we track activity upon it. Closes: https://gitlab.freedesktop.org/drm/intel/issues/827 Fixes: 8e7cb1799b4f ("drm/i915: Extract intel_frontbuffer active tracking") Signed-off-by: Chris Wilson Cc: Matthew Auld Cc: # v5.4+ Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20191218104043.3539458-1-chris@chris-wilson.co.uk (cherry picked from commit da42104f589d979bbe402703fd836cec60befae1) Signed-off-by: Jani Nikula commit d39da686c2f3b8518b6933951d53891aa83227d6 Author: Chris Wilson Date: Wed Dec 18 09:35:04 2019 +0000 drm/i915/gt: Ratelimit display power w/a For very light workloads that frequently park, acquiring the display power well (required to prevent the dmc from trashing the system) takes longer than the execution. A good example is the igt_coherency selftest, which is slowed down by an order of magnitude in the worst case with powerwell cycling. To prevent frequent cycling, while keeping our fast soft-rc6, use a timer to delay release of the display powerwell. Fixes: 311770173fac ("drm/i915/gt: Schedule request retirement when timeline idles") References: https://gitlab.freedesktop.org/drm/intel/issues/848 Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191218093504.3477048-1-chris@chris-wilson.co.uk (cherry picked from commit 81ff52b705775433a955b2746d37b87bdc89a3d0) Signed-off-by: Jani Nikula commit 74ac57806af124b57af30f2ca9fc9df0afe6269e Author: Tvrtko Ursulin Date: Tue Dec 17 14:20:57 2019 +0000 drm/i915/pmu: Ensure monotonic rc6 Avoid rc6 counter going backward in close to 0% RC6 scenarios like: 15.005477996 114,246,613 ns i915/rc6-residency/ 16.005876662 667,657 ns i915/rc6-residency/ 17.006131417 7,286 ns i915/rc6-residency/ 18.006615031 18,446,744,073,708,914,688 ns i915/rc6-residency/ 19.007158361 18,446,744,073,709,447,168 ns i915/rc6-residency/ 20.007806498 0 ns i915/rc6-residency/ 21.008227495 1,440,403 ns i915/rc6-residency/ There are two aspects to this fix. First is not assuming rc6 value zero means GT is asleep since that can also mean GPU is fully busy and we do not want to enter the estimation path in that case. Second is ensuring monotonicity on the estimation path itself. I suspect what is happening is with extremely rapid park/unpark cycles we get no updates on the real rc6 and therefore have to careful not to unconditionally trust use last known real rc6 when creating a new estimation. v2: * Simplify logic by not tracking the estimate but last reported value. Signed-off-by: Tvrtko Ursulin Fixes: 16ffe73c186b ("drm/i915/pmu: Use GT parked for estimating RC6 while asleep") Cc: Chris Wilson Reviewed-by: Chris Wilson # v1 Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20191217142057.1000-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit df6a42053513846475ae1fbd224dfbdbcd0c7010) Signed-off-by: Jani Nikula commit 91a063c956084fb21cf2523bce6892514e3f1799 Author: Michael Ellerman Date: Sat Dec 21 14:16:54 2019 +1100 powerpc/mm: Mark get_slice_psize() & slice_addr_is_low() as notrace These slice routines are called from the SLB miss handler, which can lead to warnings from the IRQ code, because we have not reconciled the IRQ state properly: WARNING: CPU: 72 PID: 30150 at arch/powerpc/kernel/irq.c:258 arch_local_irq_restore.part.0+0xcc/0x100 Modules linked in: CPU: 72 PID: 30150 Comm: ftracetest Not tainted 5.5.0-rc2-gcc9x-g7e0165b2f1a9 #1 NIP: c00000000001d83c LR: c00000000029ab90 CTR: c00000000026cf90 REGS: c0000007eee3b960 TRAP: 0700 Not tainted (5.5.0-rc2-gcc9x-g7e0165b2f1a9) MSR: 8000000000021033 CR: 22242844 XER: 20000000 CFAR: c00000000001d780 IRQMASK: 0 ... NIP arch_local_irq_restore.part.0+0xcc/0x100 LR trace_graph_entry+0x270/0x340 Call Trace: trace_graph_entry+0x254/0x340 (unreliable) function_graph_enter+0xe4/0x1a0 prepare_ftrace_return+0xa0/0x130 ftrace_graph_caller+0x44/0x94 # (get_slice_psize()) slb_allocate_user+0x7c/0x100 do_slb_fault+0xf8/0x300 instruction_access_slb_common+0x140/0x180 Fixes: 48e7b7695745 ("powerpc/64s/hash: Convert SLB miss handlers to C") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191221121337.4894-1-mpe@ellerman.id.au commit d84a7a654a66eead599cfd4f436d1f921e01074f Author: Johannes Berg Date: Thu Dec 5 09:31:07 2019 +0100 iwlwifi: pcie: extend hardware workaround to context-info After more investigation on the hardware side, it appears that the hardware bug regarding 2^32 boundary reaching/crossing also affects other uses of the DMA engine, in particular the ones triggered by the context-info (image loader) mechanism. It also turns out that the bug only affects devices with gen2 TX hardware engine, so we don't need to change context info for gen3. The TX path workarounds are simpler to still keep for both though. Add the workaround to that code as well; this is a lot simpler as we have just a single way to allocate DMA memory there. I made the algorithm recursive (with a small limit) since it's actually (almost) impossible to hit this today - dma_alloc_coherent is currently documented to always return 32-bit addressable memory regardless of the DMA mask for it, and so we could only get REALLY unlucky to get the very last page in that area. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit 2763bba6328c53c455d8f7f5302b80030551c31b Author: Haim Dreyfuss Date: Wed Nov 27 14:55:58 2019 -0500 iwlwifi: Don't ignore the cap field upon mcc update When receiving a new MCC driver get all the data about the new country code and its regulatory information. Mistakenly, we ignored the cap field, which includes global regulatory information which should be applies to every channel. Fix it. Signed-off-by: Haim Dreyfuss Signed-off-by: Luca Coelho commit ed780545c13a21dc0276807897e2d4fc142e11ac Author: Johannes Berg Date: Thu Nov 21 11:02:31 2019 +0100 iwlwifi: mvm: report TX rate to mac80211 directly for RS offload If we have offloaded rate scaling, which is always true for those devices supporting HE, then report the TX rate directly from the data the firmware gives us, instead of only passing it to mac80211 on frame status only and for it to track it. First of all, this makes us always report the last good rate that the rate scaling algorithm picked, which is better than reporting the last rate for any frame since management frames etc. are sent with very low rates and could interfere. Additionally, this allows us to properly report HE rates, though in case there's a lot of trigger-based traffic, we don't get any choice in the rates and don't report that properly right now. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit b3f20e098293892388d6a0491d6bbb2efb46fbff Author: Luca Coelho Date: Mon Nov 25 13:21:58 2019 +0200 iwlwifi: mvm: fix NVM check for 3168 devices We had a check on !NVM_EXT and then a check for NVM_SDP in the else block of this if. The else block, obviously, could only be reached if using NVM_EXT, so it would never be NVM_SDP. Fix that by checking whether the nvm_type is IWL_NVM instead of checking for !IWL_NVM_EXT to solve this issue. Reported-by: Stefan Sperling Signed-off-by: Luca Coelho commit 4f565ee2999960d541854389e20b78e7105e3afc Author: Luca Coelho Date: Mon Nov 25 11:50:58 2019 +0200 iwlwifi: fix TLV fragment allocation loop In the allocation loop, "pages" will never become zero (because of the DIV_ROUND_UP), so if we can't allocate any size and pages becomes 1, we will keep trying to allocate 1 page until it succeeds. And in that case, as coverity reported, block will never be NULL. Reported-by: coverity-bot Addresses-Coverity-ID: 1487402 ("Control flow issues") Fixes: 14124b25780d ("iwlwifi: dbg_ini: implement monitor allocation flow") Signed-off-by: Luca Coelho Fixes: 14124b25780d ("iwlwifi: dbg_ini: implement monitor allocation flow") Signed-off-by: Luca Coelho commit a89c72ffd07369f5ccc74f0332d2785a7077241d Author: Johannes Berg Date: Thu Nov 14 09:09:34 2019 +0100 iwlwifi: pcie: allocate smaller dev_cmd for TX headers As noted in the previous commit, due to the way we allocate the dev_cmd headers with 324 byte size, and 4/8 byte alignment, the part we use of them (bytes 20..40-68) could still cross a page and thus 2^32 boundary. Address this by using alignment to ensure that the allocation cannot cross a page boundary, on hardware that's affected. To make that not cause more memory consumption, reduce the size of the allocations to the necessary size - we go from 324 bytes in each allocation to 60/68 on gen2 depending on family, and ~120 or so on gen1 (so on gen1 it's a pure reduction in size, since we don't need alignment there). To avoid size and clearing issues, add a new structure that's just the header, and use kmem_cache_zalloc(). Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit c5a4e8eb683c6a80c6907c12acf7b66665ef4b0b Author: Johannes Berg Date: Thu Nov 14 09:26:20 2019 +0100 iwlwifi: pcie: detect the DMA bug and warn if it happens Warn if the DMA bug is going to happen. We don't have a good way of actually aborting in this case and we have workarounds in place for the cases where it happens, but in order to not be surprised add a safety-check and warn. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit c4a786b32621850775dedd1a329de0c060f9c904 Author: Johannes Berg Date: Tue Nov 12 10:32:42 2019 +0100 iwlwifi: pcie: work around DMA hardware bug There's a hardware bug in the flow handler (DMA engine), if the address + len of some TB wraps around a 2^32 boundary, the carry bit is then carried over into the next TB. Work around this by copying the data to a new page when we find this situation, and then copy it in a way that we cannot hit the very end of the page. To be able to free the new page again later we need to chain it to the TSO page, use the last pointer there to make sure we can never use the page fully for DMA, and thus cannot cause the same overflow situation on this page. This leaves a few potential places (where we didn't observe the problem) unaddressed: * The second TB could reach or cross the end of a page (and thus 2^32) due to the way we allocate the dev_cmd for the header * For host commands, a similar thing could happen since they're just kmalloc(). We'll address these in further commits. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit 106f7b3bf943d267eb657f34616adcaadb2ab07f Author: Angus Ainslie (Purism) Date: Mon Dec 23 09:12:53 2019 +0100 arm64: dts: imx8mq-librem5-devkit: use correct interrupt for the magnetometer The LSM9DS1 uses a high level interrupt. Signed-off-by: Angus Ainslie (Purism) Signed-off-by: Martin Kepplinger Fixes: eb4ea0857c83 ("arm64: dts: fsl: librem5: Add a device tree for the Librem5 devkit") Signed-off-by: Shawn Guo commit fe6a6689d1815b63528796886853890d8ee7f021 Author: Marek Vasut Date: Fri Dec 20 10:11:24 2019 +0100 ARM: dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection The SGTL5000 VDDIO is connected to the PMIC SW2 output, not to a fixed 3V3 rail. Describe this correctly in the DT. Fixes: 52c7a088badd ("ARM: dts: imx6q: Add support for the DHCOM iMX6 SoM and PDK2") Signed-off-by: Marek Vasut Cc: Fabio Estevam Cc: Ludwig Zenz Cc: NXP Linux Team To: linux-arm-kernel@lists.infradead.org Signed-off-by: Shawn Guo commit 24461d9792c2c706092805ff1b067628933441bd Author: Peter Ujfalusi Date: Fri Dec 20 15:11:00 2019 +0200 dmaengine: virt-dma: Fix access after free in vchan_complete() vchan_vdesc_fini() is freeing up 'vd' so the access to vd->tx_result is via already freed up memory. Move the vchan_vdesc_fini() after invoking the callback to avoid this. Fixes: 09d5b702b0f97 ("dmaengine: virt-dma: store result on dma descriptor") Signed-off-by: Peter Ujfalusi Reviewed-by: Alexandru Ardelean Link: https://lore.kernel.org/r/20191220131100.21804-1-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul commit 2f42e05b942fe2fbfb9bbc6e34e1dd8c3ce4f3a4 Author: John Stultz Date: Wed Dec 18 19:09:06 2019 +0000 dmaengine: k3dma: Avoid null pointer traversal In some cases we seem to submit two transactions in a row, which causes us to lose track of the first. If we then cancel the request, we may still get an interrupt, which traverses a null ds_run value. So try to avoid starting a new transaction if the ds_run value is set. While this patch avoids the null pointer crash, I've had some reports of the k3dma driver still getting confused, which suggests the ds_run/ds_done value handling still isn't quite right. However, I've not run into an issue recently with it so I think this patch is worth pushing upstream to avoid the crash. Signed-off-by: John Stultz [add ss tag] Link: https://lore.kernel.org/r/20191218190906.6641-1-john.stultz@linaro.org Signed-off-by: Vinod Koul commit b8ab62ff7199fac8ce27fa4a149929034fabe7f8 Author: Peng Fan Date: Wed Dec 18 12:22:32 2019 +0000 ARM: dts: imx7ulp: fix reg of cpu node According to arm cpus binding doc, " On 32-bit ARM v7 or later systems this property is required and matches the CPU MPIDR[23:0] register bits. Bits [23:0] in the reg cell must be set to bits [23:0] in MPIDR. All other bits in the reg cell must be set to 0. " In i.MX7ULP, the MPIDR[23:0] is 0xf00, not 0, so fix it. Otherwise there will be warning: "DT missing boot CPU MPIDR[23:0], fall back to default cpu_logical_map" Fixes: 20434dc92c05 ("ARM: dts: imx: add common imx7ulp dtsi support") Signed-off-by: Peng Fan Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 24a572bf67994223e722cadfe663e15ba221882a Author: Adam Ford Date: Mon Dec 16 05:15:30 2019 -0600 arm64: dts: imx8mm: Change SDMA1 ahb clock for imx8mm Using SDMA1 with UART1 is causing a "Timeout waiting for CH0" error. This patch changes to ahb clock from SDMA1_ROOT to AHB which fixes the timeout error. Fixes: a05ea40eb384 ("arm64: dts: imx: Add i.mx8mm dtsi support") Signed-off-by: Adam Ford Signed-off-by: Shawn Guo commit 33eae7fb2e593fdbaac15d843e2558379c6d1149 Author: Yinbo Zhu Date: Fri Dec 13 10:18:39 2019 +0800 arm64: dts: ls1028a: fix endian setting for dcfg DCFG block uses little endian. Fix it so that register access becomes correct. Signed-off-by: Yinbo Zhu Acked-by: Yangbo Lu Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC") Signed-off-by: Shawn Guo commit 7d7778b1396bc9e2a3875009af522beb4ea9355a Author: Alexandre Belloni Date: Fri Dec 13 00:08:14 2019 +0100 ARM: dts: imx6q-dhcom: fix rtc compatible The only correct and documented compatible string for the rv3029 is microcrystal,rv3029. Fix it up. Fixes: 52c7a088badd ("ARM: dts: imx6q: Add support for the DHCOM iMX6 SoM and PDK2") Signed-off-by: Alexandre Belloni Signed-off-by: Shawn Guo commit 5fdb0684b5b0f41402161f068d3d84bf6ed1c3f4 Author: Arnd Bergmann Date: Thu Dec 12 10:56:31 2019 +0900 PM / devfreq: tegra: Add COMMON_CLK dependency Compile-testing this driver fails if CONFIG_COMMON_CLK is not set: drivers/devfreq/tegra30-devfreq.o: In function `tegra_devfreq_target': tegra30-devfreq.c:(.text+0x164): undefined reference to `clk_set_min_rate' Fixes: 35f8dbc72721 ("PM / devfreq: tegra: Enable COMPILE_TEST for the driver") Signed-off-by: Arnd Bergmann Reviewed-by: Dmitry Osipenko Signed-off-by: Chanwoo Choi commit 996fa477d118a11e63f77fbb393173560e5a655d Author: Leonard Crestez Date: Mon Nov 11 20:16:10 2019 +0200 PM / devfreq: Drop explicit selection of PM_OPP CONFIG_PM_OPP is already selected by CONFIG_PM_DEVFREQ since commit b9c69e043266 ("PM / devfreq: Add dependency on PM_OPP"). This means that individual drivers shouldn't "select PM_OPP" explicitly. Signed-off-by: Leonard Crestez [cw00.choi: Edit the patch title] Signed-off-by: Chanwoo Choi commit f54c7898ed1c3c9331376c0337a5049c38f66497 Author: Daniel Borkmann Date: Sun Dec 22 23:37:40 2019 +0100 bpf: Fix precision tracking for unbounded scalars Anatoly has been fuzzing with kBdysch harness and reported a hang in one of the outcomes. Upon closer analysis, it turns out that precise scalar value tracking is missing a few precision markings for unknown scalars: 0: R1=ctx(id=0,off=0,imm=0) R10=fp0 0: (b7) r0 = 0 1: R0_w=invP0 R1=ctx(id=0,off=0,imm=0) R10=fp0 1: (35) if r0 >= 0xf72e goto pc+0 --> only follow fallthrough 2: R0_w=invP0 R1=ctx(id=0,off=0,imm=0) R10=fp0 2: (35) if r0 >= 0x80fe0000 goto pc+0 --> only follow fallthrough 3: R0_w=invP0 R1=ctx(id=0,off=0,imm=0) R10=fp0 3: (14) w0 -= -536870912 4: R0_w=invP536870912 R1=ctx(id=0,off=0,imm=0) R10=fp0 4: (0f) r1 += r0 5: R0_w=invP536870912 R1_w=inv(id=0) R10=fp0 5: (55) if r1 != 0x104c1500 goto pc+0 --> push other branch for later analysis R0_w=invP536870912 R1_w=inv273421568 R10=fp0 6: R0_w=invP536870912 R1_w=inv273421568 R10=fp0 6: (b7) r0 = 0 7: R0=invP0 R1=inv273421568 R10=fp0 7: (76) if w1 s>= 0xffffff00 goto pc+3 --> only follow goto 11: R0=invP0 R1=inv273421568 R10=fp0 11: (95) exit 6: R0_w=invP536870912 R1_w=inv(id=0) R10=fp0 6: (b7) r0 = 0 propagating r0 7: safe processed 11 insns [...] In the analysis of the second path coming after the successful exit above, the path is being pruned at line 7. Pruning analysis found that both r0 are precise P0 and both R1 are non-precise scalars and given prior path with R1 as non-precise scalar succeeded, this one is therefore safe as well. However, problem is that given condition at insn 7 in the first run, we only followed goto and didn't push the other branch for later analysis, we've never walked the few insns in there and therefore dead-code sanitation rewrites it as goto pc-1, causing the hang depending on the skb address hitting these conditions. The issue is that R1 should have been marked as precise as well such that pruning enforces range check and conluded that new R1 is not in range of old R1. In insn 4, we mark R1 (skb) as unknown scalar via __mark_reg_unbounded() but not mark_reg_unbounded() and therefore regs->precise remains as false. Back in b5dc0163d8fd ("bpf: precise scalar_value tracking"), this was not the case since marking out of __mark_reg_unbounded() had this covered as well. Once in both are set as precise in 4 as they should have been, we conclude that given R1 was in prior fall-through path 0x104c1500 and now is completely unknown, the check at insn 7 concludes that we need to continue walking. Analysis after the fix: 0: R1=ctx(id=0,off=0,imm=0) R10=fp0 0: (b7) r0 = 0 1: R0_w=invP0 R1=ctx(id=0,off=0,imm=0) R10=fp0 1: (35) if r0 >= 0xf72e goto pc+0 2: R0_w=invP0 R1=ctx(id=0,off=0,imm=0) R10=fp0 2: (35) if r0 >= 0x80fe0000 goto pc+0 3: R0_w=invP0 R1=ctx(id=0,off=0,imm=0) R10=fp0 3: (14) w0 -= -536870912 4: R0_w=invP536870912 R1=ctx(id=0,off=0,imm=0) R10=fp0 4: (0f) r1 += r0 5: R0_w=invP536870912 R1_w=invP(id=0) R10=fp0 5: (55) if r1 != 0x104c1500 goto pc+0 R0_w=invP536870912 R1_w=invP273421568 R10=fp0 6: R0_w=invP536870912 R1_w=invP273421568 R10=fp0 6: (b7) r0 = 0 7: R0=invP0 R1=invP273421568 R10=fp0 7: (76) if w1 s>= 0xffffff00 goto pc+3 11: R0=invP0 R1=invP273421568 R10=fp0 11: (95) exit 6: R0_w=invP536870912 R1_w=invP(id=0) R10=fp0 6: (b7) r0 = 0 7: R0_w=invP0 R1_w=invP(id=0) R10=fp0 7: (76) if w1 s>= 0xffffff00 goto pc+3 R0_w=invP0 R1_w=invP(id=0) R10=fp0 8: R0_w=invP0 R1_w=invP(id=0) R10=fp0 8: (a5) if r0 < 0x2007002a goto pc+0 9: R0_w=invP0 R1_w=invP(id=0) R10=fp0 9: (57) r0 &= -16316416 10: R0_w=invP0 R1_w=invP(id=0) R10=fp0 10: (a6) if w0 < 0x1201 goto pc+0 11: R0_w=invP0 R1_w=invP(id=0) R10=fp0 11: (95) exit 11: R0=invP0 R1=invP(id=0) R10=fp0 11: (95) exit processed 16 insns [...] Fixes: 6754172c208d ("bpf: fix precision tracking in presence of bpf2bpf calls") Reported-by: Anatoly Trosinenko Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191222223740.25297-1-daniel@iogearbox.net commit 46cf053efec6a3a5f343fead837777efe8252a46 Author: Linus Torvalds Date: Sun Dec 22 17:02:23 2019 -0800 Linux 5.5-rc3 commit 9efa3ed504edb1c1fc88dba96fd32168f50ab77c Merge: c60174717544 1edc8eb2e931 Author: Linus Torvalds Date: Sun Dec 22 17:00:04 2019 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "Eric's s_inodes softlockup fixes + Jan's fix for recent regression from pipe rework" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs: call fsnotify_sb_delete after evict_inodes fs: avoid softlockups in s_inodes iterators pipe: Fix bogus dereference in iov_iter_alignment() commit c60174717544aa8959683d7e19d568309c3a0c65 Merge: a396560706d4 5084bf6b2006 Author: Linus Torvalds Date: Sun Dec 22 10:59:06 2019 -0800 Merge tag 'xfs-5.5-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "Fix a few bugs that could lead to corrupt files, fsck complaints, and filesystem crashes: - Minor documentation fixes - Fix a file corruption due to read racing with an insert range operation. - Fix log reservation overflows when allocating large rt extents - Fix a buffer log item flags check - Don't allow administrators to mount with sunit= options that will cause later xfs_repair complaints about the root directory being suspicious because the fs geometry appeared inconsistent - Fix a non-static helper that should have been static" * tag 'xfs-5.5-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: Make the symbol 'xfs_rtalloc_log_count' static xfs: don't commit sunit/swidth updates to disk if that would cause repair failures xfs: split the sunit parameter update into two parts xfs: refactor agfl length computation function libxfs: resync with the userspace libxfs xfs: use bitops interface for buf log item AIL flag check xfs: fix log reservation overflows when allocating large rt extents xfs: stabilize insert range start boundary to avoid COW writeback race xfs: fix Sphinx documentation warning commit a396560706d457058b9f54f184b6f5973c82032c Merge: 44579f35c2d9 23f6b0240534 Author: Linus Torvalds Date: Sun Dec 22 10:41:48 2019 -0800 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 bug fixes from Ted Ts'o: "Ext4 bug fixes, including a regression fix" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: clarify impact of 'commit' mount option ext4: fix unused-but-set-variable warning in ext4_add_entry() jbd2: fix kernel-doc notation warning ext4: use RCU API in debug_print_tree ext4: validate the debug_want_extra_isize mount option at parse time ext4: reserve revoke credits in __ext4_new_inode ext4: unlock on error in ext4_expand_extra_isize() ext4: optimize __ext4_check_dir_entry() ext4: check for directory entries too close to block end ext4: fix ext4_empty_dir() for directories with holes commit 44579f35c2d90dfac5ea27308261318c7750e9b5 Merge: a313c8e056f8 df034c93f15e Author: Linus Torvalds Date: Sun Dec 22 10:36:55 2019 -0800 Merge tag 'block-5.5-20191221' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Let's try this one again, this time without the compat_ioctl changes. We've got those fixed up, but that can go out next week. This contains: - block queue flush lockdep annotation (Bart) - Type fix for bsg_queue_rq() (Bart) - Three dasd fixes (Stefan, Jan) - nbd deadlock fix (Mike) - Error handling bio user map fix (Yang) - iocost fix (Tejun) - sbitmap waitqueue addition fix that affects the kyber IO scheduler (David)" * tag 'block-5.5-20191221' of git://git.kernel.dk/linux-block: sbitmap: only queue kyber's wait callback if not already active block: fix memleak when __blk_rq_map_user_iov() is failed s390/dasd: fix typo in copyright statement s390/dasd: fix memleak in path handling error case s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly block: Fix a lockdep complaint triggered by request queue flushing block: Fix the type of 'sts' in bsg_queue_rq() block: end bio with BLK_STS_AGAIN in case of non-mq devs and REQ_NOWAIT nbd: fix shutdown and recv work deadlock v2 iocost: over-budget forced IOs should schedule async delay commit a313c8e056f86d13ae95a4aef30715918efff20f Merge: 7214618c60e9 d68321dec1b2 Author: Linus Torvalds Date: Sun Dec 22 10:26:59 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "PPC: - Fix a bug where we try to do an ultracall on a system without an ultravisor KVM: - Fix uninitialised sysreg accessor - Fix handling of demand-paged device mappings - Stop spamming the console on IMPDEF sysregs - Relax mappings of writable memslots - Assorted cleanups MIPS: - Now orphan, James Hogan is stepping down x86: - MAINTAINERS change, so long Radim and thanks for all the fish - supported CPUID fixes for AMD machines without SPEC_CTRL" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: MAINTAINERS: remove Radim from KVM maintainers MAINTAINERS: Orphan KVM for MIPS kvm: x86: Host feature SSBD doesn't imply guest feature AMD_SSBD kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD KVM: PPC: Book3S HV: Don't do ultravisor calls on systems without ultravisor KVM: arm/arm64: Properly handle faulting of device mappings KVM: arm64: Ensure 'params' is initialised when looking up sys register KVM: arm/arm64: Remove excessive permission check in kvm_arch_prepare_memory_region KVM: arm64: Don't log IMP DEF sysreg traps KVM: arm64: Sanely ratelimit sysreg messages KVM: arm/arm64: vgic: Use wrapper function to lock/unlock all vcpus in kvm_vgic_create() KVM: arm/arm64: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy() KVM: arm/arm64: Get rid of unused arg in cpu_init_hyp_mode() commit 7214618c60e947b8cea12b47d8279bd4220f21bc Merge: 78bac77b521b 9209fb51896f Author: Linus Torvalds Date: Sun Dec 22 10:22:47 2019 -0800 Merge tag 'riscv/for-v5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "Several fixes, and one cleanup, for RISC-V. Fixes: - Fix an error in a Kconfig file that resulted in an undefined Kconfig option "CONFIG_CONFIG_MMU" - Fix undefined Kconfig option "CONFIG_CONFIG_MMU" - Fix scratch register clearing in M-mode (affects nommu users) - Fix a mismerge on my part that broke the build for CONFIG_SPARSEMEM_VMEMMAP users Cleanup: - Move SiFive L2 cache-related code to drivers/soc, per request" * tag 'riscv/for-v5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: move sifive_l2_cache.c to drivers/soc riscv: define vmemmap before pfn_to_page calls riscv: fix scratch register clearing in M-mode. riscv: Fix use of undefined config option CONFIG_CONFIG_MMU commit 78bac77b521b032f96077c21241cc5d5668482c5 Merge: 0dd1e3773ae8 4bfeadfc0712 Author: Linus Torvalds Date: Sun Dec 22 09:54:33 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Several nf_flow_table_offload fixes from Pablo Neira Ayuso, including adding a missing ipv6 match description. 2) Several heap overflow fixes in mwifiex from qize wang and Ganapathi Bhat. 3) Fix uninit value in bond_neigh_init(), from Eric Dumazet. 4) Fix non-ACPI probing of nxp-nci, from Stephan Gerhold. 5) Fix use after free in tipc_disc_rcv(), from Tuong Lien. 6) Enforce limit of 33 tail calls in mips and riscv JIT, from Paul Chaignon. 7) Multicast MAC limit test is off by one in qede, from Manish Chopra. 8) Fix established socket lookup race when socket goes from TCP_ESTABLISHED to TCP_LISTEN, because there lacks an intervening RCU grace period. From Eric Dumazet. 9) Don't send empty SKBs from tcp_write_xmit(), also from Eric Dumazet. 10) Fix active backup transition after link failure in bonding, from Mahesh Bandewar. 11) Avoid zero sized hash table in gtp driver, from Taehee Yoo. 12) Fix wrong interface passed to ->mac_link_up(), from Russell King. 13) Fix DSA egress flooding settings in b53, from Florian Fainelli. 14) Memory leak in gmac_setup_txqs(), from Navid Emamdoost. 15) Fix double free in dpaa2-ptp code, from Ioana Ciornei. 16) Reject invalid MTU values in stmmac, from Jose Abreu. 17) Fix refcount leak in error path of u32 classifier, from Davide Caratti. 18) Fix regression causing iwlwifi firmware crashes on boot, from Anders Kaseorg. 19) Fix inverted return value logic in llc2 code, from Chan Shu Tak. 20) Disable hardware GRO when XDP is attached to qede, frm Manish Chopra. 21) Since we encode state in the low pointer bits, dst metrics must be at least 4 byte aligned, which is not necessarily true on m68k. Add annotations to fix this, from Geert Uytterhoeven. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (160 commits) sfc: Include XDP packet headroom in buffer step size. sfc: fix channel allocation with brute force net: dst: Force 4-byte alignment of dst_metrics selftests: pmtu: fix init mtu value in description hv_netvsc: Fix unwanted rx_table reset net: phy: ensure that phy IDs are correctly typed mod_devicetable: fix PHY module format qede: Disable hardware gro when xdp prog is installed net: ena: fix issues in setting interrupt moderation params in ethtool net: ena: fix default tx interrupt moderation interval net/smc: unregister ib devices in reboot_event net: stmmac: platform: Fix MDIO init for platforms without PHY llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) net: hisilicon: Fix a BUG trigered by wrong bytes_compl net: dsa: ksz: use common define for tag len s390/qeth: don't return -ENOTSUPP to userspace s390/qeth: fix promiscuous mode after reset s390/qeth: handle error due to unsupported transport mode cxgb4: fix refcount init for TC-MQPRIO offload tc-testing: initial tdc selftests for cls_u32 ... commit 0dd1e3773ae8afc4bfdce782bdeffc10f9cae6ec Author: Jan Stancek Date: Sun Dec 22 13:33:24 2019 +0100 pipe: fix empty pipe check in pipe_write() LTP pipeio_1 test is hanging with v5.5-rc2-385-gb8e382a185eb, with read side observing empty pipe and sleeping and write side running out of space and then sleeping as well. In this scenario there are 5 writers and 1 reader. Problem is that after pipe_write() reacquires pipe lock, it re-checks for empty pipe with potentially stale 'head' and doesn't wake up read side anymore. pipe->tail can advance beyond 'head', because there are multiple writers. Use pipe->head for empty pipe check after reacquiring lock to observe current state. Testing: With patch, LTP pipeio_1 ran successfully in loop for 1 hour. Without patch it hanged within a minute. Fixes: 1b6b26ae7053 ("pipe: fix and clarify pipe write wakeup logic") Reported-by: Rachel Sibley Signed-off-by: Jan Stancek Signed-off-by: Linus Torvalds commit d68321dec1b2234fb32f423e32c3af5915eae36c Merge: 19a049f1a44d d89c69f42bf0 Author: Paolo Bonzini Date: Sun Dec 22 13:18:15 2019 +0100 Merge tag 'kvm-ppc-fixes-5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into kvm-master PPC KVM fix for 5.5 - Fix a bug where we try to do an ultracall on a system without an ultravisor. commit 19a049f1a44d18e38a311e723c19c33c81020a30 Author: Paolo Bonzini Date: Wed Dec 4 15:33:35 2019 +0100 MAINTAINERS: remove Radim from KVM maintainers Radim's kernel.org email is bouncing, which I take as a signal that he is not really able to deal with KVM at this time. Make MAINTAINERS match the effective value of KVM's bus factor. Signed-off-by: Paolo Bonzini commit 088e11d4220b4802e23fa00fe610ea89a5094587 Author: James Hogan Date: Sat Dec 21 15:50:13 2019 +0000 MAINTAINERS: Orphan KVM for MIPS I haven't been active for 18 months, and don't have the hardware set up to test KVM for MIPS, so mark it as orphaned and remove myself as maintainer. Hopefully somebody from MIPS can pick this up. Signed-off-by: James Hogan Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Paul Burton Cc: Ralf Baechle Cc: kvm@vger.kernel.org Cc: linux-mips@vger.kernel.org Signed-off-by: Paolo Bonzini commit 23f6b02405343103791c6a9533d73716cdf0c672 Author: Jan Kara Date: Wed Dec 18 12:12:10 2019 +0100 ext4: clarify impact of 'commit' mount option The description of 'commit' mount option dates back to ext3 times. Update the description to match current meaning for ext4. Reported-by: Paul Richards Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20191218111210.14161-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit 68d7b2d838f1aff4d46a793a2fae33e8ad19223e Author: Yunfeng Ye Date: Tue Dec 17 22:46:49 2019 +0800 ext4: fix unused-but-set-variable warning in ext4_add_entry() Warning is found when compile with "-Wunused-but-set-variable": fs/ext4/namei.c: In function ‘ext4_add_entry’: fs/ext4/namei.c:2167:23: warning: variable ‘sbi’ set but not used [-Wunused-but-set-variable] struct ext4_sb_info *sbi; ^~~ Fix this by moving the variable @sbi under CONFIG_UNICODE. Signed-off-by: Yunfeng Ye Reviewed-by: Ritesh Harjani Link: https://lore.kernel.org/r/cb5eb904-224a-9701-c38f-cb23514b1fff@huawei.com Signed-off-by: Theodore Ts'o commit b8e382a185ebb1bca66bd541e5a0f858b6b9cbb9 Merge: 4746104a6f59 fe6e096a5bbf Author: Linus Torvalds Date: Sat Dec 21 15:16:56 2019 -0800 Merge tag 'trace-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: - Fix memory leak on error path of process_system_preds() - Lock inversion fix with updating tgid recording option - Fix histogram compare function on big endian machines - Fix histogram trigger function on big endian machines - Make trace_printk() irq sync on init for kprobe selftest correctness * tag 'trace-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix endianness bug in histogram trigger samples/trace_printk: Wait for IRQ work to finish tracing: Fix lock inversion in trace_event_enable_tgid_record() tracing: Have the histogram compare functions convert to u64 first tracing: Avoid memory leak in process_system_preds() commit 4746104a6f599f213c3d97d8c39032953fd4580f Merge: 60b04df6bfbf c14685547762 Author: Linus Torvalds Date: Sat Dec 21 15:12:26 2019 -0800 Merge tag 'libnvdimm-fix-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fix from Dan Williams: "A minor regression fix. The libnvdimm unit tests were expecting to mock calls to ioremap_nocache() which disappeared in v5.5-rc1. This fix has appeared in -next and collided with some cleanups that Christoph has planned for v5.6, but he will fix up his branch once this goes in. Summary: - Restore the operation of the libnvdimm unit tests after the removal of ioremap_nocache()" * tag 'libnvdimm-fix-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: tools/testing/nvdimm: Fix mock support for ioremap commit fe6e096a5bbf73a142f09c72e7aa2835026eb1a3 Author: Sven Schnelle Date: Wed Dec 18 08:44:27 2019 +0100 tracing: Fix endianness bug in histogram trigger At least on PA-RISC and s390 synthetic histogram triggers are failing selftests because trace_event_raw_event_synth() always writes a 64 bit values, but the reader expects a field->size sized value. On little endian machines this doesn't hurt, but on big endian this makes the reader always read zero values. Link: http://lore.kernel.org/linux-trace-devel/20191218074427.96184-4-svens@linux.ibm.com Cc: stable@vger.kernel.org Fixes: 4b147936fa509 ("tracing: Add support for 'synthetic' events") Acked-by: Tom Zanussi Signed-off-by: Sven Schnelle Signed-off-by: Steven Rostedt (VMware) commit 01f36a554e3ef32f9fc4b81a4437cf08fd0e4742 Author: Sven Schnelle Date: Wed Dec 18 08:44:26 2019 +0100 samples/trace_printk: Wait for IRQ work to finish trace_printk schedules work via irq_work_queue(), but doesn't wait until it was processed. The kprobe_module.tc testcase does: :;: "Load module again, which means the event1 should be recorded";: modprobe trace-printk grep "event1:" trace so the grep which checks the trace file might run before the irq work was processed. Fix this by adding a irq_work_sync(). Link: http://lore.kernel.org/linux-trace-devel/20191218074427.96184-3-svens@linux.ibm.com Cc: stable@vger.kernel.org Fixes: af2a0750f3749 ("selftests/ftrace: Improve kprobe on module testcase to load/unload module") Signed-off-by: Sven Schnelle Signed-off-by: Steven Rostedt (VMware) commit 3a53acf1d9bea11b57c1f6205e3fe73f9d8a3688 Author: Prateek Sood Date: Tue Dec 10 09:15:16 2019 +0000 tracing: Fix lock inversion in trace_event_enable_tgid_record() Task T2 Task T3 trace_options_core_write() subsystem_open() mutex_lock(trace_types_lock) mutex_lock(event_mutex) set_tracer_flag() trace_event_enable_tgid_record() mutex_lock(trace_types_lock) mutex_lock(event_mutex) This gives a circular dependency deadlock between trace_types_lock and event_mutex. To fix this invert the usage of trace_types_lock and event_mutex in trace_options_core_write(). This keeps the sequence of lock usage consistent. Link: http://lkml.kernel.org/r/0101016eef175e38-8ca71caf-a4eb-480d-a1e6-6f0bbc015495-000000@us-west-2.amazonses.com Cc: stable@vger.kernel.org Fixes: d914ba37d7145 ("tracing: Add support for recording tgid of tasks") Signed-off-by: Prateek Sood Signed-off-by: Steven Rostedt (VMware) commit 60b04df6bfbf7e65954c44f7945b381e0fee5b6a Merge: fd7a6d2b8f1d b4adfe55915d Author: Linus Torvalds Date: Sat Dec 21 12:17:14 2019 -0800 Merge tag 's390-5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix unwinding from irq context of interrupted user process. - Add purgatory build missing symbols check. That helped to uncover and fix missing symbols when built with kasan support enabled. - Couple of ftrace fixes. Avoid broken stack trace and fix recursion loop in function_graph tracer. * tag 's390-5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/ftrace: save traced function caller s390/unwind: stop gracefully at user mode pt_regs in irq stack s390/purgatory: do not build purgatory with kcov, kasan and friends s390/purgatory: Make sure we fail the build if purgatory has missing symbols s390/ftrace: fix endless recursion in function_graph tracer commit fd7a6d2b8f1d67df76d0e863f003162b931074a1 Merge: c4ff10efe8e4 6cf82d559e1a Author: Linus Torvalds Date: Sat Dec 21 10:52:10 2019 -0800 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "Misc fixes: a (rare) PSI crash fix, a CPU affinity related balancing fix, and a toning down of active migration attempts" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/cfs: fix spurious active migration sched/fair: Fix find_idlest_group() to handle CPU affinity psi: Fix a division error in psi poll() sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime commit c4ff10efe8e487cd35f4475ed2dd1e5e0c6f784a Merge: 6c1c79a5f4ee 9f0bff1180ef Author: Linus Torvalds Date: Sat Dec 21 10:51:00 2019 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Misc fixes: a BTS fix, a PT NMI handling fix, a PMU sysfs fix and an SRCU annotation" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Add SRCU annotation for pmus list walk perf/x86/intel: Fix PT PMI handling perf/x86/intel/bts: Fix the use of page_private() perf/x86: Fix potential out-of-bounds access commit 6c1c79a5f4eead27465d4d1d97ce230163772a78 Merge: 6210469417fd 28f94a44298c Author: Linus Torvalds Date: Sat Dec 21 10:49:47 2019 -0800 Merge tag 'kbuild-fixes-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - fix warning in out-of-tree 'make clean' - add READELF variable to the top Makefile - fix broken builds when LINUX_COMPILE_BY contains a backslash - fix build warning in kallsyms - fix NULL pointer access in expr_eq() in Kconfig - fix missing dependency on rsync in deb-pkg build - remove ---help--- from documentation - fix misleading documentation about directory descending * tag 'kbuild-fixes-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: clarify the difference between obj-y and obj-m w.r.t. descending kconfig: remove ---help--- from documentation scripts: package: mkdebian: add missing rsync dependency kconfig: don't crash on NULL expressions in expr_eq() scripts/kallsyms: fix offset overflow of kallsyms_relative_base mkcompile_h: use printf for LINUX_COMPILE_BY mkcompile_h: git rid of UTS_TRUNCATE from LINUX_COMPILE_{BY,HOST} x86/boot: kbuild: allow readelf executable to be specified kbuild: fix 'No such file or directory' warning when cleaning commit 43cf75d96409a20ef06b756877a2e72b10a026fc Author: chenqiwu Date: Thu Dec 19 14:29:53 2019 +0800 exit: panic before exit_mm() on global init exit Currently, when global init and all threads in its thread-group have exited we panic via: do_exit() -> exit_notify() -> forget_original_parent() -> find_child_reaper() This makes it hard to extract a useable coredump for global init from a kernel crashdump because by the time we panic exit_mm() will have already released global init's mm. This patch moves the panic futher up before exit_mm() is called. As was the case previously, we only panic when global init and all its threads in the thread-group have exited. Signed-off-by: chenqiwu Acked-by: Christian Brauner Acked-by: Oleg Nesterov [christian.brauner@ubuntu.com: fix typo, rewrite commit message] Link: https://lore.kernel.org/r/1576736993-10121-1-git-send-email-qiwuchen55@gmail.com Signed-off-by: Christian Brauner commit 28f94a44298c99c0db85539874b62f21d94fcaa7 Author: Masahiro Yamada Date: Thu Dec 19 20:51:00 2019 +0900 kbuild: clarify the difference between obj-y and obj-m w.r.t. descending Kbuild descends into a directory by either 'y' or 'm', but there is an important difference. Kbuild combines the built-in objects into built-in.a in each directory. The built-in.a in the directory visited by obj-y is merged into the built-in.a in the parent directory. This merge happens recursively when Kbuild is ascending back towards the top directory, then built-in objects are linked into vmlinux eventually. This works properly only when the Makefile specifying obj-y is reachable by the chain of obj-y. On the other hand, Kbuild does not take built-in.a from the directory visited by obj-m. This it, all the objects in that directory are supposed to be modular. If Kbuild descends into a directory by obj-m, but the Makefile in the sub-directory specifies obj-y, those objects are just left orphan. The current statement "Kbuild only uses this information to decide that it needs to visit the directory" is misleading. Clarify the difference. Reported-by: Johan Hovold Signed-off-by: Masahiro Yamada Reviewed-by: Johan Hovold commit 6210469417fd967ec72dea56723593beefeecafb Merge: 62af608b4b07 75cf9797006a Author: Linus Torvalds Date: Sat Dec 21 06:49:41 2019 -0800 Merge branch 'parisc-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pul parisc fixes from Helge Deller: "Two build error fixes, one for the soft_offline_page() parameter change and one for a specific KEXEC/KEXEC_FILE configuration, as well as a compiler and a linker warning fix" * 'parisc-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix compiler warnings in debug_core.c parisc: soft_offline_page() now takes the pfn parisc: add missing __init annotation parisc: fix compilation when KEXEC=n and KEXEC_FILE=y commit b2c0fcd28772f99236d261509bcd242135677965 Author: Arnd Bergmann Date: Fri Nov 29 11:28:22 2019 +0100 compat_ioctl: block: handle Persistent Reservations These were added to blkdev_ioctl() in linux-5.5 but not blkdev_compat_ioctl, so add them now. Cc: # v4.4+ Fixes: bbd3e064362e ("block: add an API for Persistent Reservations") Signed-off-by: Arnd Bergmann Fold in followup patch from Arnd with missing pr.h header include. Signed-off-by: Jens Axboe commit 4b43f31d65dac587dae09ee27a48fd68a0cfd8c2 Author: Arnd Bergmann Date: Fri Nov 29 11:28:22 2019 +0100 compat_ioctl: block: handle add zone open, close and finish ioctl These were added to blkdev_ioctl() in linux-5.5 but not blkdev_compat_ioctl, so add them now. Fixes: e876df1fe0ad ("block: add zone open, close and finish ioctl support") Reviewed-by: Damien Le Moal Signed-off-by: Arnd Bergmann Signed-off-by: Jens Axboe commit 21d37340912d74b1222d43c11aa9dd0687162573 Author: Arnd Bergmann Date: Fri Nov 29 11:28:22 2019 +0100 compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES These were added to blkdev_ioctl() in v4.20 but not blkdev_compat_ioctl, so add them now. Cc: # v4.20+ Fixes: 72cd87576d1d ("block: Introduce BLKGETZONESZ ioctl") Fixes: 65e4e3eee83d ("block: Introduce BLKGETNRZONES ioctl") Reviewed-by: Damien Le Moal Signed-off-by: Arnd Bergmann Signed-off-by: Jens Axboe commit 673bdf8ce0a387ef585c13b69a2676096c6edfe9 Author: Arnd Bergmann Date: Fri Nov 29 11:28:22 2019 +0100 compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE These were added to blkdev_ioctl() but not blkdev_compat_ioctl, so add them now. Cc: # v4.10+ Fixes: 3ed05a987e0f ("blk-zoned: implement ioctls") Reviewed-by: Damien Le Moal Signed-off-by: Arnd Bergmann Signed-off-by: Jens Axboe commit 257bf4176362c3920250d6b972ccb36edd788487 Author: Arnd Bergmann Date: Mon Dec 9 16:37:24 2019 +0100 pktcdvd: fix regression on 64-bit architectures The support for the compat ioctl did not actually do what it was supposed to do because of a typo, instead it broke native support for CDROM_LAST_WRITTEN and CDROM_SEND_PACKET on all architectures with CONFIG_COMPAT enabled. Fixes: 1b114b0817cc ("pktcdvd: add compat_ioctl handler") Signed-off-by: Arnd Bergmann ---- Please apply for v5.5, I just noticed the regression while rebasing some of the patches I created on top. Signed-off-by: Jens Axboe commit 62af608b4b075871f7214c345c42a2e7a456f35d Merge: 6d04182dd36d d6bd6cf9feb8 Author: Linus Torvalds Date: Sat Dec 21 06:24:56 2019 -0800 Merge tag 'for-linus-5.5b-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "This contains two cleanup patches and a small series for supporting reloading the Xen block backend driver" * tag 'for-linus-5.5b-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/grant-table: remove multiple BUG_ON on gnttab_interface xen-blkback: support dynamic unbind/bind xen/interface: re-define FRONT/BACK_RING_ATTACH() xenbus: limit when state is forced to closed xenbus: move xenbus_dev_shutdown() into frontend code... xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk commit 6d04182dd36dc5a4dd2e352c1d0f0241e83bd2a0 Merge: 5c741e2583d2 228b607d8ea1 Author: Linus Torvalds Date: Sat Dec 21 06:17:05 2019 -0800 Merge tag 'powerpc-5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Two weeks worth of accumulated fixes: - A fix for a performance regression seen on PowerVM LPARs using dedicated CPUs, caused by our vcpu_is_preempted() returning true even for idle CPUs. - One of the ultravisor support patches broke KVM on big endian hosts in v5.4. - Our KUAP (Kernel User Access Prevention) code missed allowing access in __clear_user(), which could lead to an oops or erroneous SEGV when triggered via PTRACE_GETREGSET. - Two fixes for the ocxl driver, an open/remove race, and a memory leak in an error path. - A handful of other small fixes. Thanks to: Andrew Donnellan, Christian Zigotzky, Christophe Leroy, Christoph Hellwig, Daniel Axtens, David Hildenbrand, Frederic Barrat, Gautham R. Shenoy, Greg Kurz, Ihor Pasichnyk, Juri Lelli, Marcus Comstedt, Mike Rapoport, Parth Shah, Srikar Dronamraju, Vaidyanathan Srinivasan" * tag 'powerpc-5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: KVM: PPC: Book3S HV: Fix regression on big endian hosts powerpc: Fix __clear_user() with KUAP enabled powerpc/pseries/cmm: fix managed page counts when migrating pages between zones powerpc/8xx: fix bogus __init on mmu_mapin_ram_chunk() ocxl: Fix potential memory leak on context creation powerpc/irq: fix stack overflow verification powerpc: Ensure that swiotlb buffer is allocated from low memory powerpc/shared: Use static key to detect shared processor powerpc/vcpu: Assume dedicated processors as non-preempt ocxl: Fix concurrent AFU open and device removal commit 5c741e2583d2e5a3fc148a5e8a2464bbaa45a1d9 Merge: 12ac9a08fc4c a3a57ddad061 Author: Linus Torvalds Date: Sat Dec 21 06:04:12 2019 -0800 Merge branch 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 RAS fixes from Borislav Petkov: "Three urgent RAS fixes for the AMD side of things: - initialize struct mce.bank so that calculated error severity on AMD SMCA machines is correct - do not send IPIs early during bank initialization, when interrupts are disabled - a fix for when only a subset of MCA banks are enabled, which led to boot hangs on some new AMD CPUs" * 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Fix possibly incorrect severity calculation on AMD x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() commit 12ac9a08fc4cb240a28e6690dec016abd298e52f Merge: f1fd1610cbb6 781d8cea68ac Author: Linus Torvalds Date: Sat Dec 21 05:55:35 2019 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "One core framework fix to walk the orphan list and match up clks to parents when clk providers register the DT provider after registering all their clks (as they should). Then a handful of driver fixes for the qcom, imx, and at91 drivers. The driver fixes are relatively small fixes for incorrect register settings or missing locks causing race conditions" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: qcom: Avoid SMMU/cx gdsc corner cases clk: qcom: gcc-sc7180: Fix setting flag for votable GDSCs clk: Move clk_core_reparent_orphans() under CONFIG_OF clk: at91: fix possible deadlock clk: walk orphan list on clock provider registration clk: imx: pll14xx: fix clk_pll14xx_wait_lock clk: imx: clk-imx7ulp: Add missing sentinel of ulp_div_table clk: imx: clk-composite-8m: add lock to gate/mux commit 8cc0991c09bfd11fd878b0321a7a06724520d879 Author: Alex Deucher Date: Fri Dec 20 19:17:02 2019 -0500 ALSA: hda/hdmi - fix atpx_present when CLASS is not VGA You can't use PCI_BASE_CLASS with pci_get_class(). This happens to work by luck on devices with PCI_CLASS_DISPLAY_VGA, but misses PCI_CLASS_DISPLAY_OTHER. Add a check for those as well. Fixes: 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD") Signed-off-by: Alex Deucher Link: https://lore.kernel.org/r/20191221001702.1338587-1-alexander.deucher@amd.com Signed-off-by: Takashi Iwai commit 4bfeadfc0712bbc8a6556eef6d47cbae1099dea3 Merge: 258a980d1ec2 11a14dc8d7a7 Author: David S. Miller Date: Fri Dec 20 21:56:48 2019 -0800 Merge branch 'sfc-fix-bugs-introduced-by-XDP-patches' Edward Cree says: ==================== sfc: fix bugs introduced by XDP patches Two fixes for bugs introduced by the XDP support in the sfc driver. ==================== Signed-off-by: David S. Miller commit 11a14dc8d7a76d3117896b975c536f1372f2a7c4 Author: Charles McLachlan Date: Fri Dec 20 16:27:10 2019 +0000 sfc: Include XDP packet headroom in buffer step size. Correct a mismatch between rx_page_buf_step and the actual step size used when filling buffer pages. This patch fixes the page overrun that occured when the MTU was set to anything bigger than 1692. Fixes: 3990a8fffbda ("sfc: allocate channels for XDP tx queues") Signed-off-by: Charles McLachlan Signed-off-by: Edward Cree Signed-off-by: David S. Miller commit 8700aff089843399f95bc7701ae87b642b35a716 Author: Edward Cree Date: Fri Dec 20 16:26:40 2019 +0000 sfc: fix channel allocation with brute force It was possible for channel allocation logic to get confused between what it had and what it wanted, and end up trying to use the same channel for both PTP and regular TX. This led to a kernel panic: BUG: unable to handle page fault for address: 0000000000047635 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 5.4.0-rc3-ehc14+ #900 Hardware name: Dell Inc. PowerEdge R710/0M233H, BIOS 6.4.0 07/23/2013 RIP: 0010:native_queued_spin_lock_slowpath+0x188/0x1e0 Code: f3 90 48 8b 32 48 85 f6 74 f6 eb e8 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 c0 98 02 00 48 03 04 f5 a0 c6 ed 81 <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP: 0018:ffffc90000003d28 EFLAGS: 00010006 RAX: 0000000000047635 RBX: 0000000000000246 RCX: 0000000000040000 RDX: ffff888627a298c0 RSI: 0000000000003ffe RDI: ffff88861f6b8dd4 RBP: ffff8886225c6e00 R08: 0000000000040000 R09: 0000000000000000 R10: 0000000616f080c6 R11: 00000000000000c0 R12: ffff88861f6b8dd4 R13: ffffc90000003dc8 R14: ffff88861942bf00 R15: ffff8886150f2000 FS: 0000000000000000(0000) GS:ffff888627a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000047635 CR3: 000000000200a000 CR4: 00000000000006f0 Call Trace: _raw_spin_lock_irqsave+0x22/0x30 skb_queue_tail+0x1b/0x50 sock_queue_err_skb+0x9d/0xf0 __skb_complete_tx_timestamp+0x9d/0xc0 efx_dequeue_buffer+0x126/0x180 [sfc] efx_xmit_done+0x73/0x1c0 [sfc] efx_ef10_ev_process+0x56a/0xfe0 [sfc] ? tick_sched_do_timer+0x60/0x60 ? timerqueue_add+0x5d/0x70 ? enqueue_hrtimer+0x39/0x90 efx_poll+0x111/0x380 [sfc] ? rcu_accelerate_cbs+0x50/0x160 net_rx_action+0x14a/0x400 __do_softirq+0xdd/0x2d0 irq_exit+0xa0/0xb0 do_IRQ+0x53/0xe0 common_interrupt+0xf/0xf In the long run we intend to rewrite the channel allocation code, but for 'net' fix this by allocating extra_channels, and giving them TX queues, even if we do not in fact need them (e.g. on NICs without MAC TX timestamping), and thereby using simpler logic to assign the channels once they're allocated. Fixes: 3990a8fffbda ("sfc: allocate channels for XDP tx queues") Signed-off-by: Edward Cree Signed-off-by: David S. Miller commit 258a980d1ec23e2c786e9536a7dd260bea74bae6 Author: Geert Uytterhoeven Date: Fri Dec 20 14:31:40 2019 +0100 net: dst: Force 4-byte alignment of dst_metrics When storing a pointer to a dst_metrics structure in dst_entry._metrics, two flags are added in the least significant bits of the pointer value. Hence this assumes all pointers to dst_metrics structures have at least 4-byte alignment. However, on m68k, the minimum alignment of 32-bit values is 2 bytes, not 4 bytes. Hence in some kernel builds, dst_default_metrics may be only 2-byte aligned, leading to obscure boot warnings like: WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x44/0x9a refcount_t: underflow; use-after-free. Modules linked in: CPU: 0 PID: 7 Comm: ksoftirqd/0 Tainted: G W 5.5.0-rc2-atari-01448-g114a1a1038af891d-dirty #261 Stack from 10835e6c: 10835e6c 0038134f 00023fa6 00394b0f 0000001c 00000009 00321560 00023fea 00394b0f 0000001c 001a70f8 00000009 00000000 10835eb4 00000001 00000000 04208040 0000000a 00394b4a 10835ed4 00043aa8 001a70f8 00394b0f 0000001c 00000009 00394b4a 0026aba8 003215a4 00000003 00000000 0026d5a8 00000001 003215a4 003a4361 003238d6 000001f0 00000000 003215a4 10aa3b00 00025e84 003ddb00 10834000 002416a8 10aa3b00 00000000 00000080 000aa038 0004854a Call Trace: [<00023fa6>] __warn+0xb2/0xb4 [<00023fea>] warn_slowpath_fmt+0x42/0x64 [<001a70f8>] refcount_warn_saturate+0x44/0x9a [<00043aa8>] printk+0x0/0x18 [<001a70f8>] refcount_warn_saturate+0x44/0x9a [<0026aba8>] refcount_sub_and_test.constprop.73+0x38/0x3e [<0026d5a8>] ipv4_dst_destroy+0x5e/0x7e [<00025e84>] __local_bh_enable_ip+0x0/0x8e [<002416a8>] dst_destroy+0x40/0xae Fix this by forcing 4-byte alignment of all dst_metrics structures. Fixes: e5fd387ad5b30ca3 ("ipv6: do not overwrite inetpeer metrics prematurely") Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit 152044775d0b9a9ed9509caed40efcba2677951d Author: Hangbin Liu Date: Fri Dec 20 15:08:06 2019 +0800 selftests: pmtu: fix init mtu value in description There is no a_r3, a_r4 in the testing topology. It should be b_r1, b_r2. Also b_r1 mtu is 1400 and b_r2 mtu is 1500. Fixes: e44e428f59e4 ("selftests: pmtu: add basic IPv4 and IPv6 PMTU tests") Signed-off-by: Hangbin Liu Acked-by: Stefano Brivio Signed-off-by: David S. Miller commit b0689faa8efc5a3391402d7ae93bd373b7248e51 Author: Haiyang Zhang Date: Thu Dec 19 18:28:10 2019 -0800 hv_netvsc: Fix unwanted rx_table reset In existing code, the receive indirection table, rx_table, is in struct rndis_device, which will be reset when changing MTU, ringparam, etc. User configured receive indirection table values will be lost. To fix this, move rx_table to struct net_device_context, and check netif_is_rxfh_configured(), so rx_table will be set to default only if no user configured value. Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table") Signed-off-by: Haiyang Zhang Signed-off-by: David S. Miller commit 7d49a32a66d2215c5b3bf9bc67c9036ea9904111 Author: Russell King Date: Thu Dec 19 23:24:52 2019 +0000 net: phy: ensure that phy IDs are correctly typed PHY IDs are 32-bit unsigned quantities. Ensure that they are always treated as such, and not passed around as "int"s. Fixes: 13d0ab6750b2 ("net: phy: check return code when requesting PHY driver module") Signed-off-by: Russell King Reviewed-by: Florian Fainelli Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit d2ed49cf6c13e379c5819aa5ac20e1f9674ebc89 Author: Russell King Date: Thu Dec 19 23:24:47 2019 +0000 mod_devicetable: fix PHY module format When a PHY is probed, if the top bit is set, we end up requesting a module with the string "mdio:-10101110000000100101000101010001" - the top bit is printed to a signed -1 value. This leads to the module not being loaded. Fix the module format string and the macro generating the values for it to ensure that we only print unsigned types and the top bit is always 0/1. We correctly end up with "mdio:10101110000000100101000101010001". Fixes: 8626d3b43280 ("phylib: Support phy module autoloading") Reviewed-by: Andrew Lunn Signed-off-by: Russell King Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 4c8dc00503db24deaf0b89dddfa84b7cba7cd4ce Author: Manish Chopra Date: Thu Dec 19 10:35:16 2019 -0800 qede: Disable hardware gro when xdp prog is installed commit 18c602dee472 ("qede: Use NETIF_F_GRO_HW.") introduced a regression in driver that when xdp program is installed on qede device, device's aggregation feature (hardware GRO) is not getting disabled, which is unexpected with xdp. Fixes: 18c602dee472 ("qede: Use NETIF_F_GRO_HW.") Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Reviewed-by: Michael Chan Signed-off-by: David S. Miller commit 9f5e508b6486be664bee022a325db66b299151b4 Merge: 28a3b8408f70 41c53caa5a61 Author: David S. Miller Date: Fri Dec 20 21:43:09 2019 -0800 Merge branch 'ena-fixes-of-interrupt-moderation-bugs' Arthur Kiyanovski says: ==================== ena: fixes of interrupt moderation bugs Differences from V1: 1. Updated default tx interrupt moderation to 64us 2. Added "Fixes:" tags. 3. Removed cosmetic changes that are not relevant for these bug fixes This patchset includes a couple of fixes of bugs in the implemenation of interrupt moderation. ==================== Signed-off-by: David S. Miller commit 41c53caa5a61ebc9221b71cc37f4a90549f1121d Author: Arthur Kiyanovski Date: Thu Dec 19 17:40:56 2019 +0200 net: ena: fix issues in setting interrupt moderation params in ethtool Issue 1: -------- Reproduction steps: 1. sudo ethtool -C eth0 rx-usecs 128 2. sudo ethtool -C eth0 adaptive-rx on 3. sudo ethtool -C eth0 adaptive-rx off 4. ethtool -c eth0 expected output: rx-usecs 128 actual output: rx-usecs 0 Reason for issue: In stage 3, ethtool userspace calls first the ena_get_coalesce() handler to get the current value of all properties, and then the ena_set_coalesce() handler. When ena_get_coalesce() is called the adaptive interrupt moderation is still on. There is an if in the code that returns the rx_coalesce_usecs only if the adaptive interrupt moderation is off. And since it is still on, rx_coalesce_usecs is not set, meaning it stays 0. Solution to issue: Remove this if static interrupt moderation intervals have nothing to do with dynamic ones. Issue 2: -------- Reproduction steps: 1. sudo ethtool -C eth0 adaptive-rx on 2. sudo ethtool -C eth0 rx-usecs 128 3. ethtool -c eth0 expected output: rx-usecs 128 actual output: rx-usecs 0 Reason for issue: In stage 2, when ena_set_coalesce() is called, the handler tests if rx adaptive interrupt moderation is on, and if it is, it returns before getting to the part in the function that sets the rx non-adaptive interrupt moderation interval. Solution to issue: Remove the return from the function when rx adaptive interrupt moderation is on. Also cleaned up the fixed code in ena_set_coalesce by grouping together adaptive interrupt moderation toggling, and using && instead of nested ifs. Fixes: b3db86dc4b82 ("net: ena: reimplement set/get_coalesce()") Fixes: 0eda847953d8 ("net: ena: fix retrieval of nonadaptive interrupt moderation intervals") Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 05785adf6e570a068adf0502b61fe2b521d7f0ca Author: Arthur Kiyanovski Date: Thu Dec 19 17:40:55 2019 +0200 net: ena: fix default tx interrupt moderation interval Current default non-adaptive tx interrupt moderation interval is 196 us. This value is too high and might cause the tx queue to fill up. In this commit we set the default non-adaptive tx interrupt moderation interval to 64 us in order to: 1. Reduce the probability of the queue filling-up (when compared to the current default value of 196 us). 2. Reduce unnecessary tx interrupt overhead (which happens if we set the default tx interval to 0). We determined experimentally that 64 us is an optimal value that reduces interrupt rate by more than 20% without affecting performance. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 28a3b8408f70b646e78880a7eb0a97c22ace98d1 Author: Karsten Graul Date: Thu Dec 19 12:51:13 2019 +0100 net/smc: unregister ib devices in reboot_event In the reboot_event handler, unregister the ib devices and enable the IB layer to release the devices before the reboot. Fixes: a33a803cfe64 ("net/smc: guarantee removal of link groups in reboot") Signed-off-by: Karsten Graul Reviewed-by: Ursula Braun Signed-off-by: David S. Miller commit d3e014ec7d5ebe9644b5486bc530b91e62bbf624 Author: Padmanabhan Rajanbabu Date: Thu Dec 19 15:47:01 2019 +0530 net: stmmac: platform: Fix MDIO init for platforms without PHY The current implementation of "stmmac_dt_phy" function initializes the MDIO platform bus data, even in the absence of PHY. This fix will skip MDIO initialization if there is no PHY present. Fixes: 7437127 ("net: stmmac: Convert to phylink and remove phylib logic") Acked-by: Jayati Sahu Signed-off-by: Sriram Dash Signed-off-by: Padmanabhan Rajanbabu Signed-off-by: David S. Miller commit af1c0e4e00f3cc76cb136ebf2e2c04e8b6446285 Author: Chan Shu Tak, Alex Date: Thu Dec 19 14:16:18 2019 +0800 llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) When a frame with NULL DSAP is received, llc_station_rcv is called. In turn, llc_stat_ev_rx_null_dsap_xid_c is called to check if it is a NULL XID frame. The return statement of llc_stat_ev_rx_null_dsap_xid_c returns 1 when the incoming frame is not a NULL XID frame and 0 otherwise. Hence, a NULL XID response is returned unexpectedly, e.g. when the incoming frame is a NULL TEST command. To fix the error, simply remove the conditional operator. A similar error in llc_stat_ev_rx_null_dsap_test_c is also fixed. Signed-off-by: Chan Shu Tak, Alex Signed-off-by: David S. Miller commit 90b3b339364c76baa2436445401ea9ade040c216 Author: Jiangfeng Xiao Date: Thu Dec 19 10:08:07 2019 +0800 net: hisilicon: Fix a BUG trigered by wrong bytes_compl When doing stress test, we get the following trace: kernel BUG at lib/dynamic_queue_limits.c:26! Internal error: Oops - BUG: 0 [#1] SMP ARM Modules linked in: hip04_eth CPU: 0 PID: 2003 Comm: tDblStackPcap0 Tainted: G O L 4.4.197 #1 Hardware name: Hisilicon A15 task: c3637668 task.stack: de3bc000 PC is at dql_completed+0x18/0x154 LR is at hip04_tx_reclaim+0x110/0x174 [hip04_eth] pc : [] lr : [] psr: 800f0313 sp : de3bdc2c ip : 00000000 fp : c020fb10 r10: 00000000 r9 : c39b4224 r8 : 00000001 r7 : 00000046 r6 : c39b4000 r5 : 0078f392 r4 : 0078f392 r3 : 00000047 r2 : 00000000 r1 : 00000046 r0 : df5d5c80 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 32c5387d Table: 1e189b80 DAC: 55555555 Process tDblStackPcap0 (pid: 2003, stack limit = 0xde3bc190) Stack: (0xde3bdc2c to 0xde3be000) [] (dql_completed) from [] (hip04_tx_reclaim+0x110/0x174 [hip04_eth]) [] (hip04_tx_reclaim [hip04_eth]) from [] (hip04_rx_poll+0x20/0x388 [hip04_eth]) [] (hip04_rx_poll [hip04_eth]) from [] (net_rx_action+0x120/0x374) [] (net_rx_action) from [] (__do_softirq+0x218/0x318) [] (__do_softirq) from [] (irq_exit+0x88/0xac) [] (irq_exit) from [] (msa_irq_exit+0x11c/0x1d4) [] (msa_irq_exit) from [] (__handle_domain_irq+0x110/0x148) [] (__handle_domain_irq) from [] (gic_handle_irq+0xd4/0x118) [] (gic_handle_irq) from [] (__irq_svc+0x40/0x58) Exception stack(0xde3bdde0 to 0xde3bde28) dde0: 00000000 00008001 c3637668 00000000 00000000 a00f0213 dd3627a0 c0af6380 de00: c086d380 a00f0213 c0a22a50 de3bde6c 00000002 de3bde30 c0558138 c055813c de20: 600f0213 ffffffff [] (__irq_svc) from [] (_raw_spin_unlock_irqrestore+0x44/0x54) Kernel panic - not syncing: Fatal exception in interrupt Pre-modification code: int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) { [...] [1] priv->tx_head = TX_NEXT(tx_head); [2] count++; [3] netdev_sent_queue(ndev, skb->len); [...] } An rx interrupt occurs if hip04_mac_start_xmit just executes to the line 2, tx_head has been updated, but corresponding 'skb->len' has not been added to dql_queue. And then hip04_mac_interrupt->__napi_schedule->hip04_rx_poll->hip04_tx_reclaim In hip04_tx_reclaim, because tx_head has been updated, bytes_compl will plus an additional "skb-> len" which has not been added to dql_queue. And then trigger the BUG_ON(bytes_compl > num_queued - dql->num_completed). To solve the problem described above, we put "netdev_sent_queue(ndev, skb->len);" before "priv->tx_head = TX_NEXT(tx_head);" Fixes: a41ea46a9a12 ("net: hisilicon: new hip04 ethernet driver") Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 4249c507f4cbedbe0afc75a43a8808ee072f87b9 Author: Michael Grzeschik Date: Wed Dec 18 17:01:39 2019 +0100 net: dsa: ksz: use common define for tag len Remove special taglen define KSZ8795_INGRESS_TAG_LEN and use generic KSZ_INGRESS_TAG_LEN instead. Signed-off-by: Michael Grzeschik Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit f80742b9c5ec7d3ff029f74da20f9e9fa637c090 Merge: ea8608d401de 39bdbf3e648d Author: David S. Miller Date: Fri Dec 20 21:00:28 2019 -0800 Merge branch 's390-fixes' Julian Wiedmann says: ==================== s390/qeth: fixes 2019-12-18 please apply the following patch series to your net tree. This brings two fixes for initialization / teardown issues, and one ENOTSUPP cleanup. ==================== Signed-off-by: David S. Miller commit 39bdbf3e648d801596498a5a625fbc9fc1c0002f Author: Julian Wiedmann Date: Wed Dec 18 16:32:28 2019 +0100 s390/qeth: don't return -ENOTSUPP to userspace ENOTSUPP is not uapi, use EOPNOTSUPP instead. Fixes: d66cb37e9664 ("qeth: Add new priority queueing options") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 0f399305cd31e5c813086eaa264f7f47e205c10e Author: Julian Wiedmann Date: Wed Dec 18 16:32:27 2019 +0100 s390/qeth: fix promiscuous mode after reset When managing the promiscuous mode during an RX modeset, qeth caches the current HW state to avoid repeated programming of the same state on each modeset. But while tearing down a device, we forget to clear the cached state. So when the device is later set online again, the initial RX modeset doesn't program the promiscuous mode since we believe it is already enabled. Fix this by clearing the cached state in the tear-down path. Note that for the SBP variant of promiscuous mode, this accidentally works right now because we unconditionally restore the SBP role while re-initializing. Fixes: 4a71df50047f ("qeth: new qeth device driver") Signed-off-by: Julian Wiedmann Reviewed-by: Alexandra Winter Signed-off-by: David S. Miller commit 2e3d7fa5d29b7ab649fdf8f9533ae0c0888a7fac Author: Julian Wiedmann Date: Wed Dec 18 16:32:26 2019 +0100 s390/qeth: handle error due to unsupported transport mode Along with z/VM NICs, there's additional device types that only support a specific transport mode (eg. external-bridged IQD). Identify the corresponding error code, and raise a fitting error message so that the user knows to adjust their device configuration. On top of that also fix the subsequent error path, so that the rejected cmd doesn't need to wait for a timeout but gets cancelled straight away. Fixes: 4a71df50047f ("qeth: new qeth device driver") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit df034c93f15ee71df231ff9fe311d27ff08a2a52 Author: David Jeffery Date: Tue Dec 17 11:00:24 2019 -0500 sbitmap: only queue kyber's wait callback if not already active Under heavy loads where the kyber I/O scheduler hits the token limits for its scheduling domains, kyber can become stuck. When active requests complete, kyber may not be woken up leaving the I/O requests in kyber stuck. This stuck state is due to a race condition with kyber and the sbitmap functions it uses to run a callback when enough requests have completed. The running of a sbt_wait callback can race with the attempt to insert the sbt_wait. Since sbitmap_del_wait_queue removes the sbt_wait from the list first then sets the sbq field to NULL, kyber can see the item as not on a list but the call to sbitmap_add_wait_queue will see sbq as non-NULL. This results in the sbt_wait being inserted onto the wait list but ws_active doesn't get incremented. So the sbitmap queue does not know there is a waiter on a wait list. Since sbitmap doesn't think there is a waiter, kyber may never be informed that there are domain tokens available and the I/O never advances. With the sbt_wait on a wait list, kyber believes it has an active waiter so cannot insert a new waiter when reaching the domain's full state. This race can be fixed by only adding the sbt_wait to the queue if the sbq field is NULL. If sbq is not NULL, there is already an action active which will trigger the re-running of kyber. Let it run and add the sbt_wait to the wait list if still needing to wait. Reviewed-by: Omar Sandoval Signed-off-by: David Jeffery Reported-by: John Pittman Tested-by: John Pittman Signed-off-by: Jens Axboe commit ea8608d401def015e83c2c32ed6c32996abb3ed2 Author: Rahul Lakkireddy Date: Wed Dec 18 09:19:29 2019 +0530 cxgb4: fix refcount init for TC-MQPRIO offload Properly initialize refcount to 1 when hardware queue arrays for TC-MQPRIO offload have been freshly allocated. Otherwise, following warning is observed. Also fix up error path to only free hardware queue arrays when refcount reaches 0. [ 130.075342] ------------[ cut here ]------------ [ 130.075343] refcount_t: addition on 0; use-after-free. [ 130.075355] WARNING: CPU: 0 PID: 10870 at lib/refcount.c:25 refcount_warn_saturate+0xe1/0x100 [ 130.075356] Modules linked in: sch_mqprio iptable_nat ib_iser libiscsi scsi_transport_iscsi ib_ipoib rdma_ucm ib_umad iw_cxgb4 libcxgb ib_uverbs x86_pkg_temp_thermal cxgb4 igb [ 130.075361] CPU: 0 PID: 10870 Comm: tc Kdump: loaded Not tainted 5.5.0-rc1+ #11 [ 130.075362] Hardware name: Supermicro X9SRE/X9SRE-3F/X9SRi/X9SRi-3F/X9SRE/X9SRE-3F/X9SRi/X9SRi-3F, BIOS 3.2 01/16/2015 [ 130.075363] RIP: 0010:refcount_warn_saturate+0xe1/0x100 [ 130.075364] Code: e8 14 41 c1 ff 0f 0b c3 80 3d 44 f4 10 01 00 0f 85 63 ff ff ff 48 c7 c7 38 9f 83 8c 31 c0 c6 05 2e f4 10 01 01 e8 ef 40 c1 ff <0f> 0b c3 48 c7 c7 10 9f 83 8c 31 c0 c6 05 17 f4 10 01 01 e8 d7 40 [ 130.075365] RSP: 0018:ffffa48d00c0b768 EFLAGS: 00010286 [ 130.075366] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000001 [ 130.075366] RDX: 0000000000000001 RSI: 0000000000000096 RDI: ffff8a2e9fa187d0 [ 130.075367] RBP: ffff8a2e93890000 R08: 0000000000000398 R09: 000000000000003c [ 130.075367] R10: 00000000000142a0 R11: 0000000000000397 R12: ffffa48d00c0b848 [ 130.075368] R13: ffff8a2e94746498 R14: ffff8a2e966f7000 R15: 0000000000000031 [ 130.075368] FS: 00007f689015f840(0000) GS:ffff8a2e9fa00000(0000) knlGS:0000000000000000 [ 130.075369] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.075369] CR2: 00000000006762a0 CR3: 00000007cf164005 CR4: 00000000001606f0 [ 130.075370] Call Trace: [ 130.075377] cxgb4_setup_tc_mqprio+0xbee/0xc30 [cxgb4] [ 130.075382] ? cxgb4_ethofld_restart+0x50/0x50 [cxgb4] [ 130.075384] ? pfifo_fast_init+0x7e/0xf0 [ 130.075386] mqprio_init+0x5f4/0x630 [sch_mqprio] [ 130.075389] qdisc_create+0x1bf/0x4a0 [ 130.075390] tc_modify_qdisc+0x1ff/0x770 [ 130.075392] rtnetlink_rcv_msg+0x28b/0x350 [ 130.075394] ? rtnl_calcit.isra.32+0x110/0x110 [ 130.075395] netlink_rcv_skb+0xc6/0x100 [ 130.075396] netlink_unicast+0x1db/0x330 [ 130.075397] netlink_sendmsg+0x2f5/0x460 [ 130.075399] ? _copy_from_user+0x2e/0x60 [ 130.075400] sock_sendmsg+0x59/0x70 [ 130.075401] ____sys_sendmsg+0x1f0/0x230 [ 130.075402] ? copy_msghdr_from_user+0xd7/0x140 [ 130.075403] ___sys_sendmsg+0x77/0xb0 [ 130.075404] ? ___sys_recvmsg+0x84/0xb0 [ 130.075406] ? __handle_mm_fault+0x377/0xaf0 [ 130.075407] __sys_sendmsg+0x53/0xa0 [ 130.075409] do_syscall_64+0x44/0x130 [ 130.075412] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 130.075413] RIP: 0033:0x7f688f13af10 [ 130.075414] Code: c3 48 8b 05 82 6f 2c 00 f7 db 64 89 18 48 83 cb ff eb dd 0f 1f 80 00 00 00 00 83 3d 8d d0 2c 00 00 75 10 b8 2e 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ae cc 00 00 48 89 04 24 [ 130.075414] RSP: 002b:00007ffe6c7d9988 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 130.075415] RAX: ffffffffffffffda RBX: 00000000006703a0 RCX: 00007f688f13af10 [ 130.075415] RDX: 0000000000000000 RSI: 00007ffe6c7d99f0 RDI: 0000000000000003 [ 130.075416] RBP: 000000005df38312 R08: 0000000000000002 R09: 0000000000008000 [ 130.075416] R10: 00007ffe6c7d93e0 R11: 0000000000000246 R12: 0000000000000000 [ 130.075417] R13: 00007ffe6c7e9c50 R14: 0000000000000001 R15: 000000000067c600 [ 130.075418] ---[ end trace 8fbb3bf36a8671db ]--- v2: - Move the refcount_set() closer to where the hardware queue arrays are being allocated. - Fix up error path to only free hardware queue arrays when refcount reaches 0. Fixes: 2d0cb84dd973 ("cxgb4: add ETHOFLD hardware queue support") Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit 55347ec340af401437680fd0e88df6739a967f9f Author: Yuya Fujita Date: Thu Dec 19 08:08:32 2019 +0000 perf hists: Fix variable name's inconsistency in hists__for_each() macro Variable names are inconsistent in hists__for_each macro(). Due to this inconsistency, the macro replaces its second argument with "fmt" regardless of its original name. So far it works because only "fmt" is passed to the second argument. However, this behavior is not expected and should be fixed. Fixes: f0786af536bb ("perf hists: Introduce hists__for_each_format macro") Fixes: aa6f50af822a ("perf hists: Introduce hists__for_each_sort_list macro") Signed-off-by: Yuya Fujita Acked-by: Jiri Olsa Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/OSAPR01MB1588E1C47AC22043175DE1B2E8520@OSAPR01MB1588.jpnprd01.prod.outlook.com Signed-off-by: Arnaldo Carvalho de Melo commit a75af86b6f344f99825cc894596804a91a2ee9cf Author: Arnaldo Carvalho de Melo Date: Wed Dec 18 15:23:14 2019 -0300 perf map: Set kmap->kmaps backpointer for main kernel map chunks When a map is create to represent the main kernel area (vmlinux) with map__new2() we allocate an extra area to store a pointer to the 'struct maps' for the kernel maps, so that we can access that struct when loading ELF files or kallsyms, as we will need to split it in multiple maps, one per kernel module or ELF section (such as ".init.text"). So when map->dso->kernel is non-zero, it is expected that map__kmap(map)->kmaps to be set to the tree of kernel maps (modules, chunks of the main kernel, bpf progs put in place via PERF_RECORD_KSYMBOL, the main kernel). This was not the case when we were splitting the main kernel into chunks for its ELF sections, which ended up making 'perf report --children' processing a perf.data file with callchains to trip on __map__is_kernel(), when we press ENTER to see the popup menu for main histogram entries that starts at a symbol in the ".init.text" ELF section, e.g.: - 8.83% 0.00% swapper [kernel.vmlinux].init.text [k] start_kernel start_kernel cpu_startup_entry do_idle cpuidle_enter cpuidle_enter_state intel_idle Fix it. Reviewed-by: Jiri Olsa Cc: Adrian Hunter Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/20191218190120.GB13282@kernel.org/ Signed-off-by: Arnaldo Carvalho de Melo commit 0feba17bd7ee3b7e03d141f119049dcc23efa94e Author: Jin Yao Date: Fri Dec 20 09:37:19 2019 +0800 perf report: Fix incorrectly added dimensions as switch perf data file We observed an issue that was some extra columns displayed after switching perf data file in browser. The steps to reproduce: 1. perf record -a -e cycles,instructions -- sleep 3 2. perf report --group 3. In browser, we use hotkey 's' to switch to another perf.data 4. Now in browser, the extra columns 'Self' and 'Children' are displayed. The issue is setup_sorting() executed again after repeat path, so dimensions are added again. This patch checks the last key returned from __cmd_report(). If it's K_SWITCH_INPUT_DATA, skips the setup_sorting(). Fixes: ad0de0971b7f ("perf report: Enable the runtime switching of perf data file") Signed-off-by: Jin Yao Tested-by: Arnaldo Carvalho de Melo Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Andi Kleen Cc: Feng Tang Cc: Jin Yao Cc: Kan Liang Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20191220013722.20592-1-yao.jin@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit f1fd1610cbb6655883d1838ac79e53301596685d Merge: 3939f2c86657 dbce0b65046d Author: Linus Torvalds Date: Fri Dec 20 13:48:32 2019 -0800 Merge tag 'devicetree-fixes-for-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fix from Rob Herring: "Add missing 'properties' keyword enclosing 'snps,tso' in snps,dwmac binding" * tag 'devicetree-fixes-for-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: Add missing 'properties' keyword enclosing 'snps,tso' commit f84ae29a6169318f9c929720c49d96323d2bbab9 Author: Hewenliang Date: Mon Dec 9 01:35:49 2019 -0500 tools lib traceevent: Fix memory leakage in filter_event It is necessary to call free_arg(arg) when add_filter_type() returns NULL in filter_event(). Signed-off-by: Hewenliang Reviewed-by: Steven Rostedt (VMware) Cc: Feilong Lin Cc: Tzvetomir Stoyanov Link: http://lore.kernel.org/lkml/20191209063549.59941-1-hewenliang4@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 3939f2c8665721eef8315f42d4c57fb1272aacd6 Merge: a7c88728da3b aa638cfe3e73 Author: Linus Torvalds Date: Fri Dec 20 13:36:49 2019 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Leftover put_cpu() in the perf/smmuv3 error path. - Add Hisilicon TSV110 to spectre-v2 safe list * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list perf/smmuv3: Remove the leftover put_cpu() in error path commit a7c88728da3bc68c5b3815332d084244303fd254 Merge: f8f04d085974 0c517e6ced03 Author: Linus Torvalds Date: Fri Dec 20 13:33:50 2019 -0800 Merge tag 'drm-fixes-2019-12-21' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Probably the last one before Christmas, I'll see if there is much demand over next few weeks for more fixes, I expect it'll be quiet enough. This has one exynos fix, and a bunch of i915 core and i915 GVT fixes. Summary: exynos: - component delete fix i915: - Fix to drop an unused and harmful display W/A - Fix to define EHL power wells independent of ICL - Fix for priority inversion on bonded requests - Fix in mmio offset calculation of DSB instance - Fix memory leak from get_task_pid when banning clients - Fixes to avoid dereference of uninitialized ops in dma_fence tracing and keep reference to execbuf object until submitted. - vGPU state setting locking fix (Zhenyu) - Fix vGPU display dmabuf as read-only (Zhenyu) - Properly handle vGPU display dmabuf page pin when rendering (Tina) - Fix one guest boot warning to handle guc reset state (Fred)" * tag 'drm-fixes-2019-12-21' of git://anongit.freedesktop.org/drm/drm: drm/exynos: gsc: add missed component_del drm/i915: Fix pid leak with banned clients drm/i915/gem: Keep request alive while attaching fences drm/i915: Fix WARN_ON condition for cursor plane ddb allocation drm/i915/gvt: Fix guest boot warning drm/i915/tgl: Drop Wa#1178 drm/i915/ehl: Define EHL powerwells independently of ICL drm/i915: Set fence_work.ops before dma_fence_init drm/i915: Copy across scheduler behaviour flags across submit fences drm/i915/dsb: Fix in mmio offset calculation of DSB instance drm/i915/gvt: Pin vgpu dma address before using drm/i915/gvt: set guest display buffer as readonly drm/i915/gvt: use vgpu lock for active state setting commit f8f04d085974ae37782c317abd75f770a25e7713 Merge: b371ddb94fae fd6c2e4c063d Author: Linus Torvalds Date: Fri Dec 20 13:30:49 2019 -0800 Merge tag 'io_uring-5.5-20191220' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Here's a set of fixes that should go into 5.5-rc3 for io_uring. This is bigger than I'd like it to be, mainly because we're fixing the case where an application reuses sqe data right after issue. This really must work, or it's confusing. With 5.5 we're flagging us as submit stable for the actual data, this must also be the case for SQEs. Honestly, I'd really like to add another series on top of this, since it cleans it up considerable and prevents any SQE reuse by design. I posted that here: https://lore.kernel.org/io-uring/20191220174742.7449-1-axboe@kernel.dk/T/#u and may still send it your way early next week once it's been looked at and had some more soak time (does pass all regression tests). With that series, we've unified the prep+issue handling, and only the prep phase even has access to the SQE. Anyway, outside of that, fixes in here for a few other issues that have been hit in testing or production" * tag 'io_uring-5.5-20191220' of git://git.kernel.dk/linux-block: io_uring: io_wq_submit_work() should not touch req->rw io_uring: don't wait when under-submitting io_uring: warn about unhandled opcode io_uring: read opcode and user_data from SQE exactly once io_uring: make IORING_OP_TIMEOUT_REMOVE deferrable io_uring: make IORING_OP_CANCEL_ASYNC deferrable io_uring: make IORING_POLL_ADD and IORING_POLL_REMOVE deferrable io_uring: make HARDLINK imply LINK io_uring: any deferred command must have stable sqe data io_uring: remove 'sqe' parameter to the OP helpers that take it io_uring: fix pre-prepped issue with force_nonblock == true io-wq: re-add io_wq_current_is_worker() io_uring: fix sporadic -EFAULT from IORING_OP_RECVMSG io_uring: fix stale comment and a few typos commit 0c517e6ced039b389bbe2d6be757525e52442f64 Merge: 39b7f58f10ba 78d75f5739c4 Author: Dave Airlie Date: Sat Dec 21 06:08:19 2019 +1000 Merge tag 'drm-intel-fixes-2019-12-19' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix to drop an unused and harmful display W/A - Fix to define EHL power wells independent of ICL - Fix for priority inversion on bonded requests - Fix in mmio offset calculation of DSB instance - Fix memory leak from get_task_pid when banning clients - Fixes to avoid dereference of uninitialized ops in dma_fence tracing and keep reference to execbuf object until submitted. - Includes gvt-fixes-2019-12-18 Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20191219124635.GA16068@jlahtine-desk.ger.corp.intel.com commit 39b7f58f10ba27891ee0c18bec808b00613312a2 Merge: d1eef1c61974 84c92365b20a Author: Dave Airlie Date: Sat Dec 21 06:06:51 2019 +1000 Merge tag 'exynos-drm-fixes-for-v5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Just one bug fixup . Make sure to unregister a component for Exynos gscaler driver when the driver is removed. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/1576714013-3788-1-git-send-email-inki.dae@samsung.com commit 75cf9797006a3a9f29a3a25c1febd6842a4a9eb2 Author: Helge Deller Date: Fri Dec 20 21:00:19 2019 +0100 parisc: Fix compiler warnings in debug_core.c Fix this compiler warning: kernel/debug/debug_core.c: In function ‘kgdb_cpu_enter’: arch/parisc/include/asm/cmpxchg.h:48:3: warning: value computed is not used [-Wunused-value] 48 | ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) arch/parisc/include/asm/atomic.h:78:30: note: in expansion of macro ‘xchg’ 78 | #define atomic_xchg(v, new) (xchg(&((v)->counter), new)) | ^~~~ kernel/debug/debug_core.c:596:4: note: in expansion of macro ‘atomic_xchg’ 596 | atomic_xchg(&kgdb_active, cpu); | ^~~~~~~~~~~ Signed-off-by: Helge Deller commit 3b7995a98ad76da5597b488fa84aa5a56d43b608 Author: Yang Yingliang Date: Wed Dec 18 16:44:04 2019 +0800 block: fix memleak when __blk_rq_map_user_iov() is failed When I doing fuzzy test, get the memleak report: BUG: memory leak unreferenced object 0xffff88837af80000 (size 4096): comm "memleak", pid 3557, jiffies 4294817681 (age 112.499s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 20 00 00 00 10 01 00 00 00 00 00 00 01 00 00 00 ............... backtrace: [<000000001c894df8>] bio_alloc_bioset+0x393/0x590 [<000000008b139a3c>] bio_copy_user_iov+0x300/0xcd0 [<00000000a998bd8c>] blk_rq_map_user_iov+0x2f1/0x5f0 [<000000005ceb7f05>] blk_rq_map_user+0xf2/0x160 [<000000006454da92>] sg_common_write.isra.21+0x1094/0x1870 [<00000000064bb208>] sg_write.part.25+0x5d9/0x950 [<000000004fc670f6>] sg_write+0x5f/0x8c [<00000000b0d05c7b>] __vfs_write+0x7c/0x100 [<000000008e177714>] vfs_write+0x1c3/0x500 [<0000000087d23f34>] ksys_write+0xf9/0x200 [<000000002c8dbc9d>] do_syscall_64+0x9f/0x4f0 [<00000000678d8e9a>] entry_SYSCALL_64_after_hwframe+0x49/0xbe If __blk_rq_map_user_iov() is failed in blk_rq_map_user_iov(), the bio(s) which is allocated before this failing will leak. The refcount of the bio(s) is init to 1 and increased to 2 by calling bio_get(), but __blk_rq_unmap_user() only decrease it to 1, so the bio cannot be freed. Fix it by calling blk_rq_unmap_user(). Reviewed-by: Bob Liu Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Signed-off-by: Jens Axboe commit daa400f5a1e581acc1f9a97100574e82a4590e87 Author: Stefan Haberland Date: Thu Dec 19 09:43:52 2019 +0100 s390/dasd: fix typo in copyright statement coypright -> copyright Reported-by: Kate Stewart Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit 00b39f698a4f1ee897227cace2e3937fc4412270 Author: Stefan Haberland Date: Thu Dec 19 09:43:51 2019 +0100 s390/dasd: fix memleak in path handling error case If for whatever reason the dasd_eckd_check_characteristics() function exits after at least some paths have their configuration data allocated those data is never freed again. In the error case the device->private pointer is set to NULL and dasd_eckd_uncheck_device() will exit without freeing the path data because of this NULL pointer. Fix by calling dasd_eckd_clear_conf_data() for error cases. Also use dasd_eckd_clear_conf_data() in dasd_eckd_uncheck_device() to avoid code duplication. Reported-by: Qian Cai Reviewed-by: Jan Hoeppner Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit dd4b3c83b9efac10d48a94c61372119fc555a077 Author: Jan Höppner Date: Thu Dec 19 09:43:50 2019 +0100 s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly The max data count (mdc) is an unsigned 16-bit integer value as per AR documentation and is received via ccw_device_get_mdc() for a specific path mask from the CIO layer. The function itself also always returns a positive mdc value or 0 in case mdc isn't supported or couldn't be determined. Though, the comment for this function describes a negative return value to indicate failures. As a result, the DASD device driver interprets the return value of ccw_device_get_mdc() incorrectly. The error case is essentially a dead code path. To fix this behaviour, check explicitly for a return value of 0 and change the comment for ccw_device_get_mdc() accordingly. This fix merely enables the error code path in the DASD functions get_fcx_max_data() and verify_fcx_max_data(). The actual functionality stays the same and is still correct. Reviewed-by: Cornelia Huck Signed-off-by: Jan Höppner Acked-by: Peter Oberparleiter Reviewed-by: Stefan Haberland Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit b3c6a59975415bde29cfd76ff1ab008edbf614a9 Author: Bart Van Assche Date: Tue Dec 17 16:24:35 2019 -0800 block: Fix a lockdep complaint triggered by request queue flushing Avoid that running test nvme/012 from the blktests suite triggers the following false positive lockdep complaint: ============================================ WARNING: possible recursive locking detected 5.0.0-rc3-xfstests-00015-g1236f7d60242 #841 Not tainted -------------------------------------------- ksoftirqd/1/16 is trying to acquire lock: 000000000282032e (&(&fq->mq_flush_lock)->rlock){..-.}, at: flush_end_io+0x4e/0x1d0 but task is already holding lock: 00000000cbadcbc2 (&(&fq->mq_flush_lock)->rlock){..-.}, at: flush_end_io+0x4e/0x1d0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&fq->mq_flush_lock)->rlock); lock(&(&fq->mq_flush_lock)->rlock); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by ksoftirqd/1/16: #0: 00000000cbadcbc2 (&(&fq->mq_flush_lock)->rlock){..-.}, at: flush_end_io+0x4e/0x1d0 stack backtrace: CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.0.0-rc3-xfstests-00015-g1236f7d60242 #841 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: dump_stack+0x67/0x90 __lock_acquire.cold.45+0x2b4/0x313 lock_acquire+0x98/0x160 _raw_spin_lock_irqsave+0x3b/0x80 flush_end_io+0x4e/0x1d0 blk_mq_complete_request+0x76/0x110 nvmet_req_complete+0x15/0x110 [nvmet] nvmet_bio_done+0x27/0x50 [nvmet] blk_update_request+0xd7/0x2d0 blk_mq_end_request+0x1a/0x100 blk_flush_complete_seq+0xe5/0x350 flush_end_io+0x12f/0x1d0 blk_done_softirq+0x9f/0xd0 __do_softirq+0xca/0x440 run_ksoftirqd+0x24/0x50 smpboot_thread_fn+0x113/0x1e0 kthread+0x121/0x140 ret_from_fork+0x3a/0x50 Cc: Christoph Hellwig Cc: Ming Lei Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Signed-off-by: Jens Axboe commit c44a4edb20938c85b64a256661443039f5bffdea Author: Bart Van Assche Date: Tue Dec 17 16:23:29 2019 -0800 block: Fix the type of 'sts' in bsg_queue_rq() This patch fixes the following sparse warnings: block/bsg-lib.c:269:19: warning: incorrect type in initializer (different base types) block/bsg-lib.c:269:19: expected int sts block/bsg-lib.c:269:19: got restricted blk_status_t [usertype] block/bsg-lib.c:286:16: warning: incorrect type in return expression (different base types) block/bsg-lib.c:286:16: expected restricted blk_status_t block/bsg-lib.c:286:16: got int [assigned] sts Cc: Martin Wilck Fixes: d46fe2cb2dce ("block: drop device references in bsg_queue_rq()") Signed-off-by: Bart Van Assche Signed-off-by: Jens Axboe commit 36257d5580419b28bd42de47d20400b04fc1dd2c Author: Helge Deller Date: Fri Dec 20 19:46:17 2019 +0100 parisc: soft_offline_page() now takes the pfn Switch page deallocation table (pdt) driver to use pfn instead of a page pointer in soft_offline_page(). Fixes: feec24a6139d ("mm, soft-offline: convert parameter to pfn") Signed-off-by: Helge Deller commit b371ddb94fae82b6565020639b7db31934043c65 Merge: fce34dec76d9 c18647900ec8 Author: Linus Torvalds Date: Fri Dec 20 10:42:25 2019 -0800 Merge tag 'iommu-fixes-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Fix kmemleak warning in IOVA code - Fix compile warnings on ARM32/64 in dma-iommu code due to dma_mask type mismatches - Make ISA reserved regions relaxable, so that VFIO can assign devices which have such regions defined - Fix mapping errors resulting in IO page-faults in the VT-d driver - Make sure direct mappings for a domain are created after the default domain is updated - Map ISA reserved regions in the VT-d driver with correct permissions - Remove unneeded check for PSI capability in the IOTLB flush code of the VT-d driver - Lockdep fix iommu_dma_prepare_msi() * tag 'iommu-fixes-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/dma: Relax locking in iommu_dma_prepare_msi() iommu/vt-d: Remove incorrect PSI capability check iommu/vt-d: Allocate reserved region for ISA with correct permission iommu: set group default domain before creating direct mappings iommu/vt-d: Fix dmar pte read access not set error iommu/vt-d: Set ISA bridge reserved region as relaxable iommu/dma: Rationalise types for DMA masks iommu/iova: Init the struct iova to fix the possible memleak commit fce34dec76d93311f90f1f077e1eba3605a3771c Merge: d2944d531380 02abbda105f2 Author: Linus Torvalds Date: Fri Dec 20 10:38:21 2019 -0800 Merge tag 'platform-drivers-x86-v5.5-2' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver fixes from Andy Shevchenko: "Bucket of fixes for PDx86. Note, that there is no ABI breakage in Mellanox driver because it has been introduced in v5.5-rc1, so we can change it. Summary: - Add support of APUv4 and fix an assignment of simswap GPIO - Add Siemens CONNECT X300 to DMI table to avoid stuck during boot - Correct arguments of WMI call on HP Envy x360 15-cp0xxx model - Fix the mlx-bootctl sysfs attributes to be device related" * tag 'platform-drivers-x86-v5.5-2' of git://git.infradead.org/linux-platform-drivers-x86: platform/x86: pcengines-apuv2: Spelling fixes in the driver platform/x86: pcengines-apuv2: detect apuv4 board platform/x86: pcengines-apuv2: fix simswap GPIO assignment platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes platform/mellanox: fix the mlx-bootctl sysfs commit d2944d531380110fb060ed0a9888eae91dc5861e Merge: 6398b9fc818e f667216c5c7c Author: Linus Torvalds Date: Fri Dec 20 10:36:49 2019 -0800 Merge tag 'mmc-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - mtk-sd: Fix tuning for MT8173 HS200/HS400 mode - sdhci: Revert a fix for incorrect switch to HS mode - sdhci-msm: Fixup accesses to the DDR_CONFIG register - sdhci-of-esdhc: Revert a bad fix for erratum A-009204 - sdhci-of-esdhc: Re-implement fix for erratum A-009204 - sdhci-of-esdhc: Fixup P2020 errata handling - sdhci-pci: Disable broken CMDQ on Intel GLK based Lenovo systems * tag 'mmc-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-of-esdhc: re-implement erratum A-009204 workaround mmc: sdhci: Add a quirk for broken command queuing mmc: sdhci: Workaround broken command queuing on Intel GLK mmc: sdhci-of-esdhc: fix P2020 errata handling mmc: sdhci: Update the tuning failed messages to pr_debug level mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support" mmc: mediatek: fix CMD_TA to 2 for MT8173 HS200/HS400 mode mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG register Revert "mmc: sdhci: Fix incorrect switch to HS mode" commit 6398b9fc818eea79dcd6e70f981ce782da22cdee Merge: 107aff96d36f 4aa37c463764 Author: Linus Torvalds Date: Fri Dec 20 10:11:30 2019 -0800 Merge tag 'char-misc-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char and other driver fixes for 5.5-rc3. The most noticable one is a much-reported fix for a random driver issue that came up from 5.5-rc1 compat_ioctl cleanups. The others are a chunk of habanalab driver fixes and intel_th driver fixes and new device ids. All have been in linux-next with no reported issues" * tag 'char-misc-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: random: don't forget compat_ioctl on urandom intel_th: msu: Fix window switching without windows intel_th: Fix freeing IRQs intel_th: pci: Add Elkhart Lake SOC support intel_th: pci: Add Comet Lake PCH-V support habanalabs: remove variable 'val' set but not used habanalabs: rate limit error msg on waiting for CS commit 107aff96d36fc4bf2a9ad69bc2524e9f53bde7a6 Merge: 1a4ee8673a77 c05c403b1d12 Author: Linus Torvalds Date: Fri Dec 20 10:09:21 2019 -0800 Merge tag 'staging-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some small staging driver fixes for a number of reported issues. The majority here are some fixes for the wfx driver, but also in here is a comedi driver fix found during some code review, and an axis-fifo build dependancy issue to resolve some reported testing problems. All of these have been in linux-next with no reported issues" * tag 'staging-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: wfx: fix wrong error message staging: wfx: fix hif_set_mfp() with big endian hosts staging: wfx: detect race condition in WEP authentication staging: wfx: ensure that retry policy always fallbacks to MCS0 / 1Mbps staging: wfx: fix rate control handling staging: wfx: firmware does not support more than 32 total retries staging: wfx: use boolean appropriately staging: wfx: fix counter overflow staging: wfx: fix case of lack of tx_retry_policies staging: wfx: fix the cache of rate policies on interface reset staging: axis-fifo: add unspecified HAS_IOMEM dependency staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value commit aa638cfe3e7358122a15cb1d295b622aae69e006 Author: Wei Li Date: Fri Dec 20 17:17:10 2019 +0800 arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list HiSilicon Taishan v110 CPUs didn't implement CSV2 field of the ID_AA64PFR0_EL1, but spectre-v2 is mitigated by hardware, so whitelist the MIDR in the safe list. Signed-off-by: Wei Li [hanjun: re-write the commit log] Signed-off-by: Hanjun Guo Signed-off-by: Catalin Marinas commit 1a4ee8673a775faf4164e66e03b2bcb0cc915d5d Merge: 7181aba14639 cb47b9f8630a Author: Linus Torvalds Date: Fri Dec 20 09:55:28 2019 -0800 Merge tag 'tty-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some small tty and serial driver fixes for 5.5-rc3. Only four small patches here: - atmel serial driver fix - msm_serial driver fix - sprd serial driver fix - tty core port fix The last tty core fix should resolve a long-standing bug with a race at port creation time that some people would see, and Sudip finally tracked down. All of these have been in linux-next with no reported issues" * tag 'tty-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty/serial: atmel: fix out of range clock divider handling tty: link tty and port before configuring it as console serial: sprd: Add clearing break interrupt operation tty: serial: msm_serial: Fix lockup for sysrq and oops commit 7181aba1463909b99a7c5807e5eae40d93d36366 Merge: 7190a23a58b7 6056a0f8ede2 Author: Linus Torvalds Date: Fri Dec 20 09:53:24 2019 -0800 Merge tag 'usb-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes for some reported issues. Included in here are: - xhci build warning fix - ehci disconnect warning fix - usbip lockup fix and error cleanup fix - typec build fix All of these have been in linux-next with no reported issues" * tag 'usb-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: xhci: Fix build warning seen with CONFIG_PM=n usbip: Fix error path of vhci_recv_ret_submit() usbip: Fix receive error in vhci-hcd when using scatter-gather USB: EHCI: Do not return -EPIPE when hub is disconnected usb: typec: fusb302: Fix an undefined reference to 'extcon_get_state' commit 7190a23a58b7587eadbe53aaffca280882838f35 Merge: 7e0165b2f1a9 9e65527ac3ba Author: Linus Torvalds Date: Fri Dec 20 09:49:05 2019 -0800 Merge tag 'pinctrl-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Sorry that this fixes pull request took a while. Too much christmas business going on. This contains a few really important Intel fixes and some odd fixes: - A host of fixes for the Intel baytrail and cherryview: properly serialize all register accesses and add the irqchip with the gpiochip as we need to, fix some pin lists and initialize the hardware in the right order. - Fix the Aspeed G6 LPC configuration. - Handle a possible NULL pointer exception in the core. - Fix the Kconfig dependencies for the Equilibrium driver" * tag 'pinctrl-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: ingenic: Fixup PIN_CONFIG_OUTPUT config pinctrl: Modify Kconfig to fix linker error pinctrl: pinmux: fix a possible null pointer in pinmux_can_be_used_for_gpio pinctrl: aspeed-g6: Fix LPC/eSPI mux configuration pinctrl: cherryview: Pass irqchip when adding gpiochip pinctrl: cherryview: Add GPIO <-> pin mapping ranges via callback pinctrl: cherryview: Split out irq hw-init into a separate helper function pinctrl: baytrail: Pass irqchip when adding gpiochip pinctrl: baytrail: Add GPIO <-> pin mapping ranges via callback pinctrl: baytrail: Update North Community pin list pinctrl: baytrail: Really serialize all register accesses commit 3529d8c2b353e6e446277ae96a36e7471cb070fc Author: Jens Axboe Date: Thu Dec 19 18:24:38 2019 -0700 io_uring: pass in 'sqe' to the prep handlers This moves the prep handlers outside of the opcode handlers, and allows us to pass in the sqe directly. If the sqe is non-NULL, it means that the request should be prepared for the first time. With the opcode handlers not having access to the sqe at all, we are guaranteed that the prep handler has setup the request fully by the time we get there. As before, for opcodes that need to copy in more data then the io_kiocb allows for, the io_async_ctx holds that info. If a prep handler is invoked with req->io set, it must use that to retain information for later. Finally, we can remove io_kiocb->sqe as well. Signed-off-by: Jens Axboe commit 06b76d44ba25e52711dc7cc4fc75b50907bc6b8e Author: Jens Axboe Date: Thu Dec 19 14:44:26 2019 -0700 io_uring: standardize the prep methods We currently have a mix of use cases. Most of the newer ones are pretty uniform, but we have some older ones that use different calling calling conventions. This is confusing. For the opcodes that currently rely on the req->io->sqe copy saving them from reuse, add a request type struct in the io_kiocb command union to store the data they need. Prepare for all opcodes having a standard prep method, so we can call it in a uniform fashion and outside of the opcode handler. This is in preparation for passing in the 'sqe' pointer, rather than storing it in the io_kiocb. Once we have uniform prep handlers, we can leave all the prep work to that part, and not even pass in the sqe to the opcode handler. This ensures that we don't reuse sqe data inadvertently. Signed-off-by: Jens Axboe commit 02abbda105f25fb634207e7f23a8a4b51fe67ad4 Author: Andy Shevchenko Date: Wed Dec 18 14:48:07 2019 +0200 platform/x86: pcengines-apuv2: Spelling fixes in the driver Mainly does: - capitalize gpio and bios to GPIO and BIOS - capitalize beginning of comments - add periods in multi-line comments Signed-off-by: Andy Shevchenko commit 3d00da1de3ea36ba44f4a7ba76c8c8b16f98204b Author: Enrico Weigelt, metux IT consult Date: Thu Dec 12 14:27:56 2019 +0100 platform/x86: pcengines-apuv2: detect apuv4 board GPIO stuff on APUv4 seems to be the same as on APUv2, so we just need to match on DMI data. Signed-off-by: Enrico Weigelt, metux IT consult Signed-off-by: Andy Shevchenko commit d4ac8f83dafec205c5db9b86b21587fba43bc017 Author: Enrico Weigelt, metux IT consult Date: Thu Dec 12 12:23:48 2019 +0100 platform/x86: pcengines-apuv2: fix simswap GPIO assignment The mapping entry has to hold the GPIO line index instead of controller's register number. Fixes: 5037d4ddda31 ("platform/x86: pcengines-apuv2: wire up simswitch gpio as led") Signed-off-by: Enrico Weigelt, metux IT consult Signed-off-by: Andy Shevchenko commit e8796c6c69d129420ee94a1906b18d86b84644d4 Author: Michael Haener Date: Fri Nov 29 10:16:49 2019 +0100 platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table The CONNECT X300 uses the PMC clock for on-board components and gets stuck during boot if the clock is disabled. Therefore, add this device to the critical systems list. Tested on CONNECT X300. Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL") Signed-off-by: Michael Haener Signed-off-by: Andy Shevchenko commit 133b2acee3871ae6bf123b8fe34be14464aa3d2c Author: Hans de Goede Date: Tue Dec 17 20:06:04 2019 +0100 platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes At least on the HP Envy x360 15-cp0xxx model the WMI interface for HPWMI_FEATURE2_QUERY requires an outsize of at least 128 bytes, otherwise it fails with an error code 5 (HPWMI_RET_INVALID_PARAMETERS): Dec 06 00:59:38 kernel: hp_wmi: query 0xd returned error 0x5 We do not care about the contents of the buffer, we just want to know if the HPWMI_FEATURE2_QUERY command is supported. This commits bumps the buffer size, fixing the error. Fixes: 8a1513b4932 ("hp-wmi: limit hotkey enable") Cc: stable@vger.kernel.org BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703 Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit 77dcc95e2048765b616b5308863ab1d4d5a8f720 Author: Liming Sun Date: Wed Dec 18 13:35:27 2019 -0500 platform/mellanox: fix the mlx-bootctl sysfs This is a follow-up commit for the sysfs attributes to change from DRIVER_ATTR to DEVICE_ATTR according to some initial comments. In such case, it's better to point the sysfs path to the device itself instead of the driver. The ABI document is also updated. Fixes: 79e29cb8fbc5 ("platform/mellanox: Add bootctl driver for Mellanox BlueField Soc") Signed-off-by: Liming Sun Signed-off-by: Andy Shevchenko commit 26a61679f10c6f041726411964b172565021c2eb Author: Jens Axboe Date: Fri Dec 20 09:02:01 2019 -0700 io_uring: read 'count' for IORING_OP_TIMEOUT in prep handler Add the count field to struct io_timeout, and ensure the prep handler has read it. Timeout also needs an async context always, set it up in the prep handler if we don't have one. Signed-off-by: Jens Axboe commit e47293fdf98998292a89d516c8f7b8b9eb5c5213 Author: Jens Axboe Date: Fri Dec 20 08:58:21 2019 -0700 io_uring: move all prep state for IORING_OP_{SEND,RECV}_MGS to prep handler Add struct io_sr_msg in our io_kiocb per-command union, and ensure that the send/recvmsg prep handlers have grabbed what they need from the SQE by the time prep is done. Signed-off-by: Jens Axboe commit 3fbb51c18f5c15a23db74c4da79d3d035176c480 Author: Jens Axboe Date: Fri Dec 20 08:51:52 2019 -0700 io_uring: move all prep state for IORING_OP_CONNECT to prep handler Add struct io_connect in our io_kiocb per-command union, and ensure that io_connect_prep() has grabbed what it needs from the SQE. Signed-off-by: Jens Axboe commit 9adbd45d6d32ffc1a03f3c51d72cfc69ebfc2ddb Author: Jens Axboe Date: Fri Dec 20 08:45:55 2019 -0700 io_uring: add and use struct io_rw for read/writes Put the kiocb in struct io_rw, and add the addr/len for the request as well. Use the kiocb->private field for the buffer index for fixed reads and writes. Any use of kiocb->ki_filp is flipped to req->file. It's the same thing, and less confusing. Signed-off-by: Jens Axboe commit 063c60d39180cec7c9317f5acfc3071f8fecd705 Author: David Howells Date: Fri Dec 20 16:17:16 2019 +0000 rxrpc: Fix missing security check on incoming calls Fix rxrpc_new_incoming_call() to check that we have a suitable service key available for the combination of service ID and security class of a new incoming call - and to reject calls for which we don't. This causes an assertion like the following to appear: rxrpc: Assertion failed - 6(0x6) == 12(0xc) is false kernel BUG at net/rxrpc/call_object.c:456! Where call->state is RXRPC_CALL_SERVER_SECURING (6) rather than RXRPC_CALL_COMPLETE (12). Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Reported-by: Marc Dionne Signed-off-by: David Howells commit 13b7955a0252e15265386b229b814152f109b234 Author: David Howells Date: Fri Dec 20 16:20:56 2019 +0000 rxrpc: Don't take call->user_mutex in rxrpc_new_incoming_call() Standard kernel mutexes cannot be used in any way from interrupt or softirq context, so the user_mutex which manages access to a call cannot be a mutex since on a new call the mutex must start off locked and be unlocked within the softirq handler to prevent userspace interfering with a call we're setting up. Commit a0855d24fc22d49cdc25664fb224caee16998683 ("locking/mutex: Complain upon mutex API misuse in IRQ contexts") causes big warnings to be splashed in dmesg for each a new call that comes in from the server. Whilst it *seems* like it should be okay, since the accept path uses trylock, there are issues with PI boosting and marking the wrong task as the owner. Fix this by not taking the mutex in the softirq path at all. It's not obvious that there should be any need for it as the state is set before the first notification is generated for the new call. There's also no particular reason why the link-assessing ping should be triggered inside the mutex. It's not actually transmitted there anyway, but rather it has to be deferred to a workqueue. Further, I don't think that there's any particular reason that the socket notification needs to be done from within rx->incoming_lock, so the amount of time that lock is held can be shortened too and the ping prepared before the new call notification is sent. Fixes: 540b1c48c37a ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg") Signed-off-by: David Howells cc: Peter Zijlstra (Intel) cc: Ingo Molnar cc: Will Deacon cc: Davidlohr Bueso commit f33121cbe91973a08e68e4bde8c3f7e6e4e351c1 Author: David Howells Date: Wed Dec 18 16:38:49 2019 +0000 rxrpc: Unlock new call in rxrpc_new_incoming_call() rather than the caller Move the unlock and the ping transmission for a new incoming call into rxrpc_new_incoming_call() rather than doing it in the caller. This makes it clearer to see what's going on. Suggested-by: Peter Zijlstra Signed-off-by: David Howells Acked-by: Peter Zijlstra (Intel) cc: Ingo Molnar cc: Will Deacon cc: Davidlohr Bueso commit 5084bf6b2006fcd46f1e44e3c51b687507b362e2 Author: Chen Wandun Date: Fri Dec 20 08:07:31 2019 -0800 xfs: Make the symbol 'xfs_rtalloc_log_count' static Fix the following sparse warning: fs/xfs/libxfs/xfs_trans_resv.c:206:1: warning: symbol 'xfs_rtalloc_log_count' was not declared. Should it be static? Fixes: b1de6fc7520f ("xfs: fix log reservation overflows when allocating large rt extents") Signed-off-by: Chen Wandun Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit d55e5f5b70dd6214ef81fb2313121b72a7dd2200 Author: Jens Axboe Date: Wed Dec 11 16:12:15 2019 -0700 io_uring: use u64_to_user_ptr() consistently We use it in some spots, but not consistently. Convert the rest over, makes it easier to read as well. No functional changes in this patch. Signed-off-by: Jens Axboe commit ac2917b01992c098b8d4e6837115e3ca347fdd90 Author: Ben Dooks (Codethink) Date: Tue Dec 17 11:53:09 2019 +0000 drm/arm/mali: make malidp_mw_connector_helper_funcs static The malidp_mw_connector_helper_funcs is not referenced by name outside of the file it is in, so make it static to avoid the following warning: drivers/gpu/drm/arm/malidp_mw.c:59:41: warning: symbol 'malidp_mw_connector_helper_funcs' was not declared. Should it be static? Signed-off-by: Ben Dooks (Codethink) Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20191217115309.2133503-1-ben.dooks@codethink.co.uk commit d6bd6cf9feb81737f9f64d2c1acf98fdaacebad1 Author: Aditya Pakki Date: Tue Dec 17 14:53:56 2019 -0600 xen/grant-table: remove multiple BUG_ON on gnttab_interface gnttab_request_version() always sets the gnttab_interface variable and the assertions to check for empty gnttab_interface is unnecessary. The patch eliminates multiple such assertions. Signed-off-by: Aditya Pakki Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit f4eef1b652eeb850a0f44e8f985cc4153a0c0265 Author: Paul Durrant Date: Wed Dec 11 15:29:56 2019 +0000 xen-blkback: support dynamic unbind/bind By simply re-attaching to shared rings during connect_ring() rather than assuming they are freshly allocated (i.e assuming the counters are zero) it is possible for vbd instances to be unbound and re-bound from and to (respectively) a running guest. This has been tested by running: while true; do fio --name=randwrite --ioengine=libaio --iodepth=16 \ --rw=randwrite --bs=4k --direct=1 --size=1G --verify=crc32; done in a PV guest whilst running: while true; do echo vbd-$DOMID-$VBD >unbind; echo unbound; sleep 5; echo vbd-$DOMID-$VBD >bind; echo bound; sleep 3; done in dom0 from /sys/bus/xen-backend/drivers/vbd to continuously unbind and re-bind its system disk image. This is a highly useful feature for a backend module as it allows it to be unloaded and re-loaded (i.e. updated) without requiring domUs to be halted. This was also tested by running: while true; do echo vbd-$DOMID-$VBD >unbind; echo unbound; sleep 5; rmmod xen-blkback; echo unloaded; sleep 1; modprobe xen-blkback; echo bound; cd $(pwd); sleep 3; done in dom0 whilst running the same loop as above in the (single) PV guest. Some (less stressful) testing has also been done using a Windows HVM guest with the latest 9.0 PV drivers installed. Signed-off-by: Paul Durrant Reviewed-by: Juergen Gross Reviewed-by: Roger Pau Monné Signed-off-by: Juergen Gross commit 1ee54195a305fae3955642af8528bdf67496d353 Author: Paul Durrant Date: Wed Dec 11 15:29:55 2019 +0000 xen/interface: re-define FRONT/BACK_RING_ATTACH() Currently these macros are defined to re-initialize a front/back ring (respectively) to values read from the shared ring in such a way that any requests/responses that are added to the shared ring whilst the front/back is detached will be skipped over. This, in general, is not a desirable semantic since most frontend implementations will eventually block waiting for a response which would either never appear or never be processed. Since the macros are currently unused, take this opportunity to re-define them to re-initialize a front/back ring using specified values. This also allows FRONT/BACK_RING_INIT() to be re-defined in terms of FRONT/BACK_RING_ATTACH() using a specified value of 0. NOTE: BACK_RING_ATTACH() will be used directly in a subsequent patch. Signed-off-by: Paul Durrant Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 672b7763cb2c723fd6f92a3879cc60d2fb11e56a Author: Paul Durrant Date: Wed Dec 11 15:29:54 2019 +0000 xenbus: limit when state is forced to closed If a driver probe() fails then leave the xenstore state alone. There is no reason to modify it as the failure may be due to transient resource allocation issues and hence a subsequent probe() may succeed. If the driver supports re-binding then only force state to closed during remove() only in the case when the toolstack may need to clean up. This can be detected by checking whether the state in xenstore has been set to closing prior to device removal. NOTE: Re-bind support is indicated by new boolean in struct xenbus_driver, which defaults to false. Subsequent patches will add support to some backend drivers. Signed-off-by: Paul Durrant Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit c534374ecf044384ddd24474b91fd0d31e720464 Author: Paul Durrant Date: Wed Dec 11 15:29:53 2019 +0000 xenbus: move xenbus_dev_shutdown() into frontend code... ...and make it static xenbus_dev_shutdown() is seemingly intended to cause clean shutdown of PV frontends when a guest is rebooted. Indeed the function waits for a conpletion which is only set by a call to xenbus_frontend_closed(). This patch removes the shutdown() method from backends and moves xenbus_dev_shutdown() from xenbus_probe.c into xenbus_probe_frontend.c, renaming it appropriately and making it static. NOTE: In the case where the backend is running in a driver domain, the toolstack should have already terminated any frontends that may be using it (since Xen does not support re-startable PV driver domains) so xenbus_dev_shutdown() should never be called. Signed-off-by: Paul Durrant Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 589b72894f53124a39d1bb3c0cecaf9dcabac417 Author: Nathan Chancellor Date: Mon Dec 9 13:14:44 2019 -0700 xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk Clang warns: ../drivers/block/xen-blkfront.c:1117:4: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation] nr_parts = PARTS_PER_DISK; ^ ../drivers/block/xen-blkfront.c:1115:3: note: previous statement is here if (err) ^ This is because there is a space at the beginning of this line; remove it so that the indentation is consistent according to the Linux kernel coding style and clang no longer warns. While we are here, the previous line has some trailing whitespace; clean that up as well. Fixes: c80a420995e7 ("xen-blkfront: handle Xen major numbers other than XENVBD") Link: https://github.com/ClangBuiltLinux/linux/issues/791 Signed-off-by: Nathan Chancellor Reviewed-by: Juergen Gross Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross commit cd217ee6867d285ceecd610fa1006975d5c683fa Author: Bjorn Andersson Date: Fri Dec 20 15:47:15 2019 +0530 phy: qcom-qmp: Increase PHY ready timeout It's typical for the QHP PHY to take slightly above 1ms to initialize, so increase the timeout of the PHY ready check to 10ms - as already done in the downstream PCIe driver. Signed-off-by: Bjorn Andersson Tested-by: Evan Green Tested-by: Vinod Koul Signed-off-by: Vinod Koul Signed-off-by: Kishon Vijay Abraham I commit 9209fb51896fe0eef8dfac85afe1f357e9265c0d Author: Christoph Hellwig Date: Thu Nov 7 10:20:39 2019 +0100 riscv: move sifive_l2_cache.c to drivers/soc The sifive_l2_cache.c is in no way related to RISC-V architecture memory management. It is a little stub driver working around the fact that the EDAC maintainers prefer their drivers to be structured in a certain way that doesn't fit the SiFive SOCs. Move the file to drivers/soc and add a Kconfig option for it, as well as the whole drivers/soc boilerplate for CONFIG_SOC_SIFIVE. Fixes: a967a289f169 ("RISC-V: sifive_l2_cache: Add L2 cache controller driver for SiFive SoCs") Signed-off-by: Christoph Hellwig Reviewed-by: Borislav Petkov [paul.walmsley@sifive.com: keep the MAINTAINERS change specific to the L2$ controller code] Signed-off-by: Paul Walmsley commit 7b02bf6194887eab2f8912f7284a9e407329a255 Author: Johannes Berg Date: Tue Nov 12 15:18:16 2019 +0100 iwlwifi: pcie: move page tracking into get_page_hdr() Move the tracking that records the page in the SKB for later free (refcount decrement) into the get_page_hdr() function for better code reuse. While at it, also add an assertion that this doesn't overwrite any existing page pointer in the skb. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit 160bab43419ebca9ee57219b2ccf02f0fa2c59e8 Author: Gil Adam Date: Thu Nov 7 21:23:21 2019 +0200 iwlwifi: don't send PPAG command if disabled we should not send the PPAG (Per-Platform Antenna Gain) command to FW unless the platform has this ACPI table and it was read and validated during the init flow. also no need to send the command if the feature is disabled, so check if enabled before sending, as if there is no valid table the feature is disabled. Signed-off-by: Gil Adam Signed-off-by: Luca Coelho commit 01f52e16b868ce22069425c69f2c8e3ef4077b5c Author: David Abdurachmanov Date: Wed Dec 18 10:28:11 2019 +0200 riscv: define vmemmap before pfn_to_page calls pfn_to_page & page_to_pfn depend on vmemmap being available before the calls if kernel is configured with CONFIG_SPARSEMEM_VMEMMAP=y. This was caused by NOMMU changes which moved vmemmap definition bellow functions definitions calling pfn_to_page & page_to_pfn. Noticed while compiled 5.5-rc2 kernel for Fedora/RISCV. v2: - Add a comment for vmemmap in source Signed-off-by: David Abdurachmanov Fixes: 6bd33e1ece52 ("riscv: add nommu support") Reviewed-by: Anup Patel Signed-off-by: Paul Walmsley commit d411cf02ed0260dacc4b2fd61dd5040fc2aa97e7 Author: Greentime Hu Date: Thu Dec 19 14:44:59 2019 +0800 riscv: fix scratch register clearing in M-mode. This patch fixes that the sscratch register clearing in M-mode. It cleared sscratch register in M-mode, but it should clear mscratch register. That will cause kernel trap if the CPU core doesn't support S-mode when trying to access sscratch. Fixes: 9e80635619b5 ("riscv: clear the instruction cache and all registers when booting") Signed-off-by: Greentime Hu Reviewed-by: Anup Patel Signed-off-by: Paul Walmsley commit 0312a3d4b43c0045869379affc0e228e36411c78 Author: Andreas Schwab Date: Tue Dec 17 12:15:16 2019 +0100 riscv: Fix use of undefined config option CONFIG_CONFIG_MMU In Kconfig files, config options are written without the CONFIG_ prefix. Fixes: 6bd33e1ece52 ("riscv: add nommu support") Signed-off-by: Andreas Schwab Reviewed-by: Anup Patel Signed-off-by: Paul Walmsley commit 4acb0200ab2b07843e3ef5599add3454c7440f03 Author: Tony Lindgren Date: Fri Dec 20 16:21:40 2019 +0530 phy: cpcap-usb: Fix error path when no host driver is loaded If musb_mailbox() returns an error, we must still continue to finish configuring the phy. Otherwise the phy state may end up only half initialized, and this can cause the debug serial console to stop working. And this will happen if the usb driver musb controller is not loaded. Let's fix the issue by adding helper for cpcap_usb_try_musb_mailbox(). Fixes: 6d6ce40f63af ("phy: cpcap-usb: Add CPCAP PMIC USB support") Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Signed-off-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I commit 2438c3a19dec5e98905fd3ffcc2f24716aceda6b Author: Daniele Palmas Date: Thu Dec 19 11:07:07 2019 +0100 USB: serial: option: add ZLP support for 0x1bc7/0x9010 Telit FN980 flashing device 0x1bc7/0x9010 requires zero packet to be sent if out data size is is equal to the endpoint max size. Signed-off-by: Daniele Palmas [ johan: switch operands in conditional ] Cc: stable Signed-off-by: Johan Hovold commit 0141254b0a74b37aa7eb13d42a56adba84d51c73 Author: Johan Hovold Date: Fri Dec 20 10:31:34 2019 +0100 ALSA: usb-audio: fix set_format altsetting sanity check Make sure to check the return value of usb_altnum_to_altsetting() to avoid dereferencing a NULL pointer when the requested alternate settings is missing. The format altsetting number may come from a quirk table and there does not seem to be any other validation of it (the corresponding index is checked however). Fixes: b099b9693d23 ("ALSA: usb-audio: Avoid superfluous usb_set_interface() calls") Cc: stable # 4.18 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20191220093134.1248-1-johan@kernel.org Signed-off-by: Takashi Iwai commit 307201a3d4947f1f677a1af56b2972fff40d473c Merge: 615f22f58029 6649a3f33747 Author: David S. Miller Date: Thu Dec 19 17:53:05 2019 -0800 Merge branch 'cls_u32-fix-refcount-leak' Davide Caratti says: ==================== net/sched: cls_u32: fix refcount leak a refcount leak in the error path of u32_change() has been recently introduced. It can be observed with the following commands: [root@f31 ~]# tc filter replace dev eth0 ingress protocol ip prio 97 \ > u32 match ip src 127.0.0.1/32 indev notexist20 flowid 1:1 action drop RTNETLINK answers: Invalid argument We have an error talking to the kernel [root@f31 ~]# tc filter replace dev eth0 ingress protocol ip prio 98 \ > handle 42:42 u32 divisor 256 Error: cls_u32: Divisor can only be used on a hash table. We have an error talking to the kernel [root@f31 ~]# tc filter replace dev eth0 ingress protocol ip prio 99 \ > u32 ht 47:47 Error: cls_u32: Specified hash table not found. We have an error talking to the kernel they all legitimately return -EINVAL; however, they leave semi-configured filters at eth0 tc ingress: [root@f31 ~]# tc filter show dev eth0 ingress filter protocol ip pref 97 u32 chain 0 filter protocol ip pref 97 u32 chain 0 fh 800: ht divisor 1 filter protocol ip pref 98 u32 chain 0 filter protocol ip pref 98 u32 chain 0 fh 801: ht divisor 1 filter protocol ip pref 99 u32 chain 0 filter protocol ip pref 99 u32 chain 0 fh 802: ht divisor 1 With older kernels, filters were unconditionally considered empty (and thus de-refcounted) on the error path of ->change(). After commit 8b64678e0af8 ("net: sched: refactor tp insert/delete for concurrent execution"), filters were considered empty when the walk() function didn't set 'walker.stop' to 1. Finally, with commit 6676d5e416ee ("net: sched: set dedicated tcf_walker flag when tp is empty"), tc filters are considered empty unless the walker function is called with a non-NULL handle. This last change doesn't fit cls_u32 design, because at least the "root hnode" is (almost) always non-NULL, as it's allocated in u32_init(). - patch 1/2 is a proposal to restore the original kernel behavior, where no filter was installed in the error path of u32_change(). - patch 2/2 adds tdc selftests that can be ued to verify the correct behavior of u32 in the error path of ->change(). ==================== Signed-off-by: David S. Miller commit 6649a3f3374720e000ea6d67b79b4df28a7662ba Author: Davide Caratti Date: Wed Dec 18 00:00:05 2019 +0100 tc-testing: initial tdc selftests for cls_u32 - move test "e9a3 - Add u32 with source match" to u32.json, and change the match pattern to catch all hnodes - add testcases for relevant error paths of cls_u32 module Signed-off-by: Davide Caratti Signed-off-by: David S. Miller commit 275c44aa194b7159d1191817b20e076f55f0e620 Author: Davide Caratti Date: Wed Dec 18 00:00:04 2019 +0100 net/sched: cls_u32: fix refcount leak in the error path of u32_change() when users replace cls_u32 filters with new ones having wrong parameters, so that u32_change() fails to validate them, the kernel doesn't roll-back correctly, and leaves semi-configured rules. Fix this in u32_walk(), avoiding a call to the walker function on filters that don't have a match rule connected. The side effect is, these "empty" filters are not even dumped when present; but that shouldn't be a problem as long as we are restoring the original behaviour, where semi-configured filters were not even added in the error path of u32_change(). Fixes: 6676d5e416ee ("net: sched: set dedicated tcf_walker flag when tp is empty") Signed-off-by: Davide Caratti Signed-off-by: David S. Miller commit 615f22f58029aa747b12768985e7f91cd053daa2 Author: Aditya Pakki Date: Tue Dec 17 14:43:00 2019 -0600 nfc: s3fwrn5: replace the assertion with a WARN_ON In s3fwrn5_fw_recv_frame, if fw_info->rsp is not empty, the current code causes a crash via BUG_ON. However, s3fwrn5_fw_send_msg does not crash in such a scenario. The patch replaces the BUG_ON by returning the error to the callers and frees up skb. Signed-off-by: Aditya Pakki Signed-off-by: David S. Miller commit a019739c1c32cbd07f62b1d84fa57620897464b1 Merge: 0fd260056ef8 ef8a2e27289e Author: David S. Miller Date: Thu Dec 19 17:32:21 2019 -0800 Merge branch 'macb-fix-probing-of-PHY-not-described-in-the-dt' Antoine Tenart says: ==================== net: macb: fix probing of PHY not described in the dt The macb Ethernet driver supports various ways of referencing its network PHY. When a device tree is used the PHY can be referenced with a phy-handle or, if connected to its internal MDIO bus, described in a child node. Some platforms omitted the PHY description while connecting the PHY to the internal MDIO bus and in such cases the MDIO bus has to be scanned "manually" by the macb driver. Prior to the phylink conversion the driver registered the MDIO bus with of_mdiobus_register and then in case the PHY couldn't be retrieved using dt or using phy_find_first (because registering an MDIO bus with of_mdiobus_register masks all PHYs) the macb driver was "manually" scanning the MDIO bus (like mdiobus_register does). The phylink conversion did break this particular case but reimplementing the manual scan of the bus in the macb driver wouldn't be very clean. The solution seems to be registering the MDIO bus based on if the PHYs are described in the device tree or not. There are multiple ways to do this, none is perfect. I chose to check if any of the child nodes of the macb node was a network PHY and based on this to register the MDIO bus with the of_ helper or not. The drawback is boards referencing the PHY through phy-handle, would scan the entire MDIO bus of the macb at boot time (as the MDIO bus would be registered with mdiobus_register). For this solution to work properly of_mdiobus_child_is_phy has to be exported, which means the patch doing so has to be backported to -stable as well. Another possible solution could have been to simply check if the macb node has a child node by counting its sub-nodes. This isn't techically perfect, as there could be other sub-nodes (in practice this should be fine, fixed-link being taken care of in the driver). We could also simply s/of_mdiobus_register/mdiobus_register/ but that could break boards using the PHY description in child node as a selector (which really would be not a proper way to do this...). The real issue here being having PHYs not described in the dt but we have dt backward compatibility, so we have to live with that. ==================== Signed-off-by: David S. Miller commit ef8a2e27289ee1b24e743c4302a053b128e16284 Author: Antoine Tenart Date: Tue Dec 17 18:07:42 2019 +0100 net: macb: fix probing of PHY not described in the dt This patch fixes the case where the PHY isn't described in the device tree. This is due to the way the MDIO bus is registered in the driver: whether the PHY is described in the device tree or not, the bus is registered through of_mdiobus_register. The function masks all the PHYs and only allow probing the ones described in the device tree. Prior to the Phylink conversion this was also done but later on in the driver the MDIO bus was manually scanned to circumvent the fact that the PHY wasn't described. This patch fixes it in a proper way, by registering the MDIO bus based on if the PHY attached to a given interface is described in the device tree or not. Fixes: 7897b071ac3b ("net: macb: convert to phylink") Signed-off-by: Antoine Tenart Signed-off-by: David S. Miller commit 0aa4d016c043d16a282e7e93edf6213a7b954c90 Author: Antoine Tenart Date: Tue Dec 17 18:07:41 2019 +0100 of: mdio: export of_mdiobus_child_is_phy This patch exports of_mdiobus_child_is_phy, allowing to check if a child node is a network PHY. Signed-off-by: Antoine Tenart Signed-off-by: David S. Miller commit 8cb4ec44de42b99b92399b4d1daf3dc430ed0186 Author: Phil Sutter Date: Wed Dec 18 00:59:29 2019 +0100 netfilter: nft_tproxy: Fix port selector on Big Endian On Big Endian architectures, u16 port value was extracted from the wrong parts of u32 sreg_port, just like commit 10596608c4d62 ("netfilter: nf_tables: fix mismatch in big-endian system") describes. Fixes: 4ed8eb6570a49 ("netfilter: nf_tables: Add native tproxy support") Signed-off-by: Phil Sutter Acked-by: Florian Westphal Acked-by: Máté Eckl Signed-off-by: Pablo Neira Ayuso commit e608f631f0ba5f1fc5ee2e260a3a35d13107cbfe Author: Florian Westphal Date: Sun Dec 15 03:49:25 2019 +0100 netfilter: ebtables: compat: reject all padding in matches/watchers syzbot reported following splat: BUG: KASAN: vmalloc-out-of-bounds in size_entry_mwt net/bridge/netfilter/ebtables.c:2063 [inline] BUG: KASAN: vmalloc-out-of-bounds in compat_copy_entries+0x128b/0x1380 net/bridge/netfilter/ebtables.c:2155 Read of size 4 at addr ffffc900004461f4 by task syz-executor267/7937 CPU: 1 PID: 7937 Comm: syz-executor267 Not tainted 5.5.0-rc1-syzkaller #0 size_entry_mwt net/bridge/netfilter/ebtables.c:2063 [inline] compat_copy_entries+0x128b/0x1380 net/bridge/netfilter/ebtables.c:2155 compat_do_replace+0x344/0x720 net/bridge/netfilter/ebtables.c:2249 compat_do_ebt_set_ctl+0x22f/0x27e net/bridge/netfilter/ebtables.c:2333 [..] Because padding isn't considered during computation of ->buf_user_offset, "total" is decremented by fewer bytes than it should. Therefore, the first part of if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry)) will pass, -- it should not have. This causes oob access: entry->next_offset is past the vmalloced size. Reject padding and check that computed user offset (sum of ebt_entry structure plus all individual matches/watchers/targets) is same value that userspace gave us as the offset of the next entry. Reported-by: syzbot+f68108fed972453a0ad4@syzkaller.appspotmail.com Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d05d5db815d56a0ce203ed297153d9794dfdcb68 Author: Florian Westphal Date: Fri Dec 13 01:19:58 2019 +0100 selftests: netfilter: extend flowtable test script with dnat rule NAT test currently covers snat (masquerade) only. Also add a dnat rule and then check that a connecting to the to-be-dnated address will work. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c9b3b8207bc487de02cbca968927ba2c2cb46aaf Author: Arnd Bergmann Date: Tue Dec 10 21:24:28 2019 +0100 netfilter: nf_flow_table: fix big-endian integer overflow In some configurations, gcc reports an integer overflow: net/netfilter/nf_flow_table_offload.c: In function 'nf_flow_rule_match': net/netfilter/nf_flow_table_offload.c:80:21: error: unsigned conversion from 'int' to '__be16' {aka 'short unsigned int'} changes value from '327680' to '0' [-Werror=overflow] mask->tcp.flags = TCP_FLAG_RST | TCP_FLAG_FIN; ^~~~~~~~~~~~ From what I can tell, we want the upper 16 bits of these constants, so they need to be shifted in cpu-endian mode. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Arnd Bergmann Signed-off-by: Pablo Neira Ayuso commit e4dc9a4c31fe10d1751c542702afc85be8a5c56a Author: Israel Rukshin Date: Wed Dec 11 17:36:02 2019 +0200 scsi: target/iblock: Fix protection error with blocks greater than 512B The sector size of the block layer is 512 bytes, but integrity interval size might be different (in case of 4K block size of the media). At the initiator side the virtual start sector is the one that was originally submitted by the block layer (512 bytes) for the Reftag usage. The initiator converts the Reftag to integrity interval units and sends it to the target. So the target virtual start sector should be calculated at integrity interval units. prepare_fn() and complete_fn() don't remap correctly the Reftag when using incorrect units of the virtual start sector, which leads to the following protection error at the device: "blk_update_request: protection error, dev sdb, sector 2048 op 0x0:(READ) flags 0x10000 phys_seg 1 prio class 0" To fix that, set the seed in integrity interval units. Link: https://lore.kernel.org/r/1576078562-15240-1-git-send-email-israelr@mellanox.com Signed-off-by: Israel Rukshin Reviewed-by: Max Gurtovoy Reviewed-by: Sagi Grimberg Signed-off-by: Martin K. Petersen commit 71482fde704efdd8c3abe0faf34d922c61e8d76b Author: Varun Prakash Date: Wed Dec 18 19:15:31 2019 +0530 scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy() If cxgb4i_ddp_init() fails then cdev->cdev2ppm will be NULL, so add a check for NULL pointer before dereferencing it. Link: https://lore.kernel.org/r/1576676731-3068-1-git-send-email-varun@chelsio.com Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen commit 291c2548458d3a8b326bfa8d7abbba86e036faf7 Author: Colin Ian King Date: Wed Dec 18 08:43:01 2019 +0000 scsi: lpfc: fix spelling mistakes of asynchronous There are spelling mistakes of asynchronous in a lpfc_printf_log message and comments. Fix these. Link: https://lore.kernel.org/r/20191218084301.627555-1-colin.king@canonical.com Signed-off-by: Colin Ian King Reviewed-by: James Smart Signed-off-by: Martin K. Petersen commit 106f41f5a302cb1f36c7543fae6a05de12e96fa4 Author: Steven Rostedt (VMware) Date: Wed Dec 11 15:44:22 2019 -0500 tracing: Have the histogram compare functions convert to u64 first The compare functions of the histogram code would be specific for the size of the value being compared (byte, short, int, long long). It would reference the value from the array via the type of the compare, but the value was stored in a 64 bit number. This is fine for little endian machines, but for big endian machines, it would end up comparing zeros or all ones (depending on the sign) for anything but 64 bit numbers. To fix this, first derference the value as a u64 then convert it to the type being compared. Link: http://lkml.kernel.org/r/20191211103557.7bed6928@gandalf.local.home Cc: stable@vger.kernel.org Fixes: 08d43a5fa063e ("tracing: Add lock-free tracing_map") Acked-by: Tom Zanussi Reported-by: Sven Schnelle Signed-off-by: Steven Rostedt (VMware) commit 79e65c27f09683fbb50c33acab395d0ddf5302d2 Author: Keita Suzuki Date: Wed Dec 11 09:12:58 2019 +0000 tracing: Avoid memory leak in process_system_preds() When failing in the allocation of filter_item, process_system_preds() goes to fail_mem, where the allocated filter is freed. However, this leads to memory leak of filter->filter_string and filter->prog, which is allocated before and in process_preds(). This bug has been detected by kmemleak as well. Fix this by changing kfree to __free_fiter. unreferenced object 0xffff8880658007c0 (size 32): comm "bash", pid 579, jiffies 4295096372 (age 17.752s) hex dump (first 32 bytes): 63 6f 6d 6d 6f 6e 5f 70 69 64 20 20 3e 20 31 30 common_pid > 10 00 00 00 00 00 00 00 00 65 73 00 00 00 00 00 00 ........es...... backtrace: [<0000000067441602>] kstrdup+0x2d/0x60 [<00000000141cf7b7>] apply_subsystem_event_filter+0x378/0x932 [<000000009ca32334>] subsystem_filter_write+0x5a/0x90 [<0000000072da2bee>] vfs_write+0xe1/0x240 [<000000004f14f473>] ksys_write+0xb4/0x150 [<00000000a968b4a0>] do_syscall_64+0x6d/0x1e0 [<000000001a189f40>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 unreferenced object 0xffff888060c22d00 (size 64): comm "bash", pid 579, jiffies 4295096372 (age 17.752s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 e8 d7 41 80 88 ff ff ...........A.... 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000b8c1b109>] process_preds+0x243/0x1820 [<000000003972c7f0>] apply_subsystem_event_filter+0x3be/0x932 [<000000009ca32334>] subsystem_filter_write+0x5a/0x90 [<0000000072da2bee>] vfs_write+0xe1/0x240 [<000000004f14f473>] ksys_write+0xb4/0x150 [<00000000a968b4a0>] do_syscall_64+0x6d/0x1e0 [<000000001a189f40>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 unreferenced object 0xffff888041d7e800 (size 512): comm "bash", pid 579, jiffies 4295096372 (age 17.752s) hex dump (first 32 bytes): 70 bc 85 97 ff ff ff ff 0a 00 00 00 00 00 00 00 p............... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000001e04af34>] process_preds+0x71a/0x1820 [<000000003972c7f0>] apply_subsystem_event_filter+0x3be/0x932 [<000000009ca32334>] subsystem_filter_write+0x5a/0x90 [<0000000072da2bee>] vfs_write+0xe1/0x240 [<000000004f14f473>] ksys_write+0xb4/0x150 [<00000000a968b4a0>] do_syscall_64+0x6d/0x1e0 [<000000001a189f40>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Link: http://lkml.kernel.org/r/20191211091258.11310-1-keitasuzuki.park@sslab.ics.keio.ac.jp Cc: Ingo Molnar Cc: stable@vger.kernel.org Fixes: 404a3add43c9c ("tracing: Only add filter list when needed") Signed-off-by: Keita Suzuki Signed-off-by: Steven Rostedt (VMware) commit 0fd260056ef84ede8f444c66a3820811691fe884 Merge: 6fa9a115fe7c 3123d8018d46 Author: David S. Miller Date: Thu Dec 19 14:20:47 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-12-19 The following pull-request contains BPF updates for your *net* tree. We've added 10 non-merge commits during the last 8 day(s) which contain a total of 21 files changed, 269 insertions(+), 108 deletions(-). The main changes are: 1) Fix lack of synchronization between xsk wakeup and destroying resources used by xsk wakeup, from Maxim Mikityanskiy. 2) Fix pruning with tail call patching, untrack programs in case of verifier error and fix a cgroup local storage tracking bug, from Daniel Borkmann. 3) Fix clearing skb->tstamp in bpf_redirect() when going from ingress to egress which otherwise cause issues e.g. on fq qdisc, from Lorenz Bauer. 4) Fix compile warning of unused proc_dointvec_minmax_bpf_restricted() when only cBPF is present, from Alexander Lobakin. ==================== Signed-off-by: David S. Miller commit 3123d8018d4686cf193806c4e27a9853550ed895 Author: Daniel Borkmann Date: Thu Dec 19 22:19:51 2019 +0100 bpf: Add further test_verifier cases for record_func_key Expand dummy prog generation such that we can easily check on return codes and add few more test cases to make sure we keep on tracking pruning behavior. # ./test_verifier [...] #1066/p XDP pkt read, pkt_data <= pkt_meta', bad access 1 OK #1067/p XDP pkt read, pkt_data <= pkt_meta', bad access 2 OK Summary: 1580 PASSED, 0 SKIPPED, 0 FAILED Also verified that JIT dump of added test cases looks good. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/df7200b6021444fd369376d227de917357285b65.1576789878.git.daniel@iogearbox.net commit cc52d9140aa920d8d61c7f6de3fff5fea6692ea9 Author: Daniel Borkmann Date: Thu Dec 19 22:19:50 2019 +0100 bpf: Fix record_func_key to perform backtracking on r3 While testing Cilium with /unreleased/ Linus' tree under BPF-based NodePort implementation, I noticed a strange BPF SNAT engine behavior from time to time. In some cases it would do the correct SNAT/DNAT service translation, but at a random point in time it would just stop and perform an unexpected translation after SYN, SYN/ACK and stack would send a RST back. While initially assuming that there is some sort of a race condition in BPF code, adding trace_printk()s for debugging purposes at some point seemed to have resolved the issue auto-magically. Digging deeper on this Heisenbug and reducing the trace_printk() calls to an absolute minimum, it turns out that a single call would suffice to trigger / not trigger the seen RST issue, even though the logic of the program itself remains unchanged. Turns out the single call changed verifier pruning behavior to get everything to work. Reconstructing a minimal test case, the incorrect JIT dump looked as follows: # bpftool p d j i 11346 0xffffffffc0cba96c: [...] 21: movzbq 0x30(%rdi),%rax 26: cmp $0xd,%rax 2a: je 0x000000000000003a 2c: xor %edx,%edx 2e: movabs $0xffff89cc74e85800,%rsi 38: jmp 0x0000000000000049 3a: mov $0x2,%edx 3f: movabs $0xffff89cc74e85800,%rsi 49: mov -0x224(%rbp),%eax 4f: cmp $0x20,%eax 52: ja 0x0000000000000062 54: add $0x1,%eax 57: mov %eax,-0x224(%rbp) 5d: jmpq 0xffffffffffff6911 62: mov $0x1,%eax [...] Hence, unexpectedly, JIT emitted a direct jump even though retpoline based one would have been needed since in line 2c and 3a we have different slot keys in BPF reg r3. Verifier log of the test case reveals what happened: 0: (b7) r0 = 14 1: (73) *(u8 *)(r1 +48) = r0 2: (71) r0 = *(u8 *)(r1 +48) 3: (15) if r0 == 0xd goto pc+4 R0_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff)) R1=ctx(id=0,off=0,imm=0) R10=fp0 4: (b7) r3 = 0 5: (18) r2 = 0xffff89cc74d54a00 7: (05) goto pc+3 11: (85) call bpf_tail_call#12 12: (b7) r0 = 1 13: (95) exit from 3 to 8: R0_w=inv13 R1=ctx(id=0,off=0,imm=0) R10=fp0 8: (b7) r3 = 2 9: (18) r2 = 0xffff89cc74d54a00 11: safe processed 13 insns (limit 1000000) [...] Second branch is pruned by verifier since considered safe, but issue is that record_func_key() couldn't have seen the index in line 3a and therefore decided that emitting a direct jump at this location was okay. Fix this by reusing our backtracking logic for precise scalar verification in order to prevent pruning on the slot key. This means verifier will track content of r3 all the way backwards and only prune if both scalars were unknown in state equivalence check and therefore poisoned in the first place in record_func_key(). The range is [x,x] in record_func_key() case since the slot always would have to be constant immediate. Correct verification after fix: 0: (b7) r0 = 14 1: (73) *(u8 *)(r1 +48) = r0 2: (71) r0 = *(u8 *)(r1 +48) 3: (15) if r0 == 0xd goto pc+4 R0_w=invP(id=0,umax_value=255,var_off=(0x0; 0xff)) R1=ctx(id=0,off=0,imm=0) R10=fp0 4: (b7) r3 = 0 5: (18) r2 = 0x0 7: (05) goto pc+3 11: (85) call bpf_tail_call#12 12: (b7) r0 = 1 13: (95) exit from 3 to 8: R0_w=invP13 R1=ctx(id=0,off=0,imm=0) R10=fp0 8: (b7) r3 = 2 9: (18) r2 = 0x0 11: (85) call bpf_tail_call#12 12: (b7) r0 = 1 13: (95) exit processed 15 insns (limit 1000000) [...] And correct corresponding JIT dump: # bpftool p d j i 11 0xffffffffc0dc34c4: [...] 21: movzbq 0x30(%rdi),%rax 26: cmp $0xd,%rax 2a: je 0x000000000000003a 2c: xor %edx,%edx 2e: movabs $0xffff9928b4c02200,%rsi 38: jmp 0x0000000000000049 3a: mov $0x2,%edx 3f: movabs $0xffff9928b4c02200,%rsi 49: cmp $0x4,%rdx 4d: jae 0x0000000000000093 4f: and $0x3,%edx 52: mov %edx,%edx 54: cmp %edx,0x24(%rsi) 57: jbe 0x0000000000000093 59: mov -0x224(%rbp),%eax 5f: cmp $0x20,%eax 62: ja 0x0000000000000093 64: add $0x1,%eax 67: mov %eax,-0x224(%rbp) 6d: mov 0x110(%rsi,%rdx,8),%rax 75: test %rax,%rax 78: je 0x0000000000000093 7a: mov 0x30(%rax),%rax 7e: add $0x19,%rax 82: callq 0x000000000000008e 87: pause 89: lfence 8c: jmp 0x0000000000000087 8e: mov %rax,(%rsp) 92: retq 93: mov $0x1,%eax [...] Also explicitly adding explicit env->allow_ptr_leaks to fixup_bpf_calls() since backtracking is enabled under former (direct jumps as well, but use different test). In case of only tracking different map pointers as in c93552c443eb ("bpf: properly enforce index mask to prevent out-of-bounds speculation"), pruning cannot make such short-cuts, neither if there are paths with scalar and non-scalar types as r3. mark_chain_precision() is only needed after we know that register_is_const(). If it was not the case, we already poison the key on first path and non-const key in later paths are not matching the scalar range in regsafe() either. Cilium NodePort testing passes fine as well now. Note, released kernels not affected. Fixes: d2e4c1e6c294 ("bpf: Constant map key tracking for prog array pokes") Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/ac43ffdeb7386c5bd688761ed266f3722bb39823.1576789878.git.daniel@iogearbox.net commit 1148f9adbe71415836a18a36c1b4ece999ab0973 Author: Alexander Lobakin Date: Wed Dec 18 12:18:21 2019 +0300 net, sysctl: Fix compiler warning when only cBPF is present proc_dointvec_minmax_bpf_restricted() has been firstly introduced in commit 2e4a30983b0f ("bpf: restrict access to core bpf sysctls") under CONFIG_HAVE_EBPF_JIT. Then, this ifdef has been removed in ede95a63b5e8 ("bpf: add bpf_jit_limit knob to restrict unpriv allocations"), because a new sysctl, bpf_jit_limit, made use of it. Finally, this parameter has become long instead of integer with fdadd04931c2 ("bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K") and thus, a new proc_dolongvec_minmax_bpf_restricted() has been added. With this last change, we got back to that proc_dointvec_minmax_bpf_restricted() is used only under CONFIG_HAVE_EBPF_JIT, but the corresponding ifdef has not been brought back. So, in configurations like CONFIG_BPF_JIT=y && CONFIG_HAVE_EBPF_JIT=n since v4.20 we have: CC net/core/sysctl_net_core.o net/core/sysctl_net_core.c:292:1: warning: ‘proc_dointvec_minmax_bpf_restricted’ defined but not used [-Wunused-function] 292 | proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Suppress this by guarding it with CONFIG_HAVE_EBPF_JIT again. Fixes: fdadd04931c2 ("bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K") Signed-off-by: Alexander Lobakin Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191218091821.7080-1-alobakin@dlink.ru commit 7e0165b2f1a912a06e381e91f0f4e495f4ac3736 Merge: 5f096c0ecd53 045f6d7942be Author: Linus Torvalds Date: Thu Dec 19 08:13:04 2019 -0800 Merge branch 'akpm' (patches from Andrew) Merge fixes from Andrew Morton: "6 fixes" * emailed patches from Andrew Morton : lib/Kconfig.debug: fix some messed up configurations mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG kasan: don't assume percpu shadow allocations will succeed kasan: use apply_to_existing_page_range() for releasing vmalloc shadow mm/memory.c: add apply_to_existing_page_range() helper kasan: fix crashes on access to memory mapped by vm_map_ram() commit 5f096c0ecd53263a94124bdfa516a29f154e44ed Merge: 4a94c4332334 505b308b6944 Author: Linus Torvalds Date: Thu Dec 19 08:09:43 2019 -0800 Merge tag 'pm-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a problem related to CPU offline/online and cpufreq governors that in some system configurations may lead to a system-wide deadlock during CPU online" * tag 'pm-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: Avoid leaving stale IRQ work items during CPU offline commit 13eaec4b2adf2657b8167b67e27c97cc7314d923 Author: Darrick J. Wong Date: Wed Dec 11 13:19:06 2019 -0800 xfs: don't commit sunit/swidth updates to disk if that would cause repair failures Alex Lyakas reported[1] that mounting an xfs filesystem with new sunit and swidth values could cause xfs_repair to fail loudly. The problem here is that repair calculates the where mkfs should have allocated the root inode, based on the superblock geometry. The allocation decisions depend on sunit, which means that we really can't go updating sunit if it would lead to a subsequent repair failure on an otherwise correct filesystem. Port from xfs_repair some code that computes the location of the root inode and teach mount to skip the ondisk update if it would cause problems for repair. Along the way we'll update the documentation, provide a function for computing the minimum AGFL size instead of open-coding it, and cut down some indenting in the mount code. Note that we allow the mount to proceed (and new allocations will reflect this new geometry) because we've never screened this kind of thing before. We'll have to wait for a new future incompat feature to enforce correct behavior, alas. Note that the geometry reporting always uses the superblock values, not the incore ones, so that is what xfs_info and xfs_growfs will report. [1] https://lore.kernel.org/linux-xfs/20191125130744.GA44777@bfoster/T/#m00f9594b511e076e2fcdd489d78bc30216d72a7d Reported-by: Alex Lyakas Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 4f5b1b3a8fa07dc8ecedfaf539b3deed8931a73e Author: Darrick J. Wong Date: Wed Dec 18 11:13:16 2019 -0800 xfs: split the sunit parameter update into two parts If the administrator provided a sunit= mount option, we need to validate the raw parameter, convert the mount option units (512b blocks) into the internal unit (fs blocks), and then validate that the (now cooked) parameter doesn't screw anything up on disk. The incore inode geometry computation can depend on the new sunit option, but a subsequent patch will make validating the cooked value depends on the computed inode geometry, so break the sunit update into two steps. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 1cac233cfe71f21e069705a4930c18e48d897be6 Author: Darrick J. Wong Date: Wed Dec 18 11:09:55 2019 -0800 xfs: refactor agfl length computation function Refactor xfs_alloc_min_freelist to accept a NULL @pag argument, in which case it returns the largest possible minimum length. This will be used in an upcoming patch to compute the length of the AGFL at mkfs time. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit af952aeb4a8717fe4c7a872d9699fcfa85aa9e1c Author: Darrick J. Wong Date: Mon Dec 16 11:14:09 2019 -0800 libxfs: resync with the userspace libxfs Prepare to resync the userspace libxfs with the kernel libxfs. There were a few things I missed -- a couple of static inline directory functions that have to be exported for xfs_repair; a couple of directory naming functions that make porting much easier if they're /not/ static inline; and a u16 usage that should have been uint16_t. None of these things are bugs in their own right; this just makes porting xfsprogs easier. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen commit 826f7e34130a4ce756138540170cbe935c537a47 Author: Brian Foster Date: Tue Dec 17 13:50:26 2019 -0800 xfs: use bitops interface for buf log item AIL flag check The xfs_log_item flags were converted to atomic bitops as of commit 22525c17ed ("xfs: log item flags are racy"). The assert check for AIL presence in xfs_buf_item_relse() still uses the old value based check. This likely went unnoticed as XFS_LI_IN_AIL evaluates to 0 and causes the assert to unconditionally pass. Fix up the check. Signed-off-by: Brian Foster Fixes: 22525c17ed ("xfs: log item flags are racy") Reviewed-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit ca8d0fa7cfb8abc4f623d49df210e0b81b32f626 Merge: e47304232b37 c0fdccfd226a Author: Daniel Borkmann Date: Thu Dec 19 16:20:49 2019 +0100 Merge branch 'bpf-fix-xsk-wakeup' Maxim Mikityanskiy says: ==================== This series addresses the issue described in the commit message of the first patch: lack of synchronization between XSK wakeup and destroying the resources used by XSK wakeup. The idea is similar to napi_synchronize. The series contains fixes for the drivers that implement XSK. v2 incorporates changes suggested by Björn: 1. Call synchronize_rcu in Intel drivers only if the XDP program is being unloaded. 2. Don't forget rcu_read_lock when wakeup is called from xsk_poll. 3. Use xs->zc as the condition to call ndo_xsk_wakeup. ==================== Signed-off-by: Daniel Borkmann commit c0fdccfd226a1424683d3000d9e08384391210a2 Author: Maxim Mikityanskiy Date: Tue Dec 17 16:20:47 2019 +0000 net/ixgbe: Fix concurrency issues between config flow and XSK Use synchronize_rcu to wait until the XSK wakeup function finishes before destroying the resources it uses: 1. ixgbe_down already calls synchronize_rcu after setting __IXGBE_DOWN. 2. After switching the XDP program, call synchronize_rcu to let ixgbe_xsk_wakeup exit before the XDP program is freed. 3. Changing the number of channels brings the interface down. 4. Disabling UMEM sets __IXGBE_TX_DISABLED before closing hardware resources and resetting xsk_umem. Check that bit in ixgbe_xsk_wakeup to avoid using the XDP ring when it's already destroyed. synchronize_rcu is called from ixgbe_txrx_ring_disable. Signed-off-by: Maxim Mikityanskiy Signed-off-by: Björn Töpel Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191217162023.16011-5-maximmi@mellanox.com commit b3873a5be757b44d51af542a50a6f2a3b6f95284 Author: Maxim Mikityanskiy Date: Tue Dec 17 16:20:45 2019 +0000 net/i40e: Fix concurrency issues between config flow and XSK Use synchronize_rcu to wait until the XSK wakeup function finishes before destroying the resources it uses: 1. i40e_down already calls synchronize_rcu. On i40e_down either __I40E_VSI_DOWN or __I40E_CONFIG_BUSY is set. Check the latter in i40e_xsk_wakeup (the former is already checked there). 2. After switching the XDP program, call synchronize_rcu to let i40e_xsk_wakeup exit before the XDP program is freed. 3. Changing the number of channels brings the interface down (see i40e_prep_for_reset and i40e_pf_quiesce_all_vsi). 4. Disabling UMEM sets __I40E_CONFIG_BUSY, too. Signed-off-by: Maxim Mikityanskiy Signed-off-by: Björn Töpel Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191217162023.16011-4-maximmi@mellanox.com commit 9cf88808ad6a0f1e958e00abd9a081295fe6da0c Author: Maxim Mikityanskiy Date: Tue Dec 17 16:20:44 2019 +0000 net/mlx5e: Fix concurrency issues between config flow and XSK After disabling resources necessary for XSK (the XDP program, channels, XSK queues), use synchronize_rcu to wait until the XSK wakeup function finishes, before freeing the resources. Suspend XSK wakeups during switching channels. If the XDP program is being removed, synchronize_rcu before closing the old channels to allow XSK wakeup to complete. Signed-off-by: Maxim Mikityanskiy Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191217162023.16011-3-maximmi@mellanox.com commit 06870682087b58398671e8cdc896cd62314c4399 Author: Maxim Mikityanskiy Date: Tue Dec 17 16:20:42 2019 +0000 xsk: Add rcu_read_lock around the XSK wakeup The XSK wakeup callback in drivers makes some sanity checks before triggering NAPI. However, some configuration changes may occur during this function that affect the result of those checks. For example, the interface can go down, and all the resources will be destroyed after the checks in the wakeup function, but before it attempts to use these resources. Wrap this callback in rcu_read_lock to allow driver to synchronize_rcu before actually destroying the resources. xsk_wakeup is a new function that encapsulates calling ndo_xsk_wakeup wrapped into the RCU lock. After this commit, xsk_poll starts using xsk_wakeup and checks xs->zc instead of ndo_xsk_wakeup != NULL to decide ndo_xsk_wakeup should be called. It also fixes a bug introduced with the need_wakeup feature: a non-zero-copy socket may be used with a driver supporting zero-copy, and in this case ndo_xsk_wakeup should not be called, so the xs->zc check is the correct one. Fixes: 77cd0d7b3f25 ("xsk: add support for need_wakeup flag in AF_XDP rings") Signed-off-by: Maxim Mikityanskiy Signed-off-by: Björn Töpel Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191217162023.16011-2-maximmi@mellanox.com commit 505b308b6944a91fa8437a3fd9f2dab29b5c3c88 Merge: 4c84515da809 85572c2c4a45 Author: Rafael J. Wysocki Date: Thu Dec 19 16:10:52 2019 +0100 Merge branch 'pm-cpufreq' * pm-cpufreq: cpufreq: Avoid leaving stale IRQ work items during CPU offline commit 833a20b8d4924b63ef7700e43fe4941963002822 Author: Eugeniy Paltsev Date: Thu Dec 19 16:30:40 2019 +0300 ARC: asm-offsets: remove duplicate entry We define 'PT_user_r25' twice in asm-offsets.c It's not a big issue as we define it to the same value, however let's fix it. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit 33328bfab892d676920abb440d41fbf4b16c2717 Author: Stanislaw Gruszka Date: Thu Dec 19 10:35:59 2019 +0100 MAINTAINERS: change Gruszka's email address My RedHat email address does not work any longer. Change to my private one. Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo commit 306d5acbfc66e7cccb4d8f91fc857206b8df80d1 Author: Pan Zhang Date: Thu Dec 19 10:45:30 2019 +0800 drivers/hid/hid-multitouch.c: fix a possible null pointer access. 1002 if ((quirks & MT_QUIRK_IGNORE_DUPLICATES) && mt) { 1003 struct input_mt_slot *i_slot = &mt->slots[slotnum]; 1004 1005 if (input_mt_is_active(i_slot) && 1006 input_mt_is_used(mt, i_slot)) 1007 return -EAGAIN; 1008 } We previously assumed 'mt' could be null (see line 1002). The following situation is similar, so add a judgement. Signed-off-by: Pan Zhang Signed-off-by: Benjamin Tissoires commit 66c5d718e5a6f80153b5e8d6ad8ba8e9c3320839 Author: Kailang Yang Date: Mon Dec 9 15:56:15 2019 +0800 ALSA: hda/realtek - Add headset Mic no shutup for ALC283 Chrome machine had humming noise from external speaker plugin at codec D3 state. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/2692449396954c6c968f5b75e2660358@realtek.com Signed-off-by: Takashi Iwai commit f667216c5c7c967c3e568cdddefb51fe606bfe26 Author: Yangbo Lu Date: Thu Dec 19 11:23:35 2019 +0800 mmc: sdhci-of-esdhc: re-implement erratum A-009204 workaround The erratum A-009204 workaround patch was reverted because of incorrect implementation. 8b6dc6b mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support" This patch is to re-implement the workaround (add a 5 ms delay before setting SYSCTL[RSTD] to make sure all the DMA transfers are finished). Signed-off-by: Yangbo Lu Link: https://lore.kernel.org/r/20191219032335.26528-1-yangbo.lu@nxp.com Fixes: 5dd195522562 ("mmc: sdhci-of-esdhc: add erratum A-009204 support") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 781d8cea68ac41d11a80df2a5f5babd584f86447 Author: Jeffrey Hugo Date: Tue Dec 17 09:19:05 2019 -0800 clk: qcom: Avoid SMMU/cx gdsc corner cases Mark the msm8998 cpu CX gdsc as votable and use the hw control to avoid corner cases with SMMU per hardware documentation. Fixes: 3f7df5baa259 ("clk: qcom: Add MSM8998 GPU Clock Controller (GPUCC) driver") Signed-off-by: Jeffrey Hugo Link: https://lkml.kernel.org/r/20191217171905.5619-1-jeffrey.l.hugo@gmail.com Signed-off-by: Stephen Boyd commit 8d20c39f063ed33012d7461c77fd5b89665e5163 Author: Matthias Kaehlcke Date: Wed Dec 4 12:04:12 2019 -0800 clk: qcom: gcc-sc7180: Fix setting flag for votable GDSCs Commit 17269568f7267 ("clk: qcom: Add Global Clock controller (GCC) driver for SC7180") sets the VOTABLE flag in .pwrsts, but it needs to be set in .flags, fix this. Fixes: 17269568f7267 ("clk: qcom: Add Global Clock controller (GCC) driver for SC7180") Signed-off-by: Matthias Kaehlcke Link: https://lkml.kernel.org/r/20191204120341.1.I9971817e83ee890d1096c43c5a6ce6ced53d5bd3@changeid Signed-off-by: Stephen Boyd commit 4a94c43323342f1522034d6566c5129a7386a0ab Merge: 80a0c2e511a9 1760eb689ed6 Author: Linus Torvalds Date: Wed Dec 18 17:17:36 2019 -0800 Merge tag 'tpmdd-next-20191219' of git://git.infradead.org/users/jjs/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen: "Bunch of fixes for rc3" * tag 'tpmdd-next-20191219' of git://git.infradead.org/users/jjs/linux-tpmdd: tpm/tpm_ftpm_tee: add shutdown call back tpm: selftest: cleanup after unseal with wrong auth/policy test tpm: selftest: add test covering async mode tpm: fix invalid locking in NONBLOCKING mode security: keys: trusted: fix lost handle flush tpm_tis: reserve chip for duration of tpm_tis_core_init KEYS: asymmetric: return ENOMEM if akcipher_request_alloc() fails KEYS: remove CONFIG_KEYS_COMPAT commit 1760eb689ed68c6746744aff2092bff57c78d907 Author: Pavel Tatashin Date: Wed Dec 4 10:40:38 2019 -0500 tpm/tpm_ftpm_tee: add shutdown call back Add shutdown call back to close existing session with fTPM TA to support kexec scenario. Add parentheses to function names in comments as specified in kdoc. Signed-off-by: Thirupathaiah Annapureddy Signed-off-by: Pavel Tatashin Reviewed-by: Jarkko Sakkinen Tested-by: Sasha Levin Signed-off-by: Jarkko Sakkinen commit 84c92365b20a44c363b95390ea00dfbdd786f031 Author: Chuhong Yuan Date: Mon Nov 18 19:39:55 2019 +0800 drm/exynos: gsc: add missed component_del The driver forgets to call component_del in remove to match component_add in probe. Add the missed call to fix it. Signed-off-by: Chuhong Yuan Signed-off-by: Inki Dae commit f596cf0d8062cb5d0a4513a8b3afca318c13be10 Author: Alexander Lobakin Date: Fri Dec 6 11:07:41 2019 +0300 MIPS: BPF: eBPF JIT: check for MIPS ISA compliance in Kconfig It is completely wrong to check for compile-time MIPS ISA revision in the body of bpf_int_jit_compile() as it may lead to get MIPS JIT fully omitted by the CC while the rest system will think that the JIT is actually present and works [1]. We can check if the selected CPU really supports MIPS eBPF JIT at configure time and avoid such situations when kernel can be built without both JIT and interpreter, but with CONFIG_BPF_SYSCALL=y. [1] https://lore.kernel.org/linux-mips/09d713a59665d745e21d021deeaebe0a@dlink.ru/ Fixes: 716850ab104d ("MIPS: eBPF: Initial eBPF support for MIPS32 architecture.") Cc: # v5.2+ Signed-off-by: Alexander Lobakin Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: Hassan Naveed Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Martin KaFai Lau Cc: Song Liu Cc: Yonghong Song Cc: Andrii Nakryiko Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org Cc: bpf@vger.kernel.org commit f8fffebdea752a25757b906f3dffecf1a59a6194 Author: Paul Burton Date: Thu Dec 5 10:23:18 2019 -0800 MIPS: BPF: Disable MIPS32 eBPF JIT Commit 716850ab104d ("MIPS: eBPF: Initial eBPF support for MIPS32 architecture.") enabled our eBPF JIT for MIPS32 kernels, whereas it has previously only been availailable for MIPS64. It was my understanding at the time that the BPF test suite was passing & JITing a comparable number of tests to our cBPF JIT [1], but it turns out that was not the case. The eBPF JIT has a number of problems on MIPS32: - Most notably various code paths still result in emission of MIPS64 instructions which will cause reserved instruction exceptions & kernel panics when run on MIPS32 CPUs. - The eBPF JIT doesn't account for differences between the O32 ABI used by MIPS32 kernels versus the N64 ABI used by MIPS64 kernels. Notably arguments beyond the first 4 are passed on the stack in O32, and this is entirely unhandled when JITing a BPF_CALL instruction. Stack space must be reserved for arguments even if they all fit in registers, and the callee is free to assume that stack space has been reserved for its use - with the eBPF JIT this is not the case, so calling any function can result in clobbering values on the stack & unpredictable behaviour. Function arguments in eBPF are always 64-bit values which is also entirely unhandled - the JIT still uses a single (32-bit) register per argument. As a result all function arguments are always passed incorrectly when JITing a BPF_CALL instruction, leading to kernel crashes or strange behavior. - The JIT attempts to bail our on use of ALU64 instructions or 64-bit memory access instructions. The code doing this at the start of build_one_insn() incorrectly checks whether BPF_OP() equals BPF_DW, when it should really be checking BPF_SIZE() & only doing so when BPF_CLASS() is one of BPF_{LD,LDX,ST,STX}. This results in false positives that cause more bailouts than intended, and that in turns hides some of the problems described above. - The kernel's cBPF->eBPF translation makes heavy use of 64-bit eBPF instructions that the MIPS32 eBPF JIT bails out on, leading to most cBPF programs not being JITed at all. Until these problems are resolved, revert the enabling of the eBPF JIT on MIPS32 done by commit 716850ab104d ("MIPS: eBPF: Initial eBPF support for MIPS32 architecture."). Note that this does not undo the changes made to the eBPF JIT by that commit, since they are a useful starting point to providing MIPS32 support - they're just not nearly complete. [1] https://lore.kernel.org/linux-mips/MWHPR2201MB13583388481F01A422CE7D66D4410@MWHPR2201MB1358.namprd22.prod.outlook.com/ Signed-off-by: Paul Burton Fixes: 716850ab104d ("MIPS: eBPF: Initial eBPF support for MIPS32 architecture.") Cc: Daniel Borkmann Cc: Hassan Naveed Cc: Tony Ambardar Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Cc: # v5.2+ Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit a4a3893114a41e365274d5fab5d9ff5acc235ff0 Author: Jouni Hogander Date: Mon Dec 9 14:37:07 2019 +0200 MIPS: Prevent link failure with kcov instrumentation __sanitizer_cov_trace_pc() is not linked in and causing link failure if KCOV_INSTRUMENT is enabled. Fix this by disabling instrumentation for compressed image. Signed-off-by: Jouni Hogander Signed-off-by: Paul Burton Cc: Lukas Bulwahn Cc: linux-mips@vger.kernel.org commit b4adfe55915d8363e244e42386d69567db1719b9 Author: Vasily Gorbik Date: Tue Dec 10 13:50:23 2019 +0100 s390/ftrace: save traced function caller A typical backtrace acquired from ftraced function currently looks like the following (e.g. for "path_openat"): arch_stack_walk+0x15c/0x2d8 stack_trace_save+0x50/0x68 stack_trace_call+0x15a/0x3b8 ftrace_graph_caller+0x0/0x1c 0x3e0007e3c98 <- ftraced function caller (should be do_filp_open+0x7c/0xe8) do_open_execat+0x70/0x1b8 __do_execve_file.isra.0+0x7d8/0x860 __s390x_sys_execve+0x56/0x68 system_call+0xdc/0x2d8 Note random "0x3e0007e3c98" stack value as ftraced function caller. This value causes either imprecise unwinder result or unwinding failure. That "0x3e0007e3c98" comes from r14 of ftraced function stack frame, which it haven't had a chance to initialize since the very first instruction calls ftrace code ("ftrace_caller"). (ftraced function might never save r14 as well). Nevertheless according to s390 ABI any function is called with stack frame allocated for it and r14 contains return address. "ftrace_caller" itself is called with "brasl %r0,ftrace_caller". So, to fix this issue simply always save traced function caller onto ftraced function stack frame. Reported-by: Sven Schnelle Signed-off-by: Vasily Gorbik commit eef06cbf670aaa2ccb56c9a7b84042acd657aa5d Author: Vasily Gorbik Date: Wed Dec 11 17:27:31 2019 +0100 s390/unwind: stop gracefully at user mode pt_regs in irq stack Consider reaching user mode pt_regs at the bottom of irq stack graceful unwinder termination. This is the case when irq/mcck/ext interrupt arrives while in user mode. Signed-off-by: Vasily Gorbik commit c23587c92f6e3260fe3b82bb75b38aa2553b9468 Author: Christian Borntraeger Date: Wed Dec 18 09:34:57 2019 +0100 s390/purgatory: do not build purgatory with kcov, kasan and friends the purgatory must not rely on functions from the "old" kernel, so we must disable kasan and friends. We also need to have a separate copy of string.c as the default does not build memcmp with KASAN. Reported-by: kbuild test robot Signed-off-by: Christian Borntraeger Reviewed-by: Vasily Gorbik Signed-off-by: Vasily Gorbik commit cd92ac253063981c96abfc3fdb326e430bd89ea6 Author: Hans de Goede Date: Thu Dec 12 21:53:04 2019 +0100 s390/purgatory: Make sure we fail the build if purgatory has missing symbols Since we link purgatory with -r aka we enable "incremental linking" no checks for unresolved symbols are done while linking the purgatory. This commit adds an extra check for unresolved symbols by calling ld without -r before running objcopy to generate purgatory.ro. This will help us catch missing symbols in the purgatory sooner. Note this commit also removes --no-undefined from LDFLAGS_purgatory as that has no effect. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/lkml/20191212205304.191610-1-hdegoede@redhat.com Tested-by: Philipp Rudo Signed-off-by: Christian Borntraeger Signed-off-by: Vasily Gorbik commit 6feeee8efc53035c3195b02068b58ae947538aa4 Author: Sven Schnelle Date: Mon Dec 9 09:03:12 2019 +0100 s390/ftrace: fix endless recursion in function_graph tracer The following sequence triggers a kernel stack overflow on s390x: mount -t tracefs tracefs /sys/kernel/tracing cd /sys/kernel/tracing echo function_graph > current_tracer [crash] This is because preempt_count_{add,sub} are in the list of traced functions, which can be demonstrated by: echo preempt_count_add >set_ftrace_filter echo function_graph > current_tracer [crash] The stack overflow happens because get_tod_clock_monotonic() gets called by ftrace but itself calls preempt_{disable,enable}(), which leads to a endless recursion. Fix this by using preempt_{disable,enable}_notrace(). Fixes: 011620688a71 ("s390/time: ensure get_clock_monotonic() returns monotonic values") Signed-off-by: Sven Schnelle Reviewed-by: Vasily Gorbik Signed-off-by: Vasily Gorbik commit 57177d214ee0816c4436c23d6c933ccb32c571f1 Author: Stefan Mavrodiev Date: Tue Dec 17 14:46:32 2019 +0200 drm/sun4i: hdmi: Remove duplicate cleanup calls When the HDMI unbinds drm_connector_cleanup() and drm_encoder_cleanup() are called. This also happens when the connector and the encoder are destroyed. This double call triggers a NULL pointer exception. The patch fixes this by removing the cleanup calls in the unbind function. Cc: Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support") Signed-off-by: Stefan Mavrodiev Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20191217124632.20820-1-stefan@olimex.com commit c7b305267eb77fe47498676e9337324c9653494c Author: Chen-Yu Tsai Date: Wed Dec 18 11:04:31 2019 +0800 clk: sunxi-ng: r40: Allow setting parent rate for external clock outputs One of the uses of the external clock outputs is to provide a stable 32768 Hz clock signal to WiFi and Bluetooth chips. On the R40, the RTC has an internal RC oscillator that is muxed with the external crystal. Allow setting the parent rate for the external clock outputs so that requests for 32768 Hz get passed to the RTC's clock driver to mux in the external crystal if it isn't already muxed correctly. Fixes: cd030a78f7aa ("clk: sunxi-ng: support R40 SoC") Fixes: 01a7ea763fc4 ("clk: sunxi-ng: r40: Force LOSC parent to RTC LOSC output") Cc: Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard commit 6fa9a115fe7ca507ef5618eb753706425741b285 Merge: b7ac893652ca 4772f26db8d1 Author: David S. Miller Date: Wed Dec 18 12:04:18 2019 -0800 Merge branch 'stmmac-fixes' Jose Abreu says: ==================== net: stmmac: Fixes for -net Fixes for stmmac. 1) Fixes the filtering selftests (again) for cases when the number of multicast filters are not enough. 2) Fixes SPH feature for MTU > default. 3) Fixes the behavior of accepting invalid MTU values. 4) Fixes FCS stripping for multi-descriptor packets. 5) Fixes the change of RX buffer size in XGMAC. 6) Fixes RX buffer size alignment. 7) Fixes the 16KB buffer alignment. 8) Fixes the enabling of 16KB buffer size feature. 9) Always arm the TX coalesce timer so that missed interrupts do not cause a TX queue timeout. ==================== Signed-off-by: David S. Miller commit 4772f26db8d1fb568c4862c538344a1b5fb52081 Author: Jose Abreu Date: Wed Dec 18 11:17:43 2019 +0100 net: stmmac: Always arm TX Timer at end of transmission start If TX Coalesce timer is enabled we should always arm it, otherwise we may hit the case where an interrupt is missed and the TX Queue will timeout. Arming the timer does not necessarly mean it will run the tx_clean() because this function is wrapped around NAPI launcher. Fixes: 9125cdd1be11 ("stmmac: add the initial tx coalesce schema") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit b2f3a481c4cd62f78391b836b64c0a6e72b503d2 Author: Jose Abreu Date: Wed Dec 18 11:17:42 2019 +0100 net: stmmac: Enable 16KB buffer size XGMAC supports maximum MTU that can go to 16KB. Lets add this check in the calculation of RX buffer size. Fixes: 7ac6653a085b ("stmmac: Move the STMicroelectronics driver") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 8605131747e7e1fd8f6c9f97a00287aae2b2c640 Author: Jose Abreu Date: Wed Dec 18 11:17:41 2019 +0100 net: stmmac: 16KB buffer must be 16 byte aligned The 16KB RX Buffer must also be 16 byte aligned. Fix it. Fixes: 7ac6653a085b ("stmmac: Move the STMicroelectronics driver") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 8d558f0294fe92e04af192e221d0d0f6a180ee7b Author: Jose Abreu Date: Wed Dec 18 11:17:40 2019 +0100 net: stmmac: RX buffer size must be 16 byte aligned We need to align the RX buffer size to at least 16 byte so that IP doesn't mis-behave. This is required by HW. Changes from v2: - Align UP and not DOWN (David) Fixes: 7ac6653a085b ("stmmac: Move the STMicroelectronics driver") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 11d55fd9975f8e46a0e5e19c14899544e81e1e15 Author: Jose Abreu Date: Wed Dec 18 11:17:39 2019 +0100 net: stmmac: xgmac: Clear previous RX buffer size When switching between buffer sizes we need to clear the previous value. Fixes: d6ddfacd95c7 ("net: stmmac: Add DMA related callbacks for XGMAC2") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 93b5dce401ccd4a688fe1f0d0bf0d97e63cdf921 Author: Jose Abreu Date: Wed Dec 18 11:17:38 2019 +0100 net: stmmac: Only the last buffer has the FCS field Only the last received buffer contains the FCS field. Check for end of packet before trying to strip the FCS field. Fixes: 88ebe2cf7f3f ("net: stmmac: Rework stmmac_rx()") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit eaf4fac478077d4ed57cbca2c044c4b58a96bd98 Author: Jose Abreu Date: Wed Dec 18 11:17:37 2019 +0100 net: stmmac: Do not accept invalid MTU values The maximum MTU value is determined by the maximum size of TX FIFO so that a full packet can fit in the FIFO. Add a check for this in the MTU change callback. Also check if provided and rounded MTU does not passes the maximum limit of 16K. Changes from v2: - Align MTU before checking if its valid Fixes: 7ac6653a085b ("stmmac: Move the STMicroelectronics driver") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 5d626c879e238be9585bd59a61eb606c9408178a Author: Jose Abreu Date: Wed Dec 18 11:17:36 2019 +0100 net: stmmac: Determine earlier the size of RX buffer Split Header feature needs to know the size of RX buffer but current code is determining it too late. Fix this by moving the RX buffer computation to earlier stage. Changes from v2: - Do not try to align already aligned buffer size Fixes: 67afd6d1cfdf ("net: stmmac: Add Split Header support and enable it in XGMAC cores") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 08c965430869ed423921bd9058ae59f75207feb6 Author: Jose Abreu Date: Wed Dec 18 11:17:35 2019 +0100 net: stmmac: selftests: Needs to check the number of Multicast regs When running the MC and UC filter tests we setup a multicast address that its expected to be blocked. If the number of available multicast registers is zero, driver will always pass the multicast packets which will fail the test. Check if available multicast addresses is enough before running the tests. Fixes: 091810dbded9 ("net: stmmac: Introduce selftests support") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit f40ddaa059fdfb472e3aeb733c6220d8e0633a47 Author: Chen-Yu Tsai Date: Wed Dec 18 12:47:20 2019 +0800 regulator: axp20x: Fix AXP22x ELDO2 regulator enable bitmask A copy-paste error was introduced when bitmasks were converted to macros, incorrectly setting the enable bitmask for ELDO2 to the one for ELDO1 for the AXP22x units. Fix it by using the correct macro. On affected boards, ELDO1 and/or ELDO2 are used to power the camera, which is currently unsupported. Fixes: db4a555f7c4c ("regulator: axp20x: use defines for masks") Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20191218044720.21990-1-wens@kernel.org Signed-off-by: Mark Brown commit b7ac893652cafadcf669f78452329727e4e255cc Author: Jia-Ju Bai Date: Wed Dec 18 17:21:55 2019 +0800 net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive() The kernel may sleep while holding a spinlock. The function call path (from bottom to top) in Linux 4.19 is: net/nfc/nci/uart.c, 349: nci_skb_alloc in nci_uart_default_recv_buf net/nfc/nci/uart.c, 255: (FUNC_PTR)nci_uart_default_recv_buf in nci_uart_tty_receive net/nfc/nci/uart.c, 254: spin_lock in nci_uart_tty_receive nci_skb_alloc(GFP_KERNEL) can sleep at runtime. (FUNC_PTR) means a function pointer is called. To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC for nci_skb_alloc(). This bug is found by a static analysis tool STCheck written by myself. Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller commit 921162c81a089aa2f442103290f1af9ba281fc9f Author: Pierre-Louis Bossart Date: Tue Dec 17 18:05:17 2019 -0600 ASoC: SOF: Intel: hda: hda-dai: fix oops on hda_link .hw_free When the PCM_PARAM IPC fails while configuring the FE, the kernel oopses in the HDaudio link DMA .hw_free operation. The root cause is a NULL dma_data since the BE .hw_params was never called by the SOC core. This error can also happen if the HDaudio link DMA configuration IPC fails in the BE .hw_params. This patches makes sure the dma_data is properly saved in .hw_params, and tested before being use in hw_free. GitHub issue: https://github.com/thesofproject/linux/issues/1417 Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191218000518.5830-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit b06e46427f987bf83dcb6a69516b57276eb8ec0c Author: Kai Vehmanen Date: Tue Dec 17 18:05:16 2019 -0600 ASoC: SOF: fix fault at driver unload after failed probe If sof_machine_check() fails during driver probe, the IPC state is not initialized and this will lead to a NULL dereference at driver unload. Example log is as follows: [ 1535.980630] sof-audio-pci 0000:00:1f.3: error: no matching ASoC machine driver found - aborting probe [ 1535.980631] sof-audio-pci 0000:00:1f.3: error: failed to get machine info -19 [ 1535.980632] sof-audio-pci 0000:00:1f.3: error: sof_probe_work failed err: -19 [ 1550.798373] BUG: kernel NULL pointer dereference, address: 0000000000000008 ... [ 1550.798393] Call Trace: [ 1550.798397] snd_sof_ipc_free+0x15/0x30 [snd_sof] [ 1550.798399] snd_sof_device_remove+0x29/0xa0 [snd_sof] [ 1550.798400] sof_pci_remove+0x10/0x30 [snd_sof_pci] Signed-off-by: Kai Vehmanen Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191218000518.5830-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit fd6c2e4c063d64511657ad0031a1677b6a914859 Author: Jens Axboe Date: Wed Dec 18 12:19:41 2019 -0700 io_uring: io_wq_submit_work() should not touch req->rw I've been chasing a weird and obscure crash that was userspace stack corruption, and finally narrowed it down to a bit flip that made a stack address invalid. io_wq_submit_work() unconditionally flips the req->rw.ki_flags IOCB_NOWAIT bit, but since it's a generic work handler, this isn't valid. Normal read/write operations own that part of the request, on other types it could be something else. Move the IOCB_NOWAIT clear to the read/write handlers where it belongs. Signed-off-by: Jens Axboe commit 92adc96f8eecd9522a907c197cc3d62e405539fe Author: Hui Wang Date: Wed Dec 18 21:26:50 2019 +0800 ALSA: usb-audio: set the interface format after resume on Dell WD19 Recently we found the headset-mic on the Dell Dock WD19 doesn't work anymore after s3 (s2i or deep), this problem could be workarounded by closing (pcm_close) the app and then reopening (pcm_open) the app, so this bug is not easy to be detected by users. When problem happens, retire_capture_urb() could still be called periodically, but the size of captured data is always 0, it could be a firmware bug on the dock. Anyway I found after resuming, the snd_usb_pcm_prepare() will be called, and if we forcibly run set_format() to set the interface and its endpoint, the capture size will be normal again. This problem and workaound also apply to playback. To fix it in the kernel, add a quirk to let set_format() run forcibly once after resume. Signed-off-by: Hui Wang Cc: Link: https://lore.kernel.org/r/20191218132650.6303-1-hui.wang@canonical.com Signed-off-by: Takashi Iwai commit e5e884b42639c74b5b57dc277909915c0aefc8bb Author: Wen Huang Date: Thu Nov 28 18:51:04 2019 +0800 libertas: Fix two buffer overflows at parsing bss descriptor add_ie_rates() copys rates without checking the length in bss descriptor from remote AP.when victim connects to remote attacker, this may trigger buffer overflow. lbs_ibss_join_existing() copys rates without checking the length in bss descriptor from remote IBSS node.when victim connects to remote attacker, this may trigger buffer overflow. Fix them by putting the length check before performing copy. This fix addresses CVE-2019-14896 and CVE-2019-14897. This also fix build warning of mixed declarations and code. Reported-by: kbuild test robot Signed-off-by: Wen Huang Signed-off-by: Kalle Valo commit b43e36d75e8727f78892652a25967a1ffa03d1d1 Author: Dan Carpenter Date: Tue Nov 26 07:49:56 2019 +0300 mt76: Off by one in mt76_calc_rx_airtime() The sband->bitrates[] array has "sband->n_bitrates" elements so this check needs to be >= instead of > or we could read beyond the end of the array. These values come from when we call mt76_register_device(): ret = mt76_register_device(&dev->mt76, true, mt7603_rates, ARRAY_SIZE(mt7603_rates)); Here sband->bitrates[] is mt7603_rates[] and ->n_bitrates is the ARRAY_SIZE() Fixes: 5ce09c1a7907 ("mt76: track rx airtime for airtime fairness and survey") Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo commit 43522b78b590356bf0f83dc3e6b72d93f336b086 Merge: ea200dec5128 210de0e996ae Author: Olof Johansson Date: Wed Dec 18 10:39:10 2019 -0800 Merge tag 'socfpga_dts_fix_for_v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes arm64: dts: agilex/stratix10: fix pmu interrupt numbers - Fix incorrect PMU interrupts numbers on the Agilex/Stratix10 platforms * tag 'socfpga_dts_fix_for_v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm64: dts: agilex/stratix10: fix pmu interrupt numbers Link: https://lore.kernel.org/r/20191218161336.32377-1-dinguyen@kernel.org Signed-off-by: Olof Johansson commit d68f4e43a46ff1f772ff73085f96d44eb4163e9d Author: Arnd Bergmann Date: Mon Dec 16 14:18:42 2019 +0100 mt76: fix LED link time failure The mt76_led_cleanup() function is called unconditionally, which leads to a link error when CONFIG_LEDS is a loadable module or disabled but mt76 is built-in: drivers/net/wireless/mediatek/mt76/mac80211.o: In function `mt76_unregister_device': mac80211.c:(.text+0x2ac): undefined reference to `led_classdev_unregister' Use the same trick that is guarding the registration, using an IS_ENABLED() check for the CONFIG_MT76_LEDS symbol that indicates whether LEDs can be used or not. Fixes: 36f7e2b2bb1d ("mt76: do not use devm API for led classdev") Signed-off-by: Arnd Bergmann Acked-by: Felix Fietkau Signed-off-by: Kalle Valo commit 6056a0f8ede27b296d10ef46f7f677cc9d715371 Author: Guenter Roeck Date: Tue Dec 17 17:19:11 2019 -0800 usb: xhci: Fix build warning seen with CONFIG_PM=n The following build warning is seen if CONFIG_PM is disabled. drivers/usb/host/xhci-pci.c:498:13: warning: unused function 'xhci_pci_shutdown' Fixes: f2c710f7dca8 ("usb: xhci: only set D3hot for pci device") Cc: Henry Lin Cc: stable@vger.kernel.org # all stable releases with f2c710f7dca8 Signed-off-by: Guenter Roeck Acked-by: Mathias Nyman Link: https://lore.kernel.org/r/20191218011911.6907-1-linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman commit c771256ee7a03d3fb3c0443319ae6249c455849d Author: Olof Johansson Date: Wed Dec 18 09:56:21 2019 -0800 clk: Move clk_core_reparent_orphans() under CONFIG_OF A recent addition exposed a helper that is only used for CONFIG_OF. Move it into the CONFIG_OF zone in this file to make the compiler stop warning about an unused function. Fixes: 66d9506440bb ("clk: walk orphan list on clock provider registration") Signed-off-by: Olof Johansson Link: https://lkml.kernel.org/r/20191217082501.424892072D@mail.kernel.org [sboyd@kernel.org: "Simply" move the function instead] Signed-off-by: Stephen Boyd commit 7c504e65206a4379ff38fe41d21b32b6c2c3e53e Author: Pavel Begunkov Date: Wed Dec 18 19:53:45 2019 +0300 io_uring: don't wait when under-submitting There is no reliable way to submit and wait in a single syscall, as io_submit_sqes() may under-consume sqes (in case of an early error). Then it will wait for not-yet-submitted requests, deadlocking the user in most cases. Don't wait/poll if can't submit all sqes Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 80a0c2e511a97e11d82e0ec11564e2c3fe624b0d Merge: 2187f215ebaa 7c497d799267 Author: Linus Torvalds Date: Wed Dec 18 08:54:15 2019 -0800 Merge tag 'sound-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A slightly high amount at this time, but all good and small fixes: - A PCM core fix that initializes the buffer properly for avoiding information leaks; it is a long-standing minor problem, but good to fix better now - A few ASoC core fixes for the init / cleanup ordering issues that surfaced after the recent refactoring - Lots of SOF and topology-related fixes went in, as usual as such hot topics - Several ASoC codec and platform-specific small fixes: wm89xx, realtek, and max98090, AMD, Intel-SST - A fix for the previous incomplete regression of HD-audio, now hitting Nvidia HDMI - A few HD-audio CA0132 codec fixes" * tag 'sound-5.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (27 commits) ALSA: hda - Downgrade error message for single-cmd fallback ASoC: wm8962: fix lambda value ALSA: hda: Fix regression by strip mask fix ALSA: hda/ca0132 - Fix work handling in delayed HP detection ALSA: hda/ca0132 - Avoid endless loop ALSA: hda/ca0132 - Keep power on during processing DSP response ALSA: pcm: Avoid possible info leaks from PCM stream buffers ASoC: Intel: common: work-around incorrect ACPI HID for CML boards ASoC: SOF: Intel: split cht and byt debug window sizes ASoC: SOF: loader: fix snd_sof_fw_parse_ext_data ASoC: SOF: loader: snd_sof_fw_parse_ext_data log warning on unknown header ASoC: simple-card: Don't create separate link when platform is present ASoC: topology: Check return value for soc_tplg_pcm_create() ASoC: topology: Check return value for snd_soc_add_dai_link() ASoC: core: only flush inited work during free ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89 ASoC: core: Init pcm runtime work early to avoid warnings ASoC: Intel: sst: Add missing include ASoC: max98090: fix possible race conditions ASoC: max98090: exit workaround earlier if PLL is locked ... commit f5d5f5fae4605b66fd17e3c46feb14c6c3372e5c Merge: 8715f05269bf 6d674e28f642 Author: Paolo Bonzini Date: Wed Dec 18 17:47:38 2019 +0100 Merge tag 'kvmarm-fixes-5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master KVM/arm fixes for .5.5, take #1 - Fix uninitialised sysreg accessor - Fix handling of demand-paged device mappings - Stop spamming the console on IMPDEF sysregs - Relax mappings of writable memslots - Assorted cleanups commit 8715f05269bfbc6453e25e80825d781a82902f8e Author: Jim Mattson Date: Fri Dec 13 16:15:16 2019 -0800 kvm: x86: Host feature SSBD doesn't imply guest feature AMD_SSBD The host reports support for the synthetic feature X86_FEATURE_SSBD when any of the three following hardware features are set: CPUID.(EAX=7,ECX=0):EDX.SSBD[bit 31] CPUID.80000008H:EBX.AMD_SSBD[bit 24] CPUID.80000008H:EBX.VIRT_SSBD[bit 25] Either of the first two hardware features implies the existence of the IA32_SPEC_CTRL MSR, but CPUID.80000008H:EBX.VIRT_SSBD[bit 25] does not. Therefore, CPUID.80000008H:EBX.AMD_SSBD[bit 24] should only be set in the guest if CPUID.(EAX=7,ECX=0):EDX.SSBD[bit 31] or CPUID.80000008H:EBX.AMD_SSBD[bit 24] is set on the host. Fixes: 4c6903a0f9d76 ("KVM: x86: fix reporting of AMD speculation bug CPUID leaf") Signed-off-by: Jim Mattson Reviewed-by: Jacob Xu Reviewed-by: Peter Shier Cc: Paolo Bonzini Cc: stable@vger.kernel.org Reported-by: Eric Biggers Signed-off-by: Paolo Bonzini commit 396d2e878f92ec108e4293f1c77ea3bc90b414ff Author: Jim Mattson Date: Fri Dec 13 16:15:15 2019 -0800 kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD The host reports support for the synthetic feature X86_FEATURE_SSBD when any of the three following hardware features are set: CPUID.(EAX=7,ECX=0):EDX.SSBD[bit 31] CPUID.80000008H:EBX.AMD_SSBD[bit 24] CPUID.80000008H:EBX.VIRT_SSBD[bit 25] Either of the first two hardware features implies the existence of the IA32_SPEC_CTRL MSR, but CPUID.80000008H:EBX.VIRT_SSBD[bit 25] does not. Therefore, CPUID.(EAX=7,ECX=0):EDX.SSBD[bit 31] should only be set in the guest if CPUID.(EAX=7,ECX=0):EDX.SSBD[bit 31] or CPUID.80000008H:EBX.AMD_SSBD[bit 24] is set on the host. Fixes: 0c54914d0c52a ("KVM: x86: use Intel speculation bugs and features as derived in generic x86 code") Signed-off-by: Jim Mattson Reviewed-by: Jacob Xu Reviewed-by: Peter Shier Cc: Paolo Bonzini Cc: stable@vger.kernel.org Reported-by: Eric Biggers Signed-off-by: Paolo Bonzini commit c18647900ec864d401ba09b3bbd5b34f331f8d26 Author: Robin Murphy Date: Mon Dec 9 19:47:25 2019 +0000 iommu/dma: Relax locking in iommu_dma_prepare_msi() Since commit ece6e6f0218b ("iommu/dma-iommu: Split iommu_dma_map_msi_msg() in two parts"), iommu_dma_prepare_msi() should no longer have to worry about preempting itself, nor being called in atomic context at all. Thus we can downgrade the IRQ-safe locking to a simple mutex to avoid angering the new might_sleep() check in iommu_map(). Reported-by: Qian Cai Tested-by: Jean-Philippe Brucker Signed-off-by: Robin Murphy Signed-off-by: Joerg Roedel commit 8ae4bcf4821c18a8fbfa0b2c1df26c1085e9d923 Author: Hanjun Guo Date: Wed Dec 11 14:43:06 2019 +0800 perf/smmuv3: Remove the leftover put_cpu() in error path In smmu_pmu_probe(), there is put_cpu() in the error path, which is wrong because we use raw_smp_processor_id() to get the cpu ID, not get_cpu(), remove it. While we are at it, kill 'out_cpuhp_err' altogether and just return err if we fail to add the hotplug instance. Acked-by: Robin Murphy Acked-by: Will Deacon Signed-off-by: Hanjun Guo Signed-off-by: Catalin Marinas commit f81b846dcd9a1e6d120f73970a9a98b7fcaaffba Author: Lu Baolu Date: Wed Nov 20 14:10:16 2019 +0800 iommu/vt-d: Remove incorrect PSI capability check The PSI (Page Selective Invalidation) bit in the capability register is only valid for second-level translation. Intel IOMMU supporting scalable mode must support page/address selective IOTLB invalidation for first-level translation. Remove the PSI capability check in SVA cache invalidation code. Fixes: 8744daf4b0699 ("iommu/vt-d: Remove global page flush support") Cc: Jacob Pan Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit c05c403b1d123031f86e65e867be2c2e9ee1e7e3 Author: Jérôme Pouiller Date: Tue Dec 17 16:14:40 2019 +0000 staging: wfx: fix wrong error message The driver checks that the number of retries made by the device is coherent with the rate policy. However, this check make sense only if the device has returned RETRY_EXCEEDED. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-11-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit 632441134d0f7428211cd2e9aa115b5e830b32b3 Author: Jérôme Pouiller Date: Tue Dec 17 16:14:38 2019 +0000 staging: wfx: fix hif_set_mfp() with big endian hosts struct hif_mib_protected_mgmt_policy is an array of u8. There is no reason to swap its bytes. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-10-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit 1a6ae3edcd6ae03a7ea5c08856fe79717d96cfb5 Author: Jérôme Pouiller Date: Tue Dec 17 16:14:37 2019 +0000 staging: wfx: detect race condition in WEP authentication Current code has a special case to handle association with WEP. Before to rework the tx data handling, let's try to detect any possible misuse of this code. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-9-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit 2e12ab7f05093a8595782a598df20455f78a4264 Author: Jérôme Pouiller Date: Tue Dec 17 16:14:36 2019 +0000 staging: wfx: ensure that retry policy always fallbacks to MCS0 / 1Mbps When not using HT mode, minstrel always includes 1Mbps as fallback rate. But, when using HT mode, this fallback is not included. Yet, it seems that it could save some frames. So, this patch add it unconditionally. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-8-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit cefc2033627f922e425e4b624b6a152df4ce29d7 Author: Jérôme Pouiller Date: Tue Dec 17 16:14:34 2019 +0000 staging: wfx: fix rate control handling A tx_retry_policy (the equivalent of a list of ieee80211_tx_rate in hardware API) is not able to include a rate multiple time. So currently, the driver merges the identical rates from the policy provided by minstrel (and it try to do the best choice it can in the associated flags) before to sent it to firmware. Until now, when rates are merged, field "count" is set to max(count1, count2). But, it means that the sum of retries for all rates could be far less than initial number of retries. So, this patch changes the value of field "count" to count1 + count2. Thus, sum of all retries for all rates stay the same. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-7-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit fcde3e6ba57f754dcd87c9d56bb2b05dc1305486 Author: Jérôme Pouiller Date: Tue Dec 17 16:14:33 2019 +0000 staging: wfx: firmware does not support more than 32 total retries The sum of all retries for a Tx frame cannot be superior to 32. There are 4 rates at most. So this patch limits number of retries per rate to 8. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-6-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit d77280311d929887fa11b1c3345953f23c5742e2 Author: Jérôme Pouiller Date: Tue Dec 17 16:14:32 2019 +0000 staging: wfx: use boolean appropriately The field 'uploaded' is used as a boolean, so call it a boolean. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-5-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit 5eee614700e0dc06760bcf5aff840565637cddfc Author: Jérôme Pouiller Date: Tue Dec 17 16:14:30 2019 +0000 staging: wfx: fix counter overflow Some weird behaviors were observed when connection is really good and packets are small. It appears that sometime, number of packets in queues can exceed 255 and generate an overflow in field usage_count. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-4-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit 89606bb3a9286a64bcdc2e58552edf6e2478c3bc Author: Jérôme Pouiller Date: Tue Dec 17 16:14:29 2019 +0000 staging: wfx: fix case of lack of tx_retry_policies In some rare cases, driver may not have any available tx_retry_policies. In this case, the driver asks to mac80211 to stop sending data. However, it seems that a race is possible and a few frames can be sent to the driver. In this case, driver can't wait for free tx_retry_policies since wfx_tx() must be atomic. So, this patch fix this case by sending these frames with the special policy number 15. The firmware normally use policy 15 to send internal frames (PS-poll, beacons, etc...). So, it is not a so bad fallback. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-3-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit b0ac999ebe37c931e76fbdffffd7a5b77b2d788e Author: Jérôme Pouiller Date: Tue Dec 17 16:14:27 2019 +0000 staging: wfx: fix the cache of rate policies on interface reset Device and driver maintain a cache of rate policies (aka. tx_retry_policy in hardware API). When hif_reset() is sent to hardware, device resets its cache of rate policies. In order to keep driver in sync, it is necessary to do the same on driver. Note, when driver tries to use a rate policy that has not been defined on device, data is sent at 1Mbps. So, this patch should fix abnormal throughput observed sometime after a reset of the interface. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20191217161318.31402-2-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman commit fe4e940f0f91b4a506f048b42e00386f5ad322b6 Author: Jason Gerecke Date: Mon Dec 16 10:18:57 2019 -0800 HID: wacom: Recognize new MobileStudio Pro PID A new PID is in use for repaired MobileStudio Pro devices. Add it to the list of devices that need special-casing in wacom_wac_pad_event. Signed-off-by: Jason Gerecke Signed-off-by: Benjamin Tissoires commit abb33ee8a8c0d146b4b2c52937dc86a15ec92d05 Author: Even Xu Date: Tue Dec 17 09:11:18 2019 +0800 HID: intel-ish-hid: ipc: add CMP device id Add Comet Lake H into ishtp support list. Signed-off-by: Even Xu Acked-by: Srinivas Pandruvada Signed-off-by: Benjamin Tissoires commit 18a1b06e5b91d47dc86c0a66a762646ea7c5d141 Author: Dmitry Torokhov Date: Tue Dec 17 14:50:21 2019 -0800 HID: hiddev: fix mess in hiddev_open() The open method of hiddev handler fails to bring the device out of autosuspend state as was promised in 0361a28d3f9a, as it actually has 2 blocks that try to start the transport (call hid_hw_open()) with both being guarded by the "open" counter, so the 2nd block is never executed as the first block increments the counter so it is never at 0 when we check it for the second block. Additionally hiddev_open() was leaving counter incremented on errors, causing the device to never be reopened properly if there was ever an error. Let's fix all of this by factoring out code that creates client structure and powers up the device into a separate function that is being called from usbhid_open() with the "existancelock" being held. Fixes: 0361a28d3f9a ("HID: autosuspend support for USB HID") Signed-off-by: Dmitry Torokhov Signed-off-by: Benjamin Tissoires commit 8f268881d7d278047b00eed54bbb9288dbd6ab23 Author: Masahiro Yamada Date: Tue Dec 17 20:51:51 2019 +0900 kconfig: remove ---help--- from documentation Since commit 84af7a6194e4 ("checkpatch: kconfig: prefer 'help' over '---help---'"), scripts/checkpatch.pl warns the use of ---help---. Kconfig still supports ---help---, but new code should avoid using it. Let's stop advertising it in documentation. Signed-off-by: Masahiro Yamada commit 75d27ea1abf7af3cc2cdec3513e74f52191605c8 Author: Adrian Hunter Date: Tue Dec 17 11:53:49 2019 +0200 mmc: sdhci: Add a quirk for broken command queuing Command queuing has been reported broken on some systems based on Intel GLK. A separate patch disables command queuing in some cases. This patch adds a quirk for broken command queuing, which enables users with problems to disable command queuing using sdhci module parameters for quirks. Fixes: 8ee82bda230f ("mmc: sdhci-pci: Add CQHCI support for Intel GLK") Signed-off-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191217095349.14592-2-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit bedf9fc01ff1f40cfd1a79ccacedd9f3cd8e652a Author: Adrian Hunter Date: Tue Dec 17 11:53:48 2019 +0200 mmc: sdhci: Workaround broken command queuing on Intel GLK Command queuing has been reported broken on some Lenovo systems based on Intel GLK. This is likely a BIOS issue, so disable command queuing for Intel GLK if the BIOS vendor string is "LENOVO". Fixes: 8ee82bda230f ("mmc: sdhci-pci: Add CQHCI support for Intel GLK") Signed-off-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191217095349.14592-1-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit fe0acab448f68c3146235afe03fb932e242ec94c Author: Yangbo Lu Date: Mon Dec 16 11:18:42 2019 +0800 mmc: sdhci-of-esdhc: fix P2020 errata handling Two previous patches introduced below quirks for P2020 platforms. - SDHCI_QUIRK_RESET_AFTER_REQUEST - SDHCI_QUIRK_BROKEN_TIMEOUT_VAL The patches made a mistake to add them in quirks2 of sdhci_host structure, while they were defined for quirks. host->quirks2 |= SDHCI_QUIRK_RESET_AFTER_REQUEST; host->quirks2 |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; This patch is to fix them. host->quirks |= SDHCI_QUIRK_RESET_AFTER_REQUEST; host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; Fixes: 05cb6b2a66fa ("mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support") Fixes: a46e42712596 ("mmc: sdhci-of-esdhc: add erratum eSDHC5 support") Signed-off-by: Yangbo Lu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191216031842.40068-1-yangbo.lu@nxp.com Signed-off-by: Ulf Hansson commit 78d75f5739c457ff37cfe5adab1c01bc1f3375e2 Merge: f0f3a6cecf3b 5e822e44cece Author: Joonas Lahtinen Date: Wed Dec 18 11:01:41 2019 +0200 Merge tag 'gvt-fixes-2019-12-18' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2019-12-18 - vGPU state setting locking fix (Zhenyu) - Fix vGPU display dmabuf as read-only (Zhenyu) - Properly handle vGPU display dmabuf page pin when rendering (Tina) - Fix one guest boot warning to handle guc reset state (Fred) Signed-off-by: Joonas Lahtinen From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20191218051657.GA21662@zhen-hp.sh.intel.com commit f0f3a6cecf3b98990985cd42f7bf5a0313894822 Author: Tvrtko Ursulin Date: Tue Dec 17 17:09:33 2019 +0000 drm/i915: Fix pid leak with banned clients Get_pid_task() needs to be paired with a put_pid or we leak a pid reference every time a banned client tries to create a context. v2: * task_pid_nr helper exists! (Chris) Signed-off-by: Tvrtko Ursulin Fixes: b083a0870c79 ("drm/i915: Add per client max context ban limit") Cc: Chris Wilson Cc: Mika Kuoppala Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20191217170933.8108-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit ba16a48af797db124ac100417f9229b1650ce1fb) Signed-off-by: Joonas Lahtinen commit a76cf56920966a384b578f7b099bd1f073cc2a92 Author: Chris Wilson Date: Tue Dec 17 13:47:29 2019 +0000 drm/i915/gem: Keep request alive while attaching fences Since commit e5dadff4b093 ("drm/i915: Protect request retirement with timeline->mutex"), the request retirement can happen outside of the struct_mutex serialised only by the timeline->mutex. We drop the timeline->mutex on submitting the request (i915_request_add) so after that point, it is liable to be freed. Make sure our local reference is kept alive until we have finished attaching it to the signalers. (Note that this erodes the argument that i915_request_add should consume the reference, but that is a slightly larger patch!) Fixes: e5dadff4b093 ("drm/i915: Protect request retirement with timeline->mutex") Signed-off-by: Chris Wilson Cc: Matthew Auld Cc: Tvrtko Ursulin Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20191217134729.3297818-1-chris@chris-wilson.co.uk (cherry picked from commit e14177f19739d74839eb496a27f5f5d958beaa5b) Signed-off-by: Joonas Lahtinen commit ddd9b5e3e765d8ed5a35786a6cb00111713fe161 Author: Jouni Hogander Date: Tue Dec 17 13:46:34 2019 +0200 net-sysfs: Call dev_hold always in rx_queue_add_kobject Dev_hold has to be called always in rx_queue_add_kobject. Otherwise usage count drops below 0 in case of failure in kobject_init_and_add. Fixes: b8eb718348b8 ("net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject") Reported-by: syzbot Cc: Tetsuo Handa Cc: David Miller Cc: Lukas Bulwahn Signed-off-by: Jouni Hogander Signed-off-by: David S. Miller commit 39f14c00b13c47186739a4cbc7a16e04d7fdbb60 Author: John Hurley Date: Tue Dec 17 11:28:56 2019 +0000 nfp: flower: fix stats id allocation As flower rules are added, they are given a stats ID based on the number of rules that can be supported in firmware. Only after the initial allocation of all available IDs does the driver begin to reuse those that have been released. The initial allocation of IDs was modified to account for multiple memory units on the offloaded device. However, this introduced a bug whereby the counter that controls the IDs could be decremented before the ID was assigned (where it is further decremented). This means that the stats ID could be assigned as -1/0xfffffff which is out of range. Fix this by only decrementing the main counter after the current ID has been assigned. Fixes: 467322e2627f ("nfp: flower: support multiple memory units for filter offloads") Signed-off-by: John Hurley Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 4e2ce6e55050125d313408770d20dbf387dfc79c Author: Ben Dooks (Codethink) Date: Tue Dec 17 11:20:38 2019 +0000 net: dsa: make unexported dsa_link_touch() static dsa_link_touch() is not exported, or defined outside of the file it is in so make it static to avoid the following warning: net/dsa/dsa2.c:127:17: warning: symbol 'dsa_link_touch' was not declared. Should it be static? Signed-off-by: Ben Dooks (Codethink) Signed-off-by: David S. Miller commit 9d4b98af8a2eb2ddb7779f2929700b5c174e9cc9 Author: Oleksij Rempel Date: Tue Dec 17 07:51:45 2019 +0100 net: ag71xx: fix compile warnings drivers/net/ethernet/atheros/ag71xx.c: In function 'ag71xx_probe': drivers/net/ethernet/atheros/ag71xx.c:1776:30: warning: passing argument 2 of 'of_get_phy_mode' makes pointer from integer without a cast [-Wint-conversion] In file included from drivers/net/ethernet/atheros/ag71xx.c:33: ./include/linux/of_net.h:15:69: note: expected 'phy_interface_t *' {aka 'enum *'} but argument is of type 'int' Fixes: 0c65b2b90d13c1 ("net: of_get_phy_mode: Change API to solve int/unit warnings") Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 1f26c0d3d24125992ab0026b0dab16c08df947c7 Author: Randy Dunlap Date: Mon Dec 16 18:52:45 2019 -0800 net: fix kernel-doc warning in Fix missing '*' kernel-doc notation that causes this warning: ../include/linux/netdevice.h:1779: warning: bad line: spinlock Fixes: ab92d68fc22f ("net: core: add generic lockdep keys") Signed-off-by: Randy Dunlap Cc: Taehee Yoo Signed-off-by: David S. Miller commit 7c68fa2bddda6d942bd387c9ba5b4300737fd991 Author: Eric Dumazet Date: Mon Dec 16 18:51:03 2019 -0800 net: annotate lockless accesses to sk->sk_pacing_shift sk->sk_pacing_shift can be read and written without lock synchronization. This patch adds annotations to document this fact and avoid future syzbot complains. This might also avoid unexpected false sharing in sk_pacing_shift_update(), as the compiler could remove the conditional check and always write over sk->sk_pacing_shift : if (sk->sk_pacing_shift != val) sk->sk_pacing_shift = val; Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit cad46039e4c99812db067c8ac22a864960e7acc4 Author: Ben Hutchings Date: Tue Dec 17 01:57:40 2019 +0000 net: qlogic: Fix error paths in ql_alloc_large_buffers() ql_alloc_large_buffers() has the usual RX buffer allocation loop where it allocates skbs and maps them for DMA. It also treats failure as a fatal error. There are (at least) three bugs in the error paths: 1. ql_free_large_buffers() assumes that the lrg_buf[] entry for the first buffer that couldn't be allocated will have .skb == NULL. But the qla_buf[] array is not zero-initialised. 2. ql_free_large_buffers() DMA-unmaps all skbs in lrg_buf[]. This is incorrect for the last allocated skb, if DMA mapping failed. 3. Commit 1acb8f2a7a9f ("net: qlogic: Fix memory leak in ql_alloc_large_buffers") added a direct call to dev_kfree_skb_any() after the skb is recorded in lrg_buf[], so ql_free_large_buffers() will double-free it. The bugs are somewhat inter-twined, so fix them all at once: * Clear each entry in qla_buf[] before attempting to allocate an skb for it. This goes half-way to fixing bug 1. * Set the .skb field only after the skb is DMA-mapped. This fixes the rest. Fixes: 1357bfcf7106 ("qla3xxx: Dynamically size the rx buffer queue ...") Fixes: 0f8ab89e825f ("qla3xxx: Check return code from pci_map_single() ...") Fixes: 1acb8f2a7a9f ("net: qlogic: Fix memory leak in ql_alloc_large_buffers") Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller commit 951c6db954a1adefab492f6da805decacabbd1a7 Author: Marcelo Ricardo Leitner Date: Mon Dec 16 22:01:16 2019 -0300 sctp: fix memleak on err handling of stream initialization syzbot reported a memory leak when an allocation fails within genradix_prealloc() for output streams. That's because genradix_prealloc() leaves initialized members initialized when the issue happens and SCTP stack will abort the current initialization but without cleaning up such members. The fix here is to always call genradix_free() when genradix_prealloc() fails, for output and also input streams, as it suffers from the same issue. Reported-by: syzbot+772d9e36c490b18d51d1@syzkaller.appspotmail.com Fixes: 2075e50caf5e ("sctp: convert to genradix") Signed-off-by: Marcelo Ricardo Leitner Tested-by: Xin Long Signed-off-by: David S. Miller commit 1edc8eb2e93130e36ac74ac9c80913815a57d413 Author: Eric Sandeen Date: Fri Dec 6 10:55:59 2019 -0600 fs: call fsnotify_sb_delete after evict_inodes When a filesystem is unmounted, we currently call fsnotify_sb_delete() before evict_inodes(), which means that fsnotify_unmount_inodes() must iterate over all inodes on the superblock looking for any inodes with watches. This is inefficient and can lead to livelocks as it iterates over many unwatched inodes. At this point, SB_ACTIVE is gone and dropping refcount to zero kicks the inode out out immediately, so anything processed by fsnotify_sb_delete / fsnotify_unmount_inodes gets evicted in that loop. After that, the call to evict_inodes will evict everything else with a zero refcount. This should speed things up overall, and avoid livelocks in fsnotify_unmount_inodes(). Signed-off-by: Eric Sandeen Reviewed-by: Jan Kara Signed-off-by: Al Viro commit 04646aebd30b99f2cfa0182435a2ec252fcb16d0 Author: Eric Sandeen Date: Fri Dec 6 10:54:23 2019 -0600 fs: avoid softlockups in s_inodes iterators Anything that walks all inodes on sb->s_inodes list without rescheduling risks softlockups. Previous efforts were made in 2 functions, see: c27d82f fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() ac05fbb inode: don't softlockup when evicting inodes but there hasn't been an audit of all walkers, so do that now. This also consistently moves the cond_resched() calls to the bottom of each loop in cases where it already exists. One loop remains: remove_dquot_ref(), because I'm not quite sure how to deal with that one w/o taking the i_lock. Signed-off-by: Eric Sandeen Reviewed-by: Jan Kara Signed-off-by: Al Viro commit 045f6d7942be248fbda6e85b2393f2735695ed39 Author: Changbin Du Date: Tue Dec 17 20:51:56 2019 -0800 lib/Kconfig.debug: fix some messed up configurations Some configuration items are messed up during conflict resolving. For example, STRICT_DEVMEM should not in testing menu, but kunit should. This patch fixes all of them. [akpm@linux-foundation.org: coding style fixes] Link: http://lkml.kernel.org/r/20191209155653.7509-1-changbin.du@gmail.com Signed-off-by: Changbin Du Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 42a9a53bb394a1de2247ef78f0b802ae86798122 Author: Yang Shi Date: Tue Dec 17 20:51:52 2019 -0800 mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG Since commit 0a432dcbeb32 ("mm: shrinker: make shrinker not depend on memcg kmem"), shrinkers' idr is protected by CONFIG_MEMCG instead of CONFIG_MEMCG_KMEM, so it makes no sense to protect shrinker idr replace with CONFIG_MEMCG_KMEM. And in the CONFIG_MEMCG && CONFIG_SLOB case, shrinker_idr contains only shrinker, and it is deferred_split_shrinker. But it is never actually called, since idr_replace() is never compiled due to the wrong #ifdef. The deferred_split_shrinker all the time is staying in half-registered state, and it's never called for subordinate mem cgroups. Link: http://lkml.kernel.org/r/1575486978-45249-1-git-send-email-yang.shi@linux.alibaba.com Fixes: 0a432dcbeb32 ("mm: shrinker: make shrinker not depend on memcg kmem") Signed-off-by: Yang Shi Reviewed-by: Kirill Tkhai Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Shakeel Butt Cc: Roman Gushchin Cc: [5.4+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 253a496d8e57275d458eb3c988470525b0b2c545 Author: Daniel Axtens Date: Tue Dec 17 20:51:49 2019 -0800 kasan: don't assume percpu shadow allocations will succeed syzkaller and the fault injector showed that I was wrong to assume that we could ignore percpu shadow allocation failures. Handle failures properly. Merge all the allocated areas back into the free list and release the shadow, then clean up and return NULL. The shadow is released unconditionally, which relies upon the fact that the release function is able to tolerate pages not being present. Also clean up shadows in the recovery path - currently they are not released, which leaks a bit of memory. Link: http://lkml.kernel.org/r/20191205140407.1874-3-dja@axtens.net Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") Signed-off-by: Daniel Axtens Reported-by: syzbot+82e323920b78d54aaed5@syzkaller.appspotmail.com Reported-by: syzbot+59b7daa4315e07a994f1@syzkaller.appspotmail.com Reviewed-by: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Qian Cai Cc: Uladzislau Rezki (Sony) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e218f1ca3971e5bcaae1fe8e6f007f9a206e32e9 Author: Daniel Axtens Date: Tue Dec 17 20:51:46 2019 -0800 kasan: use apply_to_existing_page_range() for releasing vmalloc shadow kasan_release_vmalloc uses apply_to_page_range to release vmalloc shadow. Unfortunately, apply_to_page_range can allocate memory to fill in page table entries, which is not what we want. Also, kasan_release_vmalloc is called under free_vmap_area_lock, so if apply_to_page_range does allocate memory, we get a sleep in atomic bug: BUG: sleeping function called from invalid context at mm/page_alloc.c:4681 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15087, name: Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x199/0x216 lib/dump_stack.c:118 ___might_sleep.cold.97+0x1f5/0x238 kernel/sched/core.c:6800 __might_sleep+0x95/0x190 kernel/sched/core.c:6753 prepare_alloc_pages mm/page_alloc.c:4681 [inline] __alloc_pages_nodemask+0x3cd/0x890 mm/page_alloc.c:4730 alloc_pages_current+0x10c/0x210 mm/mempolicy.c:2211 alloc_pages include/linux/gfp.h:532 [inline] __get_free_pages+0xc/0x40 mm/page_alloc.c:4786 __pte_alloc_one_kernel include/asm-generic/pgalloc.h:21 [inline] pte_alloc_one_kernel include/asm-generic/pgalloc.h:33 [inline] __pte_alloc_kernel+0x1d/0x200 mm/memory.c:459 apply_to_pte_range mm/memory.c:2031 [inline] apply_to_pmd_range mm/memory.c:2068 [inline] apply_to_pud_range mm/memory.c:2088 [inline] apply_to_p4d_range mm/memory.c:2108 [inline] apply_to_page_range+0x77d/0xa00 mm/memory.c:2133 kasan_release_vmalloc+0xa7/0xc0 mm/kasan/common.c:970 __purge_vmap_area_lazy+0xcbb/0x1f30 mm/vmalloc.c:1313 try_purge_vmap_area_lazy mm/vmalloc.c:1332 [inline] free_vmap_area_noflush+0x2ca/0x390 mm/vmalloc.c:1368 free_unmap_vmap_area mm/vmalloc.c:1381 [inline] remove_vm_area+0x1cc/0x230 mm/vmalloc.c:2209 vm_remove_mappings mm/vmalloc.c:2236 [inline] __vunmap+0x223/0xa20 mm/vmalloc.c:2299 __vfree+0x3f/0xd0 mm/vmalloc.c:2356 __vmalloc_area_node mm/vmalloc.c:2507 [inline] __vmalloc_node_range+0x5d5/0x810 mm/vmalloc.c:2547 __vmalloc_node mm/vmalloc.c:2607 [inline] __vmalloc_node_flags mm/vmalloc.c:2621 [inline] vzalloc+0x6f/0x80 mm/vmalloc.c:2666 alloc_one_pg_vec_page net/packet/af_packet.c:4233 [inline] alloc_pg_vec net/packet/af_packet.c:4258 [inline] packet_set_ring+0xbc0/0x1b50 net/packet/af_packet.c:4342 packet_setsockopt+0xed7/0x2d90 net/packet/af_packet.c:3695 __sys_setsockopt+0x29b/0x4d0 net/socket.c:2117 __do_sys_setsockopt net/socket.c:2133 [inline] __se_sys_setsockopt net/socket.c:2130 [inline] __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2130 do_syscall_64+0xfa/0x780 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Switch to using the apply_to_existing_page_range() helper instead, which won't allocate memory. [akpm@linux-foundation.org: s/apply_to_existing_pages/apply_to_existing_page_range/] Link: http://lkml.kernel.org/r/20191205140407.1874-2-dja@axtens.net Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") Signed-off-by: Daniel Axtens Reported-by: Dmitry Vyukov Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Qian Cai Cc: Uladzislau Rezki (Sony) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit be1db4753ee6a0db80a900df9dbbf6ad2acc4bd1 Author: Daniel Axtens Date: Tue Dec 17 20:51:41 2019 -0800 mm/memory.c: add apply_to_existing_page_range() helper apply_to_page_range() takes an address range, and if any parts of it are not covered by the existing page table hierarchy, it allocates memory to fill them in. In some use cases, this is not what we want - we want to be able to operate exclusively on PTEs that are already in the tables. Add apply_to_existing_page_range() for this. Adjust the walker functions for apply_to_page_range to take 'create', which switches them between the old and new modes. This will be used in KASAN vmalloc. [akpm@linux-foundation.org: reduce code duplication] [akpm@linux-foundation.org: s/apply_to_existing_pages/apply_to_existing_page_range/] [akpm@linux-foundation.org: initialize __apply_to_page_range::err] Link: http://lkml.kernel.org/r/20191205140407.1874-1-dja@axtens.net Signed-off-by: Daniel Axtens Cc: Dmitry Vyukov Cc: Uladzislau Rezki (Sony) Cc: Alexander Potapenko Cc: Daniel Axtens Cc: Qian Cai Cc: Andrey Ryabinin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d98c9e83b5e7ca78175df1b13ac4a6d460d3962d Author: Andrey Ryabinin Date: Tue Dec 17 20:51:38 2019 -0800 kasan: fix crashes on access to memory mapped by vm_map_ram() With CONFIG_KASAN_VMALLOC=y any use of memory obtained via vm_map_ram() will crash because there is no shadow backing that memory. Instead of sprinkling additional kasan_populate_vmalloc() calls all over the vmalloc code, move it into alloc_vmap_area(). This will fix vm_map_ram() and simplify the code a bit. [aryabinin@virtuozzo.com: v2] Link: http://lkml.kernel.org/r/20191205095942.1761-1-aryabinin@virtuozzo.comLink: http://lkml.kernel.org/r/20191204204534.32202-1-aryabinin@virtuozzo.com Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") Signed-off-by: Andrey Ryabinin Reported-by: Dmitry Vyukov Reviewed-by: Uladzislau Rezki (Sony) Cc: Daniel Axtens Cc: Alexander Potapenko Cc: Daniel Axtens Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d89c69f42bf0fe42d1f52ea9b3dca15b1ade7601 Author: Paul Mackerras Date: Wed Dec 18 11:43:06 2019 +1100 KVM: PPC: Book3S HV: Don't do ultravisor calls on systems without ultravisor Commit 22945688acd4 ("KVM: PPC: Book3S HV: Support reset of secure guest") added a call to uv_svm_terminate, which is an ultravisor call, without any check that the guest is a secure guest or even that the system has an ultravisor. On a system without an ultravisor, the ultracall will degenerate to a hypercall, but since we are not in KVM guest context, the hypercall will get treated as a system call, which could have random effects depending on what happens to be in r0, and could also corrupt the current task's kernel stack. Hence this adds a test for the guest being a secure guest before doing uv_svm_terminate(). Fixes: 22945688acd4 ("KVM: PPC: Book3S HV: Support reset of secure guest") Signed-off-by: Paul Mackerras commit e781573e2fb1b75acdba61dcb9bcbfc16f288442 Author: Jens Axboe Date: Tue Dec 17 19:45:06 2019 -0700 io_uring: warn about unhandled opcode Now that we have all the opcodes handled in terms of command prep and SQE reuse, add a printk_once() to warn about any potentially new and unhandled ones. Signed-off-by: Jens Axboe commit d625c6ee4975000140c57da7e1ff244efefde274 Author: Jens Axboe Date: Tue Dec 17 19:53:05 2019 -0700 io_uring: read opcode and user_data from SQE exactly once If we defer a request, we can't be reading the opcode again. Ensure that the user_data and opcode fields are stable. For the user_data we already have a place for it, for the opcode we can fill a one byte hold and store that as well. For both of them, assign them when we originally read the SQE in io_get_sqring(). Any code that uses sqe->opcode or sqe->user_data is switched to req->opcode and req->user_data. Signed-off-by: Jens Axboe commit b29472ee7b53784f44011069fad15e539fd25bcf Author: Jens Axboe Date: Tue Dec 17 18:50:29 2019 -0700 io_uring: make IORING_OP_TIMEOUT_REMOVE deferrable If we defer this command as part of a link, we have to make sure that the SQE data has been read upfront. Integrate the timeout remove op into the prep handling to make it safe for SQE reuse. Signed-off-by: Jens Axboe commit fbf23849b1724d3ea362e346d0877a8d87978fe6 Author: Jens Axboe Date: Tue Dec 17 18:45:56 2019 -0700 io_uring: make IORING_OP_CANCEL_ASYNC deferrable If we defer this command as part of a link, we have to make sure that the SQE data has been read upfront. Integrate the async cancel op into the prep handling to make it safe for SQE reuse. Signed-off-by: Jens Axboe commit 0969e783e3a8913f79df27286501a6c21e961524 Author: Jens Axboe Date: Tue Dec 17 18:40:57 2019 -0700 io_uring: make IORING_POLL_ADD and IORING_POLL_REMOVE deferrable If we defer these commands as part of a link, we have to make sure that the SQE data has been read upfront. Integrate the poll add/remove into the prep handling to make it safe for SQE reuse. Signed-off-by: Jens Axboe commit ffbb8d6b76910d4f3a2bafeaf68c419011e98d05 Author: Pavel Begunkov Date: Tue Dec 17 20:57:05 2019 +0300 io_uring: make HARDLINK imply LINK The rules are as follows, if IOSQE_IO_HARDLINK is specified, then it's a link and there is no need to set IOSQE_IO_LINK separately, though it could be there. Add proper check and ensure that IOSQE_IO_HARDLINK implies IOSQE_IO_LINK. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 8ed8d3c3bc32bf5b442c9f54013b4a47d5cae740 Author: Jens Axboe Date: Mon Dec 16 11:55:28 2019 -0700 io_uring: any deferred command must have stable sqe data We're currently not retaining sqe data for accept, fsync, and sync_file_range. None of these commands need data outside of what is directly provided, hence it can't go stale when the request is deferred. However, it can get reused, if an application reuses SQE entries. Ensure that we retain the information we need and only read the sqe contents once, off the submission path. Most of this is just moving code into a prep and finish function. Signed-off-by: Jens Axboe commit fc4df999e24fc3006441acd4ce6250e6a76ac851 Author: Jens Axboe Date: Tue Dec 10 14:38:45 2019 -0700 io_uring: remove 'sqe' parameter to the OP helpers that take it We pass in req->sqe for all of them, no need to pass it in as the request is always passed in. This is a necessary prep patch to be able to cleanup/fix the request prep path. Signed-off-by: Jens Axboe commit b7bb4f7da0a1a92f142697f1c9ce335e7a44f4b1 Author: Jens Axboe Date: Sun Dec 15 22:13:43 2019 -0700 io_uring: fix pre-prepped issue with force_nonblock == true Some of these code paths assume that any force_nonblock == true issue is not prepped, but that's not true if we did prep as part of link setup earlier. Check if we already have an async context allocate before setting up a new one. Cleanup the async context setup in general, we have a lot of duplicated code there. Fixes: 03b1230ca12a ("io_uring: ensure async punted sendmsg/recvmsg requests copy data") Fixes: f67676d160c6 ("io_uring: ensure async punted read/write requests copy iovec") Signed-off-by: Jens Axboe commit 525b305d61ede489ce2118b000a5dabd6d869dac Author: Jens Axboe Date: Tue Dec 17 14:13:37 2019 -0700 io-wq: re-add io_wq_current_is_worker() This reverts commit 8cdda87a4414, we now have several use csaes for this helper. Reinstate it. Signed-off-by: Jens Axboe commit dbce0b65046d1735d7054c54ec2387dba84ba258 Author: Rob Herring Date: Tue Dec 17 10:27:12 2019 -0600 dt-bindings: Add missing 'properties' keyword enclosing 'snps,tso' DT property definitions must be under a 'properties' keyword. This was missing for 'snps,tso' in an if/then clause. A meta-schema fix will catch future errors like this. Fixes: 7db3545aef5f ("dt-bindings: net: stmmac: Convert the binding to a schemas") Cc: "David S. Miller" Acked-by: Maxime Ripard Signed-off-by: Rob Herring commit 03729cfa0d543bc996bf959e762ec999afc8f3d2 Author: Dave Gerlach Date: Wed Dec 11 22:03:14 2019 -0600 soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot Any user of wkup_m3_ipc calls wkup_m3_ipc_get to get a handle and this checks the value of the static variable m3_ipc_state to see if the wkup_m3 is ready. Currently this is populated during probe before rproc_boot has been called, meaning there is a window of time that wkup_m3_ipc_get can return a valid handle but the wkup_m3 itself is not ready, leading to invalid IPC calls to the wkup_m3 and system instability. To avoid this, move the population of the m3_ipc_state variable until after rproc_boot has succeeded to guarantee a valid and usable handle is always returned. Reported-by: Suman Anna Signed-off-by: Dave Gerlach Acked-by: Santosh Shilimkar Signed-off-by: Tony Lindgren commit e17e7c498d4f734df93c300441e100818ed58168 Author: Kishon Vijay Abraham I Date: Tue Dec 17 14:21:24 2019 +0530 ARM: dts: beagle-x15-common: Model 5V0 regulator On am57xx-beagle-x15, 5V0 is connected to P16, P17, P18 and P19 connectors. On am57xx-evm, 5V0 regulator is used to get 3V6 regulator which is connected to the COMQ port. Model 5V0 regulator here in order for it to be used in am57xx-evm to model 3V6 regulator. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Tony Lindgren commit 040cda8a15210f19da7e29232c897ca6ca6cc950 Merge: daa6eb5a1495 0df36b90c47d Author: David S. Miller Date: Tue Dec 17 14:27:35 2019 -0800 Merge tag 'wireless-drivers-2019-12-17' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for v5.5 First set of fixes for v5.5. Fixing security issues, some regressions and few major bugs. mwifiex * security fix for handling country Information Elements (CVE-2019-14895) * security fix for handling TDLS Information Elements ath9k * fix endian issue with ath9k_pci_owl_loader mt76 * fix default mac address handling iwlwifi * fix merge damage which lead to firmware crashing during boot on some devices * fix device initialisation regression on some devices ==================== Signed-off-by: David S. Miller commit daa6eb5a149519583c8a8cb31945f06417d21902 Author: Ioana Ciornei Date: Mon Dec 16 17:32:30 2019 +0200 dpaa2-ptp: fix double free of the ptp_qoriq IRQ Upon reusing the ptp_qoriq driver, the ptp_qoriq_free() function was used on the remove path to free any allocated resources. The ptp_qoriq IRQ is among these resources that are freed in ptp_qoriq_free() even though it is also a managed one (allocated using devm_request_threaded_irq). Drop the resource managed version of requesting the IRQ in order to not trigger a double free of the interrupt as below: [ 226.731005] Trying to free already-free IRQ 126 [ 226.735533] WARNING: CPU: 6 PID: 749 at kernel/irq/manage.c:1707 __free_irq+0x9c/0x2b8 [ 226.743435] Modules linked in: [ 226.746480] CPU: 6 PID: 749 Comm: bash Tainted: G W 5.4.0-03629-gfd7102c32b2c-dirty #912 [ 226.755857] Hardware name: NXP Layerscape LX2160ARDB (DT) [ 226.761244] pstate: 40000085 (nZcv daIf -PAN -UAO) [ 226.766022] pc : __free_irq+0x9c/0x2b8 [ 226.769758] lr : __free_irq+0x9c/0x2b8 [ 226.773493] sp : ffff8000125039f0 (...) [ 226.856275] Call trace: [ 226.858710] __free_irq+0x9c/0x2b8 [ 226.862098] free_irq+0x30/0x70 [ 226.865229] devm_irq_release+0x14/0x20 [ 226.869054] release_nodes+0x1b0/0x220 [ 226.872790] devres_release_all+0x34/0x50 [ 226.876790] device_release_driver_internal+0x100/0x1c0 Fixes: d346c9e86d86 ("dpaa2-ptp: reuse ptp_qoriq driver") Cc: Yangbo Lu Signed-off-by: Ioana Ciornei Reviewed-by: Yangbo Lu Signed-off-by: David S. Miller commit 2187f215ebaac73ddbd814696d7c7fa34f0c3de0 Merge: 2d3145f8d280 fbd542971aa1 Author: Linus Torvalds Date: Tue Dec 17 13:27:02 2019 -0800 Merge tag 'for-5.5-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A mix of regression fixes and regular fixes for stable trees: - fix swapped error messages for qgroup enable/rescan - fixes for NO_HOLES feature with clone range - fix deadlock between iget/srcu lock/synchronize srcu while freeing an inode - fix double lock on subvolume cross-rename - tree log fixes * fix missing data checksums after replaying a log tree * also teach tree-checker about this problem * skip log replay on orphaned roots - fix maximum devices constraints for RAID1C -3 and -4 - send: don't print warning on read-only mount regarding orphan cleanup - error handling fixes" * tag 'for-5.5-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: send: remove WARN_ON for readonly mount btrfs: do not leak reloc root if we fail to read the fs root btrfs: skip log replay on orphaned roots btrfs: handle ENOENT in btrfs_uuid_tree_iterate btrfs: abort transaction after failed inode updates in create_subvol Btrfs: fix hole extent items with a zero size after range cloning Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues Btrfs: make tree checker detect checksum items with overlapping ranges Btrfs: fix missing data checksums after replaying a log tree btrfs: return error pointer from alloc_test_extent_buffer btrfs: fix devs_max constraints for raid1c3 and raid1c4 btrfs: tree-checker: Fix error format string for size_t btrfs: don't double lock the subvol_sem for rename exchange btrfs: handle error in btrfs_cache_block_group btrfs: do not call synchronize_srcu() in inode_tree_del Btrfs: fix cloning range with a hole when using the NO_HOLES feature btrfs: Fix error messages in qgroup_rescan_init commit 2d3145f8d2809592ef803a30c8a342b5a9e2de9a Author: Linus Torvalds Date: Tue Dec 17 13:10:11 2019 -0800 early init: fix error handling when opening /dev/console The comment says "this should never fail", but it definitely can fail when you have odd initial boot filesystems, or kernel configurations. So get the error handling right: filp_open() returns an error pointer. Reported-by: Jesse Barnes Reported-by: youling 257 Fixes: 8243186f0cc7 ("fs: remove ksys_dup()") Cc: Dominik Brodowski Signed-off-by: Linus Torvalds commit 58d90a04bdcc28e1b34251f4d9c1c4d39d4bba69 Merge: a922f1a9aec1 62a1923cc8fe Author: Linus Torvalds Date: Tue Dec 17 13:08:41 2019 -0800 Merge tag 'regulator-fix-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A small set of fixes for mostly minor issues here, the only real code ones are Wen Yang's fixes for error handling in the core and Christian Marussi's list_voltage() change which is a fix for disruptively bad performance for regulators with continuous voltage control (which are rare)" * tag 'regulator-fix-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: rn5t618: fix module aliases regulator: max77650: add of_match table regulator: core: avoid unneeded .list_voltage calls regulator: s5m8767: Fix a warning message regulator: core: fix regulator_register() error paths to properly release rdev regulator: fix use after free issue commit a922f1a9aec1102a94505622290c0ecf4ef79cec Merge: 9065e0636036 63aa6a692595 Author: Linus Torvalds Date: Tue Dec 17 13:06:31 2019 -0800 Merge tag 'spi-fix-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A relatively large set of fixes here, the biggest part of it is for fallout from the GPIO descriptor rework that affected several of the devices with usable native chip select support. There's also some new PCI IDs for Intel Jasper Lake devices. The conversion to platform_get_irq() in the fsl driver is an incremental fix for build errors introduced on SPARC by the earlier fix for error handling in probe in that driver" * tag 'spi-fix-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: fsl: use platform_get_irq() instead of of_irq_to_resource() spi: nxp-fspi: Ensure width is respected in spi-mem operations spi: spi-ti-qspi: Fix a bug when accessing non default CS spi: fsl: don't map irq during probe spi: spi-cavium-thunderx: Add missing pci_release_regions() spi: sprd: Fix the incorrect SPI register gpiolib: of: Make of_gpio_spi_cs_get_count static spi: fsl: Handle the single hardwired chipselect case gpio: Handle counting of Freescale chipselects spi: fsl: Fix GPIO descriptor support spi: dw: Correct handling of native chipselect spi: cadence: Correct handling of native chipselect spi: pxa2xx: Add support for Intel Jasper Lake commit b1de6fc7520fe12949c070af0e8c0e4044cd3420 Author: Darrick J. Wong Date: Wed Dec 11 13:19:07 2019 -0800 xfs: fix log reservation overflows when allocating large rt extents Omar Sandoval reported that a 4G fallocate on the realtime device causes filesystem shutdowns due to a log reservation overflow that happens when we log the rtbitmap updates. Factor rtbitmap/rtsummary updates into the the tr_write and tr_itruncate log reservation calculation. "The following reproducer results in a transaction log overrun warning for me: mkfs.xfs -f -r rtdev=/dev/vdc -d rtinherit=1 -m reflink=0 /dev/vdb mount -o rtdev=/dev/vdc /dev/vdb /mnt fallocate -l 4G /mnt/foo Reported-by: Omar Sandoval Tested-by: Omar Sandoval Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 9065e0636036e4f8a6f65f9c34ed384e4b776273 Merge: 2abf19327576 af1648984828 Author: Linus Torvalds Date: Tue Dec 17 11:17:03 2019 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "Fix kexec booting with certain EFI memory map layouts" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage commit 2abf193275768ac89f5d93eec7bcacb238168151 Merge: 4340ebd19ff0 e0748539e3d5 Author: Linus Torvalds Date: Tue Dec 17 11:11:08 2019 -0800 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Ingo Molnar: "Add HPET quirks for the Intel 'Coffee Lake H' and 'Ice Lake' platforms" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/intel: Disable HPET on Intel Ice Lake platforms x86/intel: Disable HPET on Intel Coffee Lake H platforms commit 4340ebd19ff031fd97a69ea7e7249c898f2d3e06 Merge: 89c683cd06e0 346da4d2c7ea Author: Linus Torvalds Date: Tue Dec 17 11:09:05 2019 -0800 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix the guest-nice cpustat values in /proc" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/cputime, proc/stat: Fix incorrect guest nice cpustat value commit 89c683cd06e03dfd3186c4cab1e2a39982c42a48 Merge: 9e8a0d5ff840 57e04eeda515 Author: Linus Torvalds Date: Tue Dec 17 11:03:57 2019 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf tooling fixes from Ingo Molnar: "These are all perf tooling changes: most of them are fixes. Note that the large CPU count related fixes go beyond regression fixes, but the IPI-flood symptoms are severe enough that I think justifies their inclusion" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (38 commits) perf vendor events s390: Remove name from L1D_RO_EXCL_WRITES description perf vendor events s390: Fix counter long description for DTLB1_GPAGE_WRITES libtraceevent: Allow custom libdir path perf header: Fix false warning when there are no duplicate cache entries perf metricgroup: Fix printing event names of metric group with multiple events perf/x86/pmu-events: Fix Kernel_Utilization metric perf top: Do not bail out when perf_env__read_cpuid() returns ENOSYS perf arch: Make the default get_cpuid() return compatible error tools headers kvm: Sync linux/kvm.h with the kernel sources tools headers UAPI: Update tools's copy of drm.h headers tools headers UAPI: Sync drm/i915_drm.h with the kernel sources perf inject: Fix processing of ID index for injected instruction tracing perf report: Bail out --mem-mode if mem info is not available perf report: Make -F more strict like -s perf report/top TUI: Replace pr_err() with ui__error() libtraceevent: Copy pkg-config file to output folder when using O= libtraceevent: Fix lib installation with O= perf kvm: Clarify the 'perf kvm' -i and -o command line options tools arch x86: Sync asm/cpufeatures.h with the kernel sources perf beauty: Add CLEAR_SIGHAND support for clone's flags arg ... commit 9e8a0d5ff8408b1e54be0546df0b2ca9d04264cd Merge: a114a18c7dbc c571b72e2b84 Author: Linus Torvalds Date: Tue Dec 17 11:00:46 2019 -0800 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Ingo Molnar: "Tone down mutex debugging complaints, and annotate/fix spinlock debugging data accesses for KCSAN" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Revert "locking/mutex: Complain upon mutex API misuse in IRQ contexts" locking/spinlock/debug: Fix various data races commit a114a18c7dbc2b7ac5a1379a8dcced6095c52ead Merge: ea200dec5128 a470552ee896 Author: Linus Torvalds Date: Tue Dec 17 10:39:55 2019 -0800 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "Protect presistent EFI memory reservations from kexec, fix EFIFB early console, EFI stub graphics output fixes and other misc fixes." * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: Don't attempt to map RCI2 config table if it doesn't exist efi/earlycon: Remap entire framebuffer after page initialization efi: Fix efi_loaded_image_t::unload type efi/gop: Fix memory leak in __gop_query32/64() efi/gop: Return EFI_SUCCESS if a usable GOP was found efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs efi/memreserve: Register reservations as 'reserved' in /proc/iomem commit 0c4eb2a6b3c6b0facd0a3bccda5db22e7b3b6f96 Author: Kishon Vijay Abraham I Date: Tue Dec 17 14:21:23 2019 +0530 ARM: dts: am571x-idk: Fix gpios property to have the correct gpio number commit d23f3839fe97d8dce03d ("ARM: dts: DRA7: Add pcie1 dt node for EP mode") while adding the dt node for EP mode for DRA7 platform, added rc node for am571x-idk and populated gpios property with "gpio3 23". However the GPIO_PCIE_SWRST line is actually connected to "gpio5 18". Fix it here. (The patch adding "gpio3 23" was tested with another am57x board in EP mode which doesn't rely on reset from host). Cc: stable # 4.14+ Fixes: d23f3839fe97d8dce03d ("ARM: dts: DRA7: Add pcie1 dt node for EP mode") Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Tony Lindgren commit 81cc0877840f72210e809bbedd6346d686560fc1 Author: Kishon Vijay Abraham I Date: Tue Dec 17 14:21:22 2019 +0530 ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes PERST# line in the PCIE connector is driven by the host mode and not EP mode. The gpios property here is used for driving the PERST# line. Remove gpios property from all endpoint device tree nodes. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Tony Lindgren commit 4aa37c463764052c68c5c430af2a67b5d784c1e0 Author: Jason A. Donenfeld Date: Tue Dec 17 18:24:55 2019 +0100 random: don't forget compat_ioctl on urandom Recently, there's been some compat ioctl cleanup, in which large hardcoded lists were replaced with compat_ptr_ioctl. One of these changes involved removing the random.c hardcoded list entries and adding a compat ioctl function pointer to the random.c fops. In the process, urandom was forgotten about, so this commit fixes that oversight. Fixes: 507e4e2b430b ("compat_ioctl: remove /dev/random commands") Cc: Arnd Bergmann Signed-off-by: Jason A. Donenfeld Link: https://lore.kernel.org/r/20191217172455.186395-1-Jason@zx2c4.com Signed-off-by: Greg Kroah-Hartman commit e47304232b373362228bf233f17bd12b11c9aafc Author: Daniel Borkmann Date: Tue Dec 17 13:28:16 2019 +0100 bpf: Fix cgroup local storage prog tracking Recently noticed that we're tracking programs related to local storage maps through their prog pointer. This is a wrong assumption since the prog pointer can still change throughout the verification process, for example, whenever bpf_patch_insn_single() is called. Therefore, the prog pointer that was assigned via bpf_cgroup_storage_assign() is not guaranteed to be the same as we pass in bpf_cgroup_storage_release() and the map would therefore remain in busy state forever. Fix this by using the prog's aux pointer which is stable throughout verification and beyond. Fixes: de9cbbaadba5 ("bpf: introduce cgroup storage maps") Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Cc: Roman Gushchin Cc: Martin KaFai Lau Link: https://lore.kernel.org/bpf/1471c69eca3022218666f909bc927a92388fd09e.1576580332.git.daniel@iogearbox.net commit c58c1f83436b501d45d4050fd1296d71a9760bcb Author: Roman Penyaev Date: Tue Dec 17 16:54:07 2019 +0100 block: end bio with BLK_STS_AGAIN in case of non-mq devs and REQ_NOWAIT Non-mq devs do not honor REQ_NOWAIT so give a chance to the caller to repeat request gracefully on -EAGAIN error. The problem is well reproduced using io_uring: mkfs.ext4 /dev/ram0 mount /dev/ram0 /mnt # Preallocate a file dd if=/dev/zero of=/mnt/file bs=1M count=1 # Start fio with io_uring and get -EIO fio --rw=write --ioengine=io_uring --size=1M --direct=1 --name=job --filename=/mnt/file Signed-off-by: Roman Penyaev Signed-off-by: Jens Axboe commit aabb5b833872524eaf28f52187e5987984982264 Author: Suwan Kim Date: Fri Dec 13 11:30:55 2019 +0900 usbip: Fix error path of vhci_recv_ret_submit() If a transaction error happens in vhci_recv_ret_submit(), event handler closes connection and changes port status to kick hub_event. Then hub tries to flush the endpoint URBs, but that causes infinite loop between usb_hub_flush_endpoint() and vhci_urb_dequeue() because "vhci_priv" in vhci_urb_dequeue() was already released by vhci_recv_ret_submit() before a transmission error occurred. Thus, vhci_urb_dequeue() terminates early and usb_hub_flush_endpoint() continuously calls vhci_urb_dequeue(). The root cause of this issue is that vhci_recv_ret_submit() terminates early without giving back URB when transaction error occurs in vhci_recv_ret_submit(). That causes the error URB to still be linked at endpoint list without “vhci_priv". So, in the case of transaction error in vhci_recv_ret_submit(), unlink URB from the endpoint, insert proper error code in urb->status and give back URB. Reported-by: Marek Marczykowski-Górecki Tested-by: Marek Marczykowski-Górecki Signed-off-by: Suwan Kim Cc: stable Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20191213023055.19933-3-suwan.kim027@gmail.com Signed-off-by: Greg Kroah-Hartman commit d986294ee55d719562b20aabe15a39bf8f863415 Author: Suwan Kim Date: Fri Dec 13 11:30:54 2019 +0900 usbip: Fix receive error in vhci-hcd when using scatter-gather When vhci uses SG and receives data whose size is smaller than SG buffer size, it tries to receive more data even if it acutally receives all the data from the server. If then, it erroneously adds error event and triggers connection shutdown. vhci-hcd should check if it received all the data even if there are more SG entries left. So, check if it receivces all the data from the server in for_each_sg() loop. Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver") Reported-by: Marek Marczykowski-Górecki Tested-by: Marek Marczykowski-Górecki Signed-off-by: Suwan Kim Acked-by: Shuah Khan Cc: stable Link: https://lore.kernel.org/r/20191213023055.19933-2-suwan.kim027@gmail.com Signed-off-by: Greg Kroah-Hartman commit 64cc3f12d1c7dd054a215bc1ff9cc2abcfe35832 Author: Erkka Talvitie Date: Wed Dec 11 10:08:39 2019 +0200 USB: EHCI: Do not return -EPIPE when hub is disconnected When disconnecting a USB hub that has some child device(s) connected to it (such as a USB mouse), then the stack tries to clear halt and reset device(s) which are _already_ physically disconnected. The issue has been reproduced with: CPU: IMX6D5EYM10AD or MCIMX6D5EYM10AE. SW: U-Boot 2019.07 and kernel 4.19.40. CPU: HP Proliant Microserver Gen8. SW: Linux version 4.2.3-300.fc23.x86_64 In this situation there will be error bit for MMF active yet the CERR equals EHCI_TUNE_CERR + halt. Existing implementation interprets this as a stall [1] (chapter 8.4.5). The possible conditions when the MMF will be active + halt can be found from [2] (Table 4-13). Fix for the issue is to check whether MMF is active and PID Code is IN before checking for the stall. If these conditions are true then it is not a stall. What happens after the fix is that when disconnecting a hub with attached device(s) the situation is not interpret as a stall. [1] [https://www.usb.org/document-library/usb-20-specification, usb_20.pdf] [2] [https://www.intel.com/content/dam/www/public/us/en/documents/ technical-specifications/ehci-specification-for-usb.pdf] Signed-off-by: Erkka Talvitie Reviewed-by: Alan Stern Cc: stable Link: https://lore.kernel.org/r/ef70941d5f349767f19c0ed26b0dd9eed8ad81bb.1576050523.git.erkka.talvitie@vincit.fi Signed-off-by: Greg Kroah-Hartman commit 547fc228755d79af648898187e7831a825d4f42c Author: zhong jiang Date: Fri Dec 13 20:16:18 2019 +0800 usb: typec: fusb302: Fix an undefined reference to 'extcon_get_state' Fixes the following compile error: drivers/usb/typec/tcpm/fusb302.o: In function `tcpm_get_current_limit': fusb302.c:(.text+0x3ee): undefined reference to `extcon_get_state' fusb302.c:(.text+0x422): undefined reference to `extcon_get_state' fusb302.c:(.text+0x450): undefined reference to `extcon_get_state' fusb302.c:(.text+0x48c): undefined reference to `extcon_get_state' drivers/usb/typec/tcpm/fusb302.o: In function `fusb302_probe': fusb302.c:(.text+0x980): undefined reference to `extcon_get_extcon_dev' make: *** [vmlinux] Error 1 It is because EXTCON is build as a module, but FUSB302 is not. Suggested-by: Heikki Krogerus Signed-off-by: zhong jiang Acked-by: Heikki Krogerus Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1576239378-50795-1-git-send-email-zhongjiang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 05b686b573cfb35a227c30787083a6631ff0f0c9 Author: Alexander Shishkin Date: Tue Dec 17 13:55:27 2019 +0200 intel_th: msu: Fix window switching without windows Commit 6cac7866c2741 ("intel_th: msu: Add a sysfs attribute to trigger window switch") adds a NULL pointer dereference in the case when there are no windows allocated: > BUG: kernel NULL pointer dereference, address: 0000000000000000 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 0 P4D 0 > Oops: 0000 1 SMP > CPU: 5 PID: 1110 Comm: bash Not tainted 5.5.0-rc1+ #1 > RIP: 0010:msc_win_switch+0xa/0x80 [intel_th_msu] > Call Trace: > ? win_switch_store+0x9b/0xc0 [intel_th_msu] > dev_attr_store+0x17/0x30 > sysfs_kf_write+0x3e/0x50 > kernfs_fop_write+0xda/0x1b0 > __vfs_write+0x1b/0x40 > vfs_write+0xb9/0x1a0 > ksys_write+0x67/0xe0 > __x64_sys_write+0x1a/0x20 > do_syscall_64+0x57/0x1d0 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix that by disallowing window switching with multiwindow buffers without windows. Signed-off-by: Alexander Shishkin Fixes: 6cac7866c274 ("intel_th: msu: Add a sysfs attribute to trigger window switch") Reviewed-by: Andy Shevchenko Reported-by: Ammy Yi Tested-by: Ammy Yi Cc: stable@vger.kernel.org # v5.2+ Link: https://lore.kernel.org/r/20191217115527.74383-5-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ab832e38e4f0f45b16c3633714d868b7ec6b33b4 Author: Alexander Shishkin Date: Tue Dec 17 13:55:26 2019 +0200 intel_th: Fix freeing IRQs Commit aac8da65174a ("intel_th: msu: Start handling IRQs") implicitly relies on the use of devm_request_irq() to subsequently free the irqs on device removal, but in case of the pci_free_irq_vectors() API, the handlers need to be freed before it is called. Therefore, at the moment the driver's remove path trips a BUG_ON(irq_has_action()): > kernel BUG at drivers/pci/msi.c:375! > invalid opcode: 0000 1 SMP > CPU: 2 PID: 818 Comm: rmmod Not tainted 5.5.0-rc1+ #1 > RIP: 0010:free_msi_irqs+0x67/0x1c0 > pci_disable_msi+0x116/0x150 > pci_free_irq_vectors+0x1b/0x20 > intel_th_pci_remove+0x22/0x30 [intel_th_pci] > pci_device_remove+0x3e/0xb0 > device_release_driver_internal+0xf0/0x1c0 > driver_detach+0x4c/0x8f > bus_remove_driver+0x5c/0xd0 > driver_unregister+0x31/0x50 > pci_unregister_driver+0x40/0x90 > intel_th_pci_driver_exit+0x10/0xad6 [intel_th_pci] > __x64_sys_delete_module+0x147/0x290 > ? exit_to_usermode_loop+0xd7/0x120 > do_syscall_64+0x57/0x1b0 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix this by explicitly freeing irqs before freeing the vectors. We keep using the devm_* variants because they are still useful in early error paths. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Fixes: aac8da65174a ("intel_th: msu: Start handling IRQs") Reported-by: Ammy Yi Tested-by: Ammy Yi Cc: stable@vger.kernel.org # v5.2+ Link: https://lore.kernel.org/r/20191217115527.74383-4-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 88385866bab8d5e18c7f45d1023052c783572e03 Author: Alexander Shishkin Date: Tue Dec 17 13:55:25 2019 +0200 intel_th: pci: Add Elkhart Lake SOC support This adds support for Intel Trace Hub in Elkhart Lake. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191217115527.74383-3-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit e4de2a5d51f97a6e720a1c0911f93e2d8c2f1c08 Author: Alexander Shishkin Date: Tue Dec 17 13:55:24 2019 +0200 intel_th: pci: Add Comet Lake PCH-V support This adds Intel(R) Trace Hub PCI ID for Comet Lake PCH-V. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Cc: Link: https://lore.kernel.org/r/20191217115527.74383-2-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 7c497d799267134786afdf719d9230b7d6f77d84 Merge: 475feec0c41a 556672d75ff4 Author: Takashi Iwai Date: Tue Dec 17 14:18:32 2019 +0100 Merge tag 'asoc-fix-v5.5-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.5 A collection of fixes since the merge window, mostly driver specific but there's a few in the core that clean up fallout from the refactorings done in the last cycle. commit cb47b9f8630ae3fa3f5fbd0c7003faba7abdf711 Author: David Engraf Date: Mon Dec 16 09:54:03 2019 +0100 tty/serial: atmel: fix out of range clock divider handling Use MCK_DIV8 when the clock divider is > 65535. Unfortunately the mode register was already written thus the clock selection is ignored. Fix by doing the baud rate calulation before setting the mode. Fixes: 5bf5635ac170 ("tty/serial: atmel: add fractional baud rate support") Signed-off-by: David Engraf Acked-by: Ludovic Desroches Acked-by: Richard Genoud Cc: stable Link: https://lore.kernel.org/r/20191216085403.17050-1-david.engraf@sysgo.com Signed-off-by: Greg Kroah-Hartman commit fb2b90014d782d80d7ebf663e50f96d8c507a73c Author: Sudip Mukherjee Date: Thu Dec 12 13:16:02 2019 +0000 tty: link tty and port before configuring it as console There seems to be a race condition in tty drivers and I could see on many boot cycles a NULL pointer dereference as tty_init_dev() tries to do 'tty->port->itty = tty' even though tty->port is NULL. 'tty->port' will be set by the driver and if the driver has not yet done it before we open the tty device we can get to this situation. By adding some extra debug prints, I noticed that: 6.650130: uart_add_one_port 6.663849: register_console 6.664846: tty_open 6.674391: tty_init_dev 6.675456: tty_port_link_device uart_add_one_port() registers the console, as soon as it registers, the userspace tries to use it and that leads to tty_open() but uart_add_one_port() has not yet done tty_port_link_device() and so tty->port is not yet configured when control reaches tty_init_dev(). Further look into the code and tty_port_link_device() is done by uart_add_one_port(). After registering the console uart_add_one_port() will call tty_port_register_device_attr_serdev() and tty_port_link_device() is called from this. Call add tty_port_link_device() before uart_configure_port() is done and add a check in tty_port_link_device() so that it only links the port if it has not been done yet. Suggested-by: Jiri Slaby Signed-off-by: Sudip Mukherjee Cc: stable Link: https://lore.kernel.org/r/20191212131602.29504-1-sudipm.mukherjee@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6cf82d559e1a1d89f06ff4d428aca479c1dd0be6 Author: Vincent Guittot Date: Fri Nov 29 15:04:47 2019 +0100 sched/cfs: fix spurious active migration The load balance can fail to find a suitable task during the periodic check because the imbalance is smaller than half of the load of the waiting tasks. This results in the increase of the number of failed load balance, which can end up to start an active migration. This active migration is useless because the current running task is not a better choice than the waiting ones. In fact, the current task was probably not running but waiting for the CPU during one of the previous attempts and it had already not been selected. When load balance fails too many times to migrate a task, we should relax the contraint on the maximum load of the tasks that can be migrated similarly to what is done with cache hotness. Before the rework, load balance used to set the imbalance to the average load_per_task in order to mitigate such situation. This increased the likelihood of migrating a task but also of selecting a larger task than needed while more appropriate ones were in the list. Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/1575036287-6052-1-git-send-email-vincent.guittot@linaro.org commit 7ed735c33104f3c6194fbc67e3a8b6e64ae84ad1 Author: Vincent Guittot Date: Wed Dec 4 19:21:40 2019 +0100 sched/fair: Fix find_idlest_group() to handle CPU affinity Because of CPU affinity, the local group can be skipped which breaks the assumption that statistics are always collected for local group. With uninitialized local_sgs, the comparison is meaningless and the behavior unpredictable. This can even end up to use local pointer which is to NULL in this case. If the local group has been skipped because of CPU affinity, we return the idlest group. Fixes: 57abff067a08 ("sched/fair: Rework find_idlest_group()") Reported-by: John Stultz Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Valentin Schneider Tested-by: John Stultz Cc: rostedt@goodmis.org Cc: valentin.schneider@arm.com Cc: mingo@redhat.com Cc: mgorman@suse.de Cc: juri.lelli@redhat.com Cc: dietmar.eggemann@arm.com Cc: bsegall@google.com Cc: qais.yousef@arm.com Link: https://lkml.kernel.org/r/1575483700-22153-1-git-send-email-vincent.guittot@linaro.org commit c3466952ca1514158d7c16c9cfc48c27d5c5dc0f Author: Johannes Weiner Date: Tue Dec 3 13:35:24 2019 -0500 psi: Fix a division error in psi poll() The psi window size is a u64 an can be up to 10 seconds right now, which exceeds the lower 32 bits of the variable. We currently use div_u64 for it, which is meant only for 32-bit divisors. The result is garbage pressure sampling values and even potential div0 crashes. Use div64_u64. Signed-off-by: Johannes Weiner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Suren Baghdasaryan Cc: Jingfeng Xie Link: https://lkml.kernel.org/r/20191203183524.41378-3-hannes@cmpxchg.org commit 3dfbe25c27eab7c90c8a7e97b4c354a9d24dd985 Author: Johannes Weiner Date: Tue Dec 3 13:35:23 2019 -0500 sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime Jingfeng reports rare div0 crashes in psi on systems with some uptime: [58914.066423] divide error: 0000 [#1] SMP [58914.070416] Modules linked in: ipmi_poweroff ipmi_watchdog toa overlay fuse tcp_diag inet_diag binfmt_misc aisqos(O) aisqos_hotfixes(O) [58914.083158] CPU: 94 PID: 140364 Comm: kworker/94:2 Tainted: G W OE K 4.9.151-015.ali3000.alios7.x86_64 #1 [58914.093722] Hardware name: Alibaba Alibaba Cloud ECS/Alibaba Cloud ECS, BIOS 3.23.34 02/14/2019 [58914.102728] Workqueue: events psi_update_work [58914.107258] task: ffff8879da83c280 task.stack: ffffc90059dcc000 [58914.113336] RIP: 0010:[] [] psi_update_stats+0x1c1/0x330 [58914.122183] RSP: 0018:ffffc90059dcfd60 EFLAGS: 00010246 [58914.127650] RAX: 0000000000000000 RBX: ffff8858fe98be50 RCX: 000000007744d640 [58914.134947] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00003594f700648e [58914.142243] RBP: ffffc90059dcfdf8 R08: 0000359500000000 R09: 0000000000000000 [58914.149538] R10: 0000000000000000 R11: 0000000000000000 R12: 0000359500000000 [58914.156837] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8858fe98bd78 [58914.164136] FS: 0000000000000000(0000) GS:ffff887f7f380000(0000) knlGS:0000000000000000 [58914.172529] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [58914.178467] CR2: 00007f2240452090 CR3: 0000005d5d258000 CR4: 00000000007606f0 [58914.185765] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [58914.193061] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [58914.200360] PKRU: 55555554 [58914.203221] Stack: [58914.205383] ffff8858fe98bd48 00000000000002f0 0000002e81036d09 ffffc90059dcfde8 [58914.213168] ffff8858fe98bec8 0000000000000000 0000000000000000 0000000000000000 [58914.220951] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [58914.228734] Call Trace: [58914.231337] [] psi_update_work+0x22/0x60 [58914.237067] [] process_one_work+0x189/0x420 [58914.243063] [] worker_thread+0x4e/0x4b0 [58914.248701] [] ? process_one_work+0x420/0x420 [58914.254869] [] kthread+0xe6/0x100 [58914.259994] [] ? kthread_park+0x60/0x60 [58914.265640] [] ret_from_fork+0x39/0x50 [58914.271193] Code: 41 29 c3 4d 39 dc 4d 0f 42 dc <49> f7 f1 48 8b 13 48 89 c7 48 c1 [58914.279691] RIP [] psi_update_stats+0x1c1/0x330 The crashing instruction is trying to divide the observed stall time by the sampling period. The period, stored in R8, is not 0, but we are dividing by the lower 32 bits only, which are all 0 in this instance. We could switch to a 64-bit division, but the period shouldn't be that big in the first place. It's the time between the last update and the next scheduled one, and so should always be around 2s and comfortably fit into 32 bits. The bug is in the initialization of new cgroups: we schedule the first sampling event in a cgroup as an offset of sched_clock(), but fail to initialize the last_update timestamp, and it defaults to 0. That results in a bogusly large sampling period the first time we run the sampling code, and consequently we underreport pressure for the first 2s of a cgroup's life. But worse, if sched_clock() is sufficiently advanced on the system, and the user gets unlucky, the period's lower 32 bits can all be 0 and the sampling division will crash. Fix this by initializing the last update timestamp to the creation time of the cgroup, thus correctly marking the start of the first pressure sampling period in a new cgroup. Reported-by: Jingfeng Xie Signed-off-by: Johannes Weiner Signed-off-by: Peter Zijlstra (Intel) Cc: Suren Baghdasaryan Link: https://lkml.kernel.org/r/20191203183524.41378-2-hannes@cmpxchg.org commit 9f0bff1180efc9ea988fed3fd93da7647151ac8b Author: Sebastian Andrzej Siewior Date: Tue Nov 19 13:14:29 2019 +0100 perf/core: Add SRCU annotation for pmus list walk Since commit 28875945ba98d ("rcu: Add support for consolidated-RCU reader checking") there is an additional check to ensure that a RCU related lock is held while the RCU list is iterated. This section holds the SRCU reader lock instead. Add annotation to list_for_each_entry_rcu() that pmus_srcu must be acquired during the list traversal. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Joel Fernandes (Google) Link: https://lkml.kernel.org/r/20191119121429.zhcubzdhm672zasg@linutronix.de commit 92ca7da4bdc24d63bb0bcd241c11441ddb63b80a Author: Alexander Shishkin Date: Tue Dec 10 12:51:01 2019 +0200 perf/x86/intel: Fix PT PMI handling Commit: ccbebba4c6bf ("perf/x86/intel/pt: Bypass PT vs. LBR exclusivity if the core supports it") skips the PT/LBR exclusivity check on CPUs where PT and LBRs coexist, but also inadvertently skips the active_events bump for PT in that case, which is a bug. If there aren't any hardware events at the same time as PT, the PMI handler will ignore PT PMIs, as active_events reads zero in that case, resulting in the "Uhhuh" spurious NMI warning and PT data loss. Fix this by always increasing active_events for PT events. Fixes: ccbebba4c6bf ("perf/x86/intel/pt: Bypass PT vs. LBR exclusivity if the core supports it") Reported-by: Vitaly Slobodskoy Signed-off-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Acked-by: Alexey Budankov Cc: Jiri Olsa Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo Link: https://lkml.kernel.org/r/20191210105101.77210-1-alexander.shishkin@linux.intel.com commit ff61541cc6c1962957758ba433c574b76f588d23 Author: Alexander Shishkin Date: Thu Dec 5 17:28:52 2019 +0300 perf/x86/intel/bts: Fix the use of page_private() Commit 8062382c8dbe2 ("perf/x86/intel/bts: Add BTS PMU driver") brought in a warning with the BTS buffer initialization that is easily tripped with (assuming KPTI is disabled): instantly throwing: > ------------[ cut here ]------------ > WARNING: CPU: 2 PID: 326 at arch/x86/events/intel/bts.c:86 bts_buffer_setup_aux+0x117/0x3d0 > Modules linked in: > CPU: 2 PID: 326 Comm: perf Not tainted 5.4.0-rc8-00291-gceb9e77324fa #904 > RIP: 0010:bts_buffer_setup_aux+0x117/0x3d0 > Call Trace: > rb_alloc_aux+0x339/0x550 > perf_mmap+0x607/0xc70 > mmap_region+0x76b/0xbd0 ... It appears to assume (for lost raisins) that PagePrivate() is set, while later it actually tests for PagePrivate() before using page_private(). Make it consistent and always check PagePrivate() before using page_private(). Fixes: 8062382c8dbe2 ("perf/x86/intel/bts: Add BTS PMU driver") Signed-off-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Cc: Jiri Olsa Cc: Vince Weaver Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo Link: https://lkml.kernel.org/r/20191205142853.28894-2-alexander.shishkin@linux.intel.com commit 1e69a0efc0bd0e02b8327e7186fbb4a81878ea0b Author: Peter Zijlstra Date: Fri Dec 6 12:50:16 2019 +0100 perf/x86: Fix potential out-of-bounds access UBSAN reported out-of-bound accesses for x86_pmu.event_map(), it's arguments should be < x86_pmu.max_events. Make sure all users observe this constraint. Reported-by: Meelis Roos Signed-off-by: Peter Zijlstra (Intel) Tested-by: Meelis Roos commit 57e04eeda515ee979fec3bc3d64c408feae18acc Merge: 0f60a0bcc1b9 58b3bafff825 Author: Ingo Molnar Date: Tue Dec 17 12:28:02 2019 +0100 Merge tag 'perf-urgent-for-mingo-5.5-20191216' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes: perf top: Arnaldo Carvalho de Melo: - Do not bail out when perf_env__read_cpuid() returns ENOSYS, which has been reported happening on aarch64. perf metricgroup: Kajol Jain: - Fix printing event names of metric group with multiple events vendor events: x86: Ravi Bangoria: - Fix Kernel_Utilization metric. s390: Ed Maste: - Fix counter long description for DTLB1_GPAGE_WRITES and L1D_RO_EXCL_WRITES. perf header: Michael Petlan: - Fix false warning when there are no duplicate cache entries libtraceevent: Sudip Mukherjee: - Allow custom libdir path API headers: Arnaldo Carvalho de Melo: - Sync linux/kvm.h with the kernel sources. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit cde9319e884eb6267a0df446f3c131fe1108defb Author: Jerry Snitselaar Date: Thu Dec 12 22:36:42 2019 -0700 iommu/vt-d: Allocate reserved region for ISA with correct permission Currently the reserved region for ISA is allocated with no permissions. If a dma domain is being used, mapping this region will fail. Set the permissions to DMA_PTE_READ|DMA_PTE_WRITE. Cc: Joerg Roedel Cc: Lu Baolu Cc: iommu@lists.linux-foundation.org Cc: stable@vger.kernel.org # v5.3+ Fixes: d850c2ee5fe2 ("iommu/vt-d: Expose ISA direct mapping region via iommu_get_resv_regions") Signed-off-by: Jerry Snitselaar Acked-by: Lu Baolu Signed-off-by: Joerg Roedel commit d360211524bece6db9920f32c91808235290b51c Author: Jerry Snitselaar Date: Tue Dec 10 11:56:06 2019 -0700 iommu: set group default domain before creating direct mappings iommu_group_create_direct_mappings uses group->default_domain, but right after it is called, request_default_domain_for_dev calls iommu_domain_free for the default domain, and sets the group default domain to a different domain. Move the iommu_group_create_direct_mappings call to after the group default domain is set, so the direct mappings get associated with that domain. Cc: Joerg Roedel Cc: Lu Baolu Cc: iommu@lists.linux-foundation.org Cc: stable@vger.kernel.org Fixes: 7423e01741dd ("iommu: Add API to request DMA domain for device") Signed-off-by: Jerry Snitselaar Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit 75d18385394f56db76845d91a192532aba421875 Author: Lu Baolu Date: Wed Dec 11 09:40:15 2019 +0800 iommu/vt-d: Fix dmar pte read access not set error If the default DMA domain of a group doesn't fit a device, it will still sit in the group but use a private identity domain. When map/unmap/iova_to_phys come through iommu API, the driver should still serve them, otherwise, other devices in the same group will be impacted. Since identity domain has been mapped with the whole available memory space and RMRRs, we don't need to worry about the impact on it. Link: https://www.spinics.net/lists/iommu/msg40416.html Cc: Jerry Snitselaar Reported-by: Jerry Snitselaar Fixes: 942067f1b6b97 ("iommu/vt-d: Identify default domains replaced with private") Cc: stable@vger.kernel.org # v5.3+ Signed-off-by: Lu Baolu Reviewed-by: Jerry Snitselaar Tested-by: Jerry Snitselaar Signed-off-by: Joerg Roedel commit d55157f6aaca04df4223c2c7a96995ceda016a15 Author: Vandita Kulkarni Date: Mon Dec 16 13:36:19 2019 +0530 drm/i915: Fix WARN_ON condition for cursor plane ddb allocation In some cases like latency[level]==0, wm[level].res_lines>31, min_ddb_alloc can be U16_MAX, exclude it from the WARN_ON. v2: Specify the cases in which we hit U16_MAX, indentation (Ville) Fixes: 10a7e07b68b9 ("drm/i915: Make sure cursor has enough ddb for the selected wm level") Suggested-by: Ville Syrjälä Signed-off-by: Vandita Kulkarni Reviewed-by: Ville Syrjälä Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20191216080619.10945-1-vandita.kulkarni@intel.com (cherry picked from commit 4ba487019d1a196051feefab57f4a393815733b4) Signed-off-by: Joonas Lahtinen commit a11391b6f50689adb22c65df783e09143fafb794 Author: Enrico Weigelt, metux IT consult Date: Mon Dec 16 21:07:19 2019 +0100 scripts: package: mkdebian: add missing rsync dependency We've missed the dependency to rsync, so build fails on minimal containers. Fixes: 59b2bd05f5f4 ("kbuild: add 'headers' target to build up uapi headers in usr/include") Signed-off-by: Enrico Weigelt, metux IT consult Signed-off-by: Masahiro Yamada commit 272a72103012862e3a24ea06635253ead0b6e808 Author: Thomas Hebb Date: Mon Dec 9 00:19:17 2019 -0800 kconfig: don't crash on NULL expressions in expr_eq() NULL expressions are taken to always be true, as implemented by the expr_is_yes() macro and by several other functions in expr.c. As such, they ought to be valid inputs to expr_eq(), which compares two expressions. Signed-off-by: Thomas Hebb Signed-off-by: Masahiro Yamada commit d8018a0e9195ba9f0fb9cf0fd3843807c8b952d5 Author: Alex Williamson Date: Wed Dec 11 13:28:29 2019 -0700 iommu/vt-d: Set ISA bridge reserved region as relaxable Commit d850c2ee5fe2 ("iommu/vt-d: Expose ISA direct mapping region via iommu_get_resv_regions") created a direct-mapped reserved memory region in order to replace the static identity mapping of the ISA address space, where the latter was then removed in commit df4f3c603aeb ("iommu/vt-d: Remove static identity map code"). According to the history of this code and the Kconfig option surrounding it, this direct mapping exists for the benefit of legacy ISA drivers that are not compatible with the DMA API. In conjuntion with commit 9b77e5c79840 ("vfio/type1: check dma map request is within a valid iova range") this change introduced a regression where the vfio IOMMU backend enforces reserved memory regions per IOMMU group, preventing userspace from creating IOMMU mappings conflicting with prescribed reserved regions. A necessary prerequisite for the vfio change was the introduction of "relaxable" direct mappings introduced by commit adfd37382090 ("iommu: Introduce IOMMU_RESV_DIRECT_RELAXABLE reserved memory regions"). These relaxable direct mappings provide the same identity mapping support in the default domain, but also indicate that the reservation is software imposed and may be relaxed under some conditions, such as device assignment. Convert the ISA bridge direct-mapped reserved region to relaxable to reflect that the restriction is self imposed and need not be enforced by drivers such as vfio. Fixes: 1c5c59fbad20 ("iommu/vt-d: Differentiate relaxable and non relaxable RMRRs") Cc: stable@vger.kernel.org # v5.3+ Link: https://lore.kernel.org/linux-iommu/20191211082304.2d4fab45@x1.home Reported-by: cprt Tested-by: cprt Signed-off-by: Alex Williamson Acked-by: Lu Baolu Reviewed-by: Eric Auger Tested-by: Jerry Snitselaar Reviewed-by: Jerry Snitselaar Signed-off-by: Joerg Roedel commit a9920d3bad40201ee8ab1da36bee4674f7e50d69 Author: Tadeusz Struk Date: Thu Dec 12 09:48:59 2019 -0800 tpm: selftest: cleanup after unseal with wrong auth/policy test Unseal with wrong auth or wrong policy test affects DA lockout and eventually causes the tests to fail with: "ProtocolError: TPM_RC_LOCKOUT: rc=0x00000921" when the tests run multiple times. Send tpm clear command after the test to reset the DA counters. Signed-off-by: Tadeusz Struk Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 8f84bddcfac9117564721ead494db7a604fdf861 Author: Tadeusz Struk Date: Thu Dec 12 09:48:53 2019 -0800 tpm: selftest: add test covering async mode Add a test that sends a tpm cmd in an async mode. Currently there is a gap in test coverage with regards to this functionality. Signed-off-by: Tadeusz Struk Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit d23d12484307b40eea549b8a858f5fffad913897 Author: Tadeusz Struk Date: Thu Dec 12 09:48:47 2019 -0800 tpm: fix invalid locking in NONBLOCKING mode When an application sends TPM commands in NONBLOCKING mode the driver holds chip->tpm_mutex returning from write(), which triggers: "WARNING: lock held when returning to user space". To fix this issue the driver needs to release the mutex before returning and acquire it again in tpm_dev_async_work() before sending the command. Cc: stable@vger.kernel.org Fixes: 9e1b74a63f776 (tpm: add support for nonblocking operation) Reported-by: Jeffrin Jose T Tested-by: Jeffrin Jose T Signed-off-by: Tadeusz Struk Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit bd036d2fdd374fa252abfc221e1a1280eee42f89 Author: Robin Murphy Date: Wed Dec 11 18:33:26 2019 +0000 iommu/dma: Rationalise types for DMA masks Since iommu_dma_alloc_iova() combines incoming masks with the u64 bus limit, it makes more sense to pass them around in their native u64 rather than converting to dma_addr_t early. Do that, and resolve the remaining type discrepancy against the domain geometry with a cheeky cast to keep things simple. Signed-off-by: Robin Murphy Reviewed-by: Christoph Hellwig Tested-by: Nathan Chancellor # build Reviewed-by: Nicolas Saenz Julienne Signed-off-by: Joerg Roedel commit 472d26df5e8075eda677b6be730e0fbf434ff2a8 Author: Xiaotao Yin Date: Tue Dec 10 12:27:04 2019 +0800 iommu/iova: Init the struct iova to fix the possible memleak During ethernet(Marvell octeontx2) set ring buffer test: ethtool -G eth1 rx tx following kmemleak will happen sometimes: unreferenced object 0xffff000b85421340 (size 64): comm "ethtool", pid 867, jiffies 4295323539 (age 550.500s) hex dump (first 64 bytes): 80 13 42 85 0b 00 ff ff ff ff ff ff ff ff ff ff ..B............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000001b204ddf>] kmem_cache_alloc+0x1b0/0x350 [<00000000d9ef2e50>] alloc_iova+0x3c/0x168 [<00000000ea30f99d>] alloc_iova_fast+0x7c/0x2d8 [<00000000b8bb2f1f>] iommu_dma_alloc_iova.isra.0+0x12c/0x138 [<000000002f1a43b5>] __iommu_dma_map+0x8c/0xf8 [<00000000ecde7899>] iommu_dma_map_page+0x98/0xf8 [<0000000082004e59>] otx2_alloc_rbuf+0xf4/0x158 [<000000002b107f6b>] otx2_rq_aura_pool_init+0x110/0x270 [<00000000c3d563c7>] otx2_open+0x15c/0x734 [<00000000a2f5f3a8>] otx2_dev_open+0x3c/0x68 [<00000000456a98b5>] otx2_set_ringparam+0x1ac/0x1d4 [<00000000f2fbb819>] dev_ethtool+0xb84/0x2028 [<0000000069b67c5a>] dev_ioctl+0x248/0x3a0 [<00000000af38663a>] sock_ioctl+0x280/0x638 [<000000002582384c>] do_vfs_ioctl+0x8b0/0xa80 [<000000004e1a2c02>] ksys_ioctl+0x84/0xb8 The reason: When alloc_iova_mem() without initial with Zero, sometimes fpn_lo will equal to IOVA_ANCHOR by chance, so when return with -ENOMEM(iova32_full) from __alloc_and_insert_iova_range(), the new_iova will not be freed in free_iova_mem(). Fixes: bb68b2fbfbd6 ("iommu/iova: Add rbtree anchor node") Signed-off-by: Xiaotao Yin Reviewed-by: Robin Murphy Signed-off-by: Joerg Roedel commit 45477b3fe3d10376b649b1b85fce72b2f9f1da84 Author: James Bottomley Date: Thu Dec 12 12:58:35 2019 -0500 security: keys: trusted: fix lost handle flush The original code, before it was moved into security/keys/trusted-keys had a flush after the blob unseal. Without that flush, the volatile handles increase in the TPM until it becomes unusable and the system either has to be rebooted or the TPM volatile area manually flushed. Fix by adding back the lost flush, which we now have to export because of the relocation of the trusted key code may cause the consumer to be modular. Signed-off-by: James Bottomley Fixes: 2e19e10131a0 ("KEYS: trusted: Move TPM2 trusted keys code") Reviewed-by: Jerry Snitselaar Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit a3a57ddad061acc90bef39635caf2b2330ce8f21 Author: Jan H. Schönherr Date: Tue Dec 10 01:07:30 2019 +0100 x86/mce: Fix possibly incorrect severity calculation on AMD The function mce_severity_amd_smca() requires m->bank to be initialized for correct operation. Fix the one case, where mce_severity() is called without doing so. Fixes: 6bda529ec42e ("x86/mce: Grade uncorrected errors for SMCA-enabled systems") Fixes: d28af26faa0b ("x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out()") Signed-off-by: Jan H. Schönherr Signed-off-by: Borislav Petkov Reviewed-by: Tony Luck Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: linux-edac Cc: Cc: Thomas Gleixner Cc: x86-ml Cc: Yazen Ghannam Link: https://lkml.kernel.org/r/20191210000733.17979-4-jschoenh@amazon.de commit 966af20929ac24360ba3fac5533eb2ab003747da Author: Yazen Ghannam Date: Thu Nov 21 08:15:08 2019 -0600 x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] Each logical CPU in Scalable MCA systems controls a unique set of MCA banks in the system. These banks are not shared between CPUs. The bank types and ordering will be the same across CPUs on currently available systems. However, some CPUs may see a bank as Reserved/Read-as-Zero (RAZ) while other CPUs do not. In this case, the bank seen as Reserved on one CPU is assumed to be the same type as the bank seen as a known type on another CPU. In general, this occurs when the hardware represented by the MCA bank is disabled, e.g. disabled memory controllers on certain models, etc. The MCA bank is disabled in the hardware, so there is no possibility of getting an MCA/MCE from it even if it is assumed to have a known type. For example: Full system: Bank | Type seen on CPU0 | Type seen on CPU1 ------------------------------------------------ 0 | LS | LS 1 | UMC | UMC 2 | CS | CS System with hardware disabled: Bank | Type seen on CPU0 | Type seen on CPU1 ------------------------------------------------ 0 | LS | LS 1 | UMC | RAZ 2 | CS | CS For this reason, there is a single, global struct smca_banks[] that is initialized at boot time. This array is initialized on each CPU as it comes online. However, the array will not be updated if an entry already exists. This works as expected when the first CPU (usually CPU0) has all possible MCA banks enabled. But if the first CPU has a subset, then it will save a "Reserved" type in smca_banks[]. Successive CPUs will then not be able to update smca_banks[] even if they encounter a known bank type. This may result in unexpected behavior. Depending on the system configuration, a user may observe issues enumerating the MCA thresholding sysfs interface. The issues may be as trivial as sysfs entries not being available, or as severe as system hangs. For example: Bank | Type seen on CPU0 | Type seen on CPU1 ------------------------------------------------ 0 | LS | LS 1 | RAZ | UMC 2 | CS | CS Extend the smca_banks[] entry check to return if the entry is a non-reserved type. Otherwise, continue so that CPUs that encounter a known bank type can update smca_banks[]. Fixes: 68627a697c19 ("x86/mce/AMD, EDAC/mce_amd: Enumerate Reserved SMCA bank type") Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: linux-edac Cc: Cc: Thomas Gleixner Cc: Tony Luck Cc: x86-ml Link: https://lkml.kernel.org/r/20191121141508.141273-1-Yazen.Ghannam@amd.com commit 246ff09f89e54fdf740a8d496176c86743db3ec7 Author: Konstantin Khlebnikov Date: Thu Oct 31 16:04:48 2019 +0300 x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() ... because interrupts are disabled that early and sending IPIs can deadlock: BUG: sleeping function called from invalid context at kernel/sched/completion.c:99 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 no locks held by swapper/1/0. irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [] copy_process+0x8b9/0x1ca0 softirqs last enabled at (0): [] copy_process+0x8b9/0x1ca0 softirqs last disabled at (0): [<0000000000000000>] 0x0 Preemption disabled at: [] start_secondary+0x3b/0x190 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.5.0-rc2+ #1 Hardware name: GIGABYTE MZ01-CE1-00/MZ01-CE1-00, BIOS F02 08/29/2018 Call Trace: dump_stack ___might_sleep.cold.92 wait_for_completion ? generic_exec_single rdmsr_safe_on_cpu ? wrmsr_on_cpus mce_amd_feature_init mcheck_cpu_init identify_cpu identify_secondary_cpu smp_store_cpu_info start_secondary secondary_startup_64 The function smca_configure() is called only on the current CPU anyway, therefore replace rdmsr_safe_on_cpu() with atomic rdmsr_safe() and avoid the IPI. [ bp: Update commit message. ] Signed-off-by: Konstantin Khlebnikov Signed-off-by: Borislav Petkov Reviewed-by: Yazen Ghannam Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: linux-edac Cc: Cc: Thomas Gleixner Cc: Tony Luck Cc: x86-ml Link: https://lkml.kernel.org/r/157252708836.3876.4604398213417262402.stgit@buzz commit 1c226017d3ec93547b58082bdf778d9db7401c95 Author: Marek Szyprowski Date: Wed Dec 11 15:52:17 2019 +0100 ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity Current USB3503 driver ignores GPIO polarity and always operates as if the GPIO lines were flagged as ACTIVE_HIGH. Fix the polarity for the existing USB3503 chip applications to match the chip specification and common convention for naming the pins. The only pin, which has to be ACTIVE_LOW is the reset pin. The remaining are ACTIVE_HIGH. This change allows later to fix the USB3503 driver to properly use generic GPIO bindings and read polarity from DT. Signed-off-by: Marek Szyprowski Signed-off-by: Maxime Ripard commit d3aa8de6b5d0853c43c616586b4e232aa1fa7de9 Author: Brendan Higgins Date: Wed Dec 11 11:27:41 2019 -0800 staging: axis-fifo: add unspecified HAS_IOMEM dependency Currently CONFIG_XIL_AXIS_FIFO=y implicitly depends on CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get the following build error: ld: drivers/staging/axis-fifo/axis-fifo.o: in function `axis_fifo_probe': drivers/staging/axis-fifo/axis-fifo.c:809: undefined reference to `devm_ioremap_resource' Fix the build error by adding the unspecified dependency. Reported-by: Brendan Higgins Signed-off-by: Brendan Higgins Link: https://lore.kernel.org/r/20191211192742.95699-7-brendanhiggins@google.com Signed-off-by: Greg Kroah-Hartman commit ab42b48f32d4c766420c3499ee9c0289b7028182 Author: Ian Abbott Date: Mon Dec 16 11:08:23 2019 +0000 staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value The "auto-attach" handler function `gsc_hpdi_auto_attach()` calls `dma_alloc_coherent()` in a loop to allocate some DMA data buffers, and also calls it to allocate a buffer for a DMA descriptor chain. However, it does not check the return value of any of these calls. Change `gsc_hpdi_auto_attach()` to return `-ENOMEM` if any of these `dma_alloc_coherent()` calls fail. This will result in the comedi core calling the "detach" handler `gsc_hpdi_detach()` as part of the clean-up, which will call `gsc_hpdi_free_dma()` to free any allocated DMA coherent memory buffers. Cc: #4.6+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20191216110823.216237-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 228b607d8ea1b7d4561945058d5692709099d432 Author: Marcus Comstedt Date: Sun Dec 15 10:49:00 2019 +0100 KVM: PPC: Book3S HV: Fix regression on big endian hosts VCPU_CR is the offset of arch.regs.ccr in kvm_vcpu. arch/powerpc/include/asm/kvm_host.h defines arch.regs as a struct pt_regs, and arch/powerpc/include/asm/ptrace.h defines the ccr field of pt_regs as "unsigned long ccr". Since unsigned long is 64 bits, a 64-bit load needs to be used to load it, unless an endianness specific correction offset is added to access the desired subpart. In this case there is no reason to _not_ use a 64 bit load though. Fixes: 6c85b7bc637b ("powerpc/kvm: Use UV_RETURN ucall to return to ultravisor") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Marcus Comstedt Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191215094900.46740-1-marcus@mc.pp.se commit ad125c6c05921091daf8ac6f01b5665d5401741b Merge: 95bed1a9fb2b 6fc232db9e8c Author: David S. Miller Date: Mon Dec 16 19:26:11 2019 -0800 Merge tag 'mac80211-for-net-2019-10-16' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== A handful of fixes: * disable AQL on most drivers, addressing the iwlwifi issues * fix double-free on network namespace changes * fix TID field in frames injected through monitor interfaces * fix ieee80211_calc_rx_airtime() * fix NULL pointer dereference in rfkill (and remove BUG_ON) ==================== Signed-off-by: David S. Miller commit 95bed1a9fb2b7ee13b58d0d29710282a62082a89 Author: Arnd Bergmann Date: Mon Dec 16 00:12:14 2019 +0200 net: dsa: ocelot: add NET_VENDOR_MICROSEMI dependency Selecting MSCC_OCELOT_SWITCH is not possible when NET_VENDOR_MICROSEMI is disabled: WARNING: unmet direct dependencies detected for MSCC_OCELOT_SWITCH Depends on [n]: NETDEVICES [=y] && ETHERNET [=n] && NET_VENDOR_MICROSEMI [=n] && NET_SWITCHDEV [=y] && HAS_IOMEM [=y] Selected by [m]: - NET_DSA_MSCC_FELIX [=m] && NETDEVICES [=y] && HAVE_NET_DSA [=y] && NET_DSA [=y] && PCI [=y] Add a Kconfig dependency on NET_VENDOR_MICROSEMI, which also implies CONFIG_NETDEVICES. Depending on a vendor config violates menuconfig locality for the DSA driver, but is the smallest compromise since all other solutions are much more complicated (see [0]). https://www.spinics.net/lists/netdev/msg618808.html Fixes: 56051948773e ("net: dsa: ocelot: add driver for Felix switch family") Signed-off-by: Arnd Bergmann Signed-off-by: Mao Wenan Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 5e822e44cecec1ea48925630aa31dfac827fd202 Author: Gao Fred Date: Tue Dec 17 11:19:58 2019 +0800 drm/i915/gvt: Fix guest boot warning Simulate MIA core in reset status once GUC engine is reset. v2: 1. use vgpu_vreg_t() function, 2. clear MIA_IN_RESET after reading. (Zhenyu) v3: add comments. (Zhenyu) Signed-off-by: Gao Fred Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20191216160255.29499-1-fred.gao@intel.com commit 201743b99c0548ffa8ddbd2571b1dcf4d79b73a9 Author: Arnd Bergmann Date: Mon Dec 16 14:16:49 2019 +0100 scsi: lpfc: fix build failure with DEBUGFS disabled A recent change appears to have moved an #endif by accident: drivers/scsi/lpfc/lpfc_debugfs.c:5393:18: error: 'lpfc_debugfs_dumpHBASlim_open' undeclared here (not in a function); did you mean 'lpfc_debugfs_op_dumpHBASlim'? drivers/scsi/lpfc/lpfc_debugfs.c:5394:18: error: 'lpfc_debugfs_lseek' undeclared here (not in a function); did you mean 'lpfc_debugfs_nvme_trc'? drivers/scsi/lpfc/lpfc_debugfs.c:5395:18: error: 'lpfc_debugfs_read' undeclared here (not in a function); did you mean 'lpfc_debug_dump_q'? drivers/scsi/lpfc/lpfc_debugfs.c:5396:18: error: 'lpfc_debugfs_release' undeclared here (not in a function); did you mean 'lpfc_debugfs_terminate'? drivers/scsi/lpfc/lpfc_debugfs.c:5402:18: error: 'lpfc_debugfs_dumpHostSlim_open' undeclared here (not in a function); did you mean 'lpfc_debugfs_op_dumpHostSlim'? Move it back to where it was previously. Fixes: 95bfc6d8ad86 ("scsi: lpfc: Make FW logging dynamically configurable") Link: https://lore.kernel.org/r/20191216131701.3125077-1-arnd@arndb.de Signed-off-by: Arnd Bergmann Reviewed-by: James Smart Signed-off-by: Martin K. Petersen commit ee560e7bbab0c10cf3f0e71997fbc354ab2ee5cb Author: Dan Carpenter Date: Tue Dec 3 12:36:52 2019 +0300 scsi: mpt3sas: Fix double free in attach error handling The caller also calls _base_release_memory_pools() on error so it leads to a number of double frees: drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->chain_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->hpr_lookup' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->internal_lookup' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->pcie_sgl_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_free_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_post_free_array_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->reply_post_free_dma_pool' double freed drivers/scsi/mpt3sas/mpt3sas_base.c:7207 mpt3sas_base_attach() warn: 'ioc->sense_dma_pool' double freed Fixes: 74522a92bbf0 ("scsi: mpt3sas: Optimize I/O memory consumption in driver.") Link: https://lore.kernel.org/r/20191203093652.gyntgvnkw2udatyc@kili.mountain Signed-off-by: Dan Carpenter Acked-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen commit e18e0f6b7c8f220774dd68965e8a9b046905acc8 Author: Jitao Shi Date: Fri Dec 13 17:52:15 2019 +0800 drm/mediatek: reduce the hbp and hfp for phy timing There are some extra data transfer in dsi. ex. LPX, hs_prepare, hs_zero, hs_exit and the sof/eof of dsi packet. This signal will enlarge the line time. So the real frame on dsi bus will be lower than calc by video timing. So dsi driver reduces the hbp and hfp to keep the line time. Fixes: 7a5bc4e22ecf ("drm/mediatek: change the dsi phytiming calculate method") Signed-off-by: Jitao Shi Tested-by: Hsin-Yi Wang Tested-by: Enric Balletbo i Serra Signed-off-by: CK Hu commit 21df4a8b6018b842d4db181a8b24166006bad3cd Author: Jerry Snitselaar Date: Wed Dec 11 16:54:55 2019 -0700 tpm_tis: reserve chip for duration of tpm_tis_core_init Instead of repeatedly calling tpm_chip_start/tpm_chip_stop when issuing commands to the tpm during initialization, just reserve the chip after wait_startup, and release it when we are ready to call tpm_chip_register. Cc: Christian Bundy Cc: Dan Williams Cc: Peter Huewe Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Stefan Berger Cc: stable@vger.kernel.org Cc: linux-integrity@vger.kernel.org Fixes: a3fbfae82b4c ("tpm: take TPM chip power gating out of tpm_transmit()") Fixes: 5b359c7c4372 ("tpm_tis_core: Turn on the TPM before probing IRQ's") Suggested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jerry Snitselaar Signed-off-by: Jarkko Sakkinen commit ea200dec51285c82655e50ddb774fdb6b97e784d Merge: 6afa873170a6 e3992af1256a Author: Linus Torvalds Date: Mon Dec 16 16:43:07 2019 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Olof Johansson: "I didn't get a batch in this weekend, so here's what we queued up last week and today. - A couple of defconfigs add back debugfs -- it used to be implicitly enabled through CONFIG_TRACING, but 0e4a459f56c32d3e ("tracing: Remove unnecessary DEBUG_FS dependency") removed that. - The rest are mostly minor fixlets of the usual kind; some DT tweaks, a headerfile refactor that needs a build fix now, etc" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (30 commits) ARM: bcm: Add missing sentinel to bcm2711_compat[] ARM: shmobile: defconfig: Restore debugfs support bus: ti-sysc: Fix missing reset delay handling ARM: imx: Fix boot crash if ocotp is not found ARM: imx_v6_v7_defconfig: Explicitly restore CONFIG_DEBUG_FS ARM: dts: imx6ul-evk: Fix peripheral regulator arm64: dts: ls1028a: fix reboot node ARM: mmp: include the correct cputype.h ARM: dts: am437x-gp/epos-evm: fix panel compatible arm64: dts: ls1028a: fix typo in TMU calibration data ARM: imx: Correct ocotp id for serial number support of i.MX6ULL/ULZ SoCs ARM: dts: bcm283x: Fix critical trip point ARM: omap2plus_defconfig: Add back DEBUG_FS ARM: omap2plus_defconfig: enable NET_SWITCHDEV ARM: dts: am335x-sancloud-bbe: fix phy mode bus: ti-sysc: Fix missing force mstandby quirk handling reset: Do not register resource data for missing resets reset: Fix {of,devm}_reset_control_array_get kerneldoc return types reset: brcmstb: Remove resource checks dt-bindings: reset: Fix brcmstb-reset example ... commit f37f710353677639bc5d37ee785335994adf2529 Author: Navid Emamdoost Date: Sat Dec 14 19:10:44 2019 -0600 net: gemini: Fix memory leak in gmac_setup_txqs In the implementation of gmac_setup_txqs() the allocated desc_ring is leaked if TX queue base is not aligned. Release it via dma_free_coherent. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Signed-off-by: Navid Emamdoost Reviewed-by: Linus Walleij Signed-off-by: David S. Miller commit 63cc54a6f0736a432b04308a74677ab0ba8a58ee Author: Florian Fainelli Date: Fri Dec 13 12:00:27 2019 -0800 net: dsa: b53: Fix egress flooding settings There were several issues with 53568438e381 ("net: dsa: b53: Add support for port_egress_floods callback") that resulted in breaking connectivity for standalone ports: - both user and CPU ports must allow unicast and multicast forwarding by default otherwise this just flat out breaks connectivity for standalone DSA ports - IP multicast is treated similarly as multicast, but has separate control registers - the UC, MC and IPMC lookup failure register offsets were wrong, and instead used bit values that are meaningful for the B53_IP_MULTICAST_CTRL register Fixes: 53568438e381 ("net: dsa: b53: Add support for port_egress_floods callback") Signed-off-by: Florian Fainelli Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller commit 1865a7b3471e183bca3ea59c3a6c1950cc9c48ee Merge: fd42bfd1bb31 4aaf596148f4 Author: David S. Miller Date: Mon Dec 16 16:07:12 2019 -0800 Merge branch 'vsock-fixes' Stefano Garzarella says: ==================== vsock/virtio: fix null-pointer dereference and related precautions This series mainly solves a possible null-pointer dereference in virtio_transport_recv_listen() introduced with the multi-transport support [PATCH 1]. PATCH 2 adds a WARN_ON check for the same potential issue and a returned error in the virtio_transport_send_pkt_info() function to avoid crashing the kernel. ==================== Signed-off-by: David S. Miller commit 4aaf596148f4b518244cf2b02fafc53ad586dd6b Author: Stefano Garzarella Date: Fri Dec 13 19:48:01 2019 +0100 vsock/virtio: add WARN_ON check on virtio_transport_get_ops() virtio_transport_get_ops() and virtio_transport_send_pkt_info() can only be used on connecting/connected sockets, since a socket assigned to a transport is required. This patch adds a WARN_ON() on virtio_transport_get_ops() to check this requirement, a comment and a returned error on virtio_transport_send_pkt_info(), Signed-off-by: Stefano Garzarella Signed-off-by: David S. Miller commit df18fa14629ae3ae10f51577642113ccc8ce87d1 Author: Stefano Garzarella Date: Fri Dec 13 19:48:00 2019 +0100 vsock/virtio: fix null-pointer dereference in virtio_transport_recv_listen() With multi-transport support, listener sockets are not bound to any transport. So, calling virtio_transport_reset(), when an error occurs, on a listener socket produces the following null-pointer dereference: BUG: kernel NULL pointer dereference, address: 00000000000000e8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 20 Comm: kworker/0:1 Not tainted 5.5.0-rc1-ste-00003-gb4be21f316ac-dirty #56 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 Workqueue: virtio_vsock virtio_transport_rx_work [vmw_vsock_virtio_transport] RIP: 0010:virtio_transport_send_pkt_info+0x20/0x130 [vmw_vsock_virtio_transport_common] Code: 1f 84 00 00 00 00 00 0f 1f 00 55 48 89 e5 41 57 41 56 41 55 49 89 f5 41 54 49 89 fc 53 48 83 ec 10 44 8b 76 20 e8 c0 ba fe ff <48> 8b 80 e8 00 00 00 e8 64 e3 7d c1 45 8b 45 00 41 8b 8c 24 d4 02 RSP: 0018:ffffc900000b7d08 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88807bf12728 RCX: 0000000000000000 RDX: ffff88807bf12700 RSI: ffffc900000b7d50 RDI: ffff888035c84000 RBP: ffffc900000b7d40 R08: ffff888035c84000 R09: ffffc900000b7d08 R10: ffff8880781de800 R11: 0000000000000018 R12: ffff888035c84000 R13: ffffc900000b7d50 R14: 0000000000000000 R15: ffff88807bf12724 FS: 0000000000000000(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000e8 CR3: 00000000790f4004 CR4: 0000000000160ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: virtio_transport_reset+0x59/0x70 [vmw_vsock_virtio_transport_common] virtio_transport_recv_pkt+0x5bb/0xe50 [vmw_vsock_virtio_transport_common] ? detach_buf_split+0xf1/0x130 virtio_transport_rx_work+0xba/0x130 [vmw_vsock_virtio_transport] process_one_work+0x1c0/0x300 worker_thread+0x45/0x3c0 kthread+0xfc/0x130 ? current_work+0x40/0x40 ? kthread_park+0x90/0x90 ret_from_fork+0x35/0x40 Modules linked in: sunrpc kvm_intel kvm vmw_vsock_virtio_transport vmw_vsock_virtio_transport_common irqbypass vsock virtio_rng rng_core CR2: 00000000000000e8 ---[ end trace e75400e2ea2fa824 ]--- This happens because virtio_transport_reset() calls virtio_transport_send_pkt_info() that can be used only on connecting/connected sockets. This patch fixes the issue, using virtio_transport_reset_no_sock() instead of virtio_transport_reset() when we are handling a listener socket. Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") Signed-off-by: Stefano Garzarella Signed-off-by: David S. Miller commit 1c05839aa973cfae8c3db964a21f9c0eef8fcc21 Author: Mike Christie Date: Sun Dec 8 16:51:50 2019 -0600 nbd: fix shutdown and recv work deadlock v2 This fixes a regression added with: commit e9e006f5fcf2bab59149cb38a48a4817c1b538b4 Author: Mike Christie Date: Sun Aug 4 14:10:06 2019 -0500 nbd: fix max number of supported devs where we can deadlock during device shutdown. The problem occurs if the recv_work's nbd_config_put occurs after nbd_start_device_ioctl has returned and the userspace app has droppped its reference via closing the device and running nbd_release. The recv_work nbd_config_put call would then drop the refcount to zero and try to destroy the config which would try to do destroy_workqueue from the recv work. This patch just has nbd_start_device_ioctl do a flush_workqueue when it wakes so we know after the ioctl returns running works have exited. This also fixes a possible race where we could try to reuse the device while old recv_works are still running. Cc: stable@vger.kernel.org Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs") Signed-off-by: Mike Christie Signed-off-by: Jens Axboe commit d7bd15a138aef3be227818aad9c501e43c89c8c5 Author: Tejun Heo Date: Mon Dec 16 13:34:00 2019 -0800 iocost: over-budget forced IOs should schedule async delay When over-budget IOs are force-issued through root cgroup, iocg_kick_delay() adjusts the async delay accordingly but doesn't actually schedule async throttle for the issuing task. This bug is pretty well masked because sooner or later the offending threads are gonna get directly throttled on regular IOs or have async delay scheduled by mem_cgroup_throttle_swaprate(). However, it can affect control quality on filesystem metadata heavy operations. Let's fix it by invoking blkcg_schedule_throttle() when iocg_kick_delay() says async delay is needed. Signed-off-by: Tejun Heo Fixes: 7caa47151ab2 ("blkcg: implement blk-iocost") Cc: stable@vger.kernel.org Reported-by: Josef Bacik Signed-off-by: Jens Axboe commit 2c81f0f6d3f52ac222a5dc07a6e5c06e1543e88b Author: Tony Lindgren Date: Mon Dec 16 14:41:53 2019 -0800 bus: ti-sysc: Fix iterating over clocks Commit d878970f6ce1 ("bus: ti-sysc: Add separate functions for handling clocks") separated handling of optional clocks from the main clocks, but introduced an issue where we do not necessarily allocate a slot for both fck and ick clocks, but still assume fixed slots for enumerating over the clocks. Let's fix the issue by ensuring we always have slots for both fck and ick even if we don't use ick, and don't attempt to enumerate optional clocks if not allocated. In the long run we might want to simplify things a bit by only allocating space only for the optional clocks as we have only few devices with optional clocks. Fixes: d878970f6ce1 ("bus: ti-sysc: Add separate functions for handling clocks") Signed-off-by: Tony Lindgren commit 90bdfa0b05e3cc809a7c1aa3b1f162b46ea1b330 Author: Tony Lindgren Date: Mon Dec 16 14:41:53 2019 -0800 ARM: OMAP2+: Fix ti_sysc_find_one_clockdomain to check for to_clk_hw_omap We must bail out early if the clock is not hw_omap. Otherwise we will try to access invalid address with hwclk->clkdm_name: Unable to handle kernel paging request at virtual address ffffffff Internal error: Oops: 27 [#1] ARM ... (strcmp) from [] (clkdm_lookup+0x40/0x60) [] (clkdm_lookup) from [] (ti_sysc_clkdm_init+0x5c/0x64) [] (ti_sysc_clkdm_init) from [] (sysc_probe+0x948/0x117c) [] (sysc_probe) from [] (platform_drv_probe+0x48/0x98) ... Fixes: 2b2f7def058a ("bus: ti-sysc: Add support for missing clockdomain handling") Signed-off-by: Tony Lindgren commit 210de0e996aee8e360ccc9e173fe7f0a7ed2f695 Author: Dinh Nguyen Date: Wed Nov 20 09:15:17 2019 -0600 arm64: dts: agilex/stratix10: fix pmu interrupt numbers Fix up the correct interrupt numbers for the PMU unit on Agilex and Stratix10. Fixes: 78cd6a9d8e15 ("arm64: dts: Add base stratix 10 dtsi") Cc: linux-stable Reported-by: Meng Li Signed-off-by: Dinh Nguyen commit e3992af1256a4fe0b83ac790d4caa58ff731609d Merge: c3e5ac0c9e98 59034b9d6af8 Author: Olof Johansson Date: Mon Dec 16 11:33:29 2019 -0800 Merge tag 'arm-soc/for-5.5/soc-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs machine fixes for 5.5-rc1, please pull the following: - H. Nikolaus adds a missing sentinel entry to the BCM2711 machine descriptor compatible array which would make multiplatform kernels fail to boot * tag 'arm-soc/for-5.5/soc-fixes' of https://github.com/Broadcom/stblinux: ARM: bcm: Add missing sentinel to bcm2711_compat[] Link: https://lore.kernel.org/r/20191216035701.15534-1-f.fainelli@gmail.com Signed-off-by: Olof Johansson commit c3e5ac0c9e98af139500e64ef413cefcf311eaff Merge: cf21d4fde012 a2315d3aea59 Author: Olof Johansson Date: Mon Dec 16 11:33:13 2019 -0800 Merge tag 'samsung-fixes-5.5' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/fixes Samsung fixes for v5.5 1. Restore debugfs support in exynos_defconfig (as now it is not selected as dependency of tracing). Debugfs is required by systemd and several tests. 2. Maintainers updates. * tag 'samsung-fixes-5.5' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: exynos_defconfig: Restore debugfs support MAINTAINERS: Include Samsung SoC serial driver in Samsung SoC entry MAINTAINERS: Update Lukasz Luba's email address Link: https://lore.kernel.org/r/20191215121316.32091-1-krzk@kernel.org Signed-off-by: Olof Johansson commit cf21d4fde012969ab6df3fa10976fd7e0bfcd3f7 Merge: 9a4b8148562d fa2cdb1762d1 Author: Olof Johansson Date: Mon Dec 16 11:33:04 2019 -0800 Merge tag 'renesas-fixes-for-v5.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas fixes for v5.5 - Restore debugfs support * tag 'renesas-fixes-for-v5.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: ARM: shmobile: defconfig: Restore debugfs support Link: https://lore.kernel.org/r/20191213213719.18122-1-geert+renesas@glider.be Signed-off-by: Olof Johansson commit a2ea07465c8d7984cc6b8b1f0b3324f9b138094a Author: Daniel Borkmann Date: Mon Dec 16 17:49:00 2019 +0100 bpf: Fix missing prog untrack in release_maps Commit da765a2f5993 ("bpf: Add poke dependency tracking for prog array maps") wrongly assumed that in case of prog load errors, we're cleaning up all program tracking via bpf_free_used_maps(). However, it can happen that we're still at the point where we didn't copy map pointers into the prog's aux section such that env->prog->aux->used_maps is still zero, running into a UAF. In such case, the verifier has similar release_maps() helper that drops references to used maps from its env. Consolidate the release code into __bpf_free_used_maps() and call it from all sides to fix it. Fixes: da765a2f5993 ("bpf: Add poke dependency tracking for prog array maps") Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/1c2909484ca524ae9f55109b06f22b6213e76376.1576514756.git.daniel@iogearbox.net commit 6afa873170a612b2b9e392c19c523ed8aae6fbc9 Merge: 4c80ba392bf6 4eac734486fd Author: Linus Torvalds Date: Mon Dec 16 10:06:04 2019 -0800 Merge tag 'linux-kselftest-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: - ftrace and safesetid test fixes from Masami Hiramatsu - Kunit fixes from Brendan Higgins, Iurii Zaikin, and Heidi Fahim - Kselftest framework fixes from SeongJae Park and Michael Ellerman * tag 'linux-kselftest-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kselftest: Support old perl versions kselftest/runner: Print new line in print of timeout log selftests: Fix dangling documentation references to kselftest_module.sh Documentation: kunit: add documentation for kunit_tool Documentation: kunit: fix typos and gramatical errors kunit: testing kunit: Bug fix in test_run_timeout function fs/ext4/inode-test: Fix inode test on 32 bit platforms. selftests: safesetid: Fix Makefile to set correct test program selftests: safesetid: Check the return value of setuid/setgid selftests: safesetid: Move link library to LDLIBS selftests/ftrace: Fix multiple kprobe testcase selftests/ftrace: Do not to use absolute debugfs path selftests/ftrace: Fix ftrace test cases to check unsupported selftests/ftrace: Fix to check the existence of set_ftrace_filter commit 6956eb33abb5deab2cd916b4c31226b57736bc3c Author: Alexandre Belloni Date: Thu Nov 28 11:25:31 2019 +0100 clk: at91: fix possible deadlock Lockdep warns about a possible circular locking dependency because using syscon_node_to_regmap() will make the created regmap get and enable the first clock it can parse from the device tree. This clock is not needed to access the registers and should not be enabled at that time. Use the recently introduced device_node_to_regmap to solve that as it looks up the regmap in the same list but doesn't care about the clocks. Reported-by: Michał Mirosław Signed-off-by: Alexandre Belloni Link: https://lkml.kernel.org/r/20191128102531.817549-1-alexandre.belloni@bootlin.com Tested-by: Michał Mirosław Signed-off-by: Stephen Boyd commit e0ff126ee7ad405c1ef531f9f3db92929de4f20f Author: Jan Kara Date: Mon Dec 16 11:54:32 2019 +0100 pipe: Fix bogus dereference in iov_iter_alignment() We cannot look at 'i->pipe' unless we know the iter is a pipe. Move the ring_size load to a branch in iov_iter_alignment() where we've already checked the iter is a pipe to avoid bogus dereference. Reported-by: syzbot+bea68382bae9490e7dd6@syzkaller.appspotmail.com Fixes: 8cefc107ca54 ("pipe: Use head and tail pointers for the ring, not cursor and length") Signed-off-by: Jan Kara Signed-off-by: Al Viro commit 4c80ba392bf603d468ea827d902f8e7b2505fbf4 Author: Eric Auger Date: Tue Nov 26 18:54:13 2019 +0100 iommu: fix KASAN use-after-free in iommu_insert_resv_region In case the new region gets merged into another one, the nr list node is freed. Checking its type while completing the merge algorithm leads to a use-after-free. Use new->type instead. Fixes: 4dbd258ff63e ("iommu: Revisit iommu_insert_resv_region() implementation") Signed-off-by: Eric Auger Reported-by: Qian Cai Reviewed-by: Jerry Snitselaar Cc: Stable #v5.3+ Signed-off-by: Linus Torvalds commit 7de7de7ca0ae0fc70515ee3154af33af75edae2c Author: Linus Torvalds Date: Sun Dec 15 19:50:23 2019 -0800 Fix root mounting with no mount options The "trivial conversion" in commit cccaa5e33525 ("init: use do_mount() instead of ksys_mount()") was totally broken, since it didn't handle the case of a NULL mount data pointer. And while I had "tested" it (and presumably Dominik had too) that bug was hidden by me having options. Cc: Dominik Brodowski Cc: Arnd Bergmann Reported-by: Ondřej Jirman Reported-by: Guenter Roeck Reported-by: Naresh Kamboju Reported-and-tested-by: Borislav Petkov Tested-by: Chris Clayton Tested-by: Eric Biggers Tested-by: Geert Uytterhoeven Tested-by: Guido Günther Signed-off-by: Linus Torvalds commit 58b3bafff8257c6946df5d6aeb215b8ac839ed2a Author: Ed Maste Date: Thu Dec 12 14:53:46 2019 +0000 perf vendor events s390: Remove name from L1D_RO_EXCL_WRITES description In 7fcfa9a2d9 an unintended prefix "Counter:18 Name:" was removed from the description for L1D_RO_EXCL_WRITES, but the extra name remained in the description. Remove it too. Fixes: 7fcfa9a2d9a7 ("perf list: Fix s390 counter long description for L1D_RO_EXCL_WRITES") Signed-off-by: Ed Maste Cc: Alexander Shishkin Cc: Greentime Hu Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Nick Hu Cc: Peter Zijlstra Cc: Thomas Richter Cc: Vincent Chen Link: http://lore.kernel.org/lkml/20191212145346.5026-1-emaste@freefall.freebsd.org Signed-off-by: Arnaldo Carvalho de Melo commit 28396b7df09b9565f404591c9945eac43526cb3f Author: Ed Maste Date: Thu Dec 12 14:34:46 2019 +0000 perf vendor events s390: Fix counter long description for DTLB1_GPAGE_WRITES The cf_z13 counter DTLB1_GPAGE_WRITES included a prefix 'Counter:132\tName:'. This is incorrect; remove the prefix as with 7fcfa9a2d9 for cf_z14. Signed-off-by: Ed Maste Cc: Alexander Shishkin Cc: Greentime Hu Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Nick Hu Cc: Peter Zijlstra Cc: Thomas Richter Cc: Vincent Chen Link: http://lore.kernel.org/lkml/20191212143446.88582-1-emaste@freefall.freebsd.org Signed-off-by: Arnaldo Carvalho de Melo commit c09982f8e2bae80a66232630ec4ba50afacea486 Author: Sudip Mukherjee Date: Sat Dec 7 11:14:40 2019 +0000 libtraceevent: Allow custom libdir path When I use prefix=/usr and try to install libtraceevent in my laptop it tries to install in /usr/lib64. I am not having any folder as /usr/lib64 and also the debian policy doesnot allow installing in /usr/lib64. It should be in /usr/lib/x86_64-linux-gnu/. Quote: No package for a 64 bit architecture may install files in /usr/lib64/ or in a subdirectory of it. ref: https://www.debian.org/doc/debian-policy/ch-opersys.html Make it more flexible by allowing to mention libdir_relative while installing so that distros can mention the path according to their policy or use the default one. Signed-off-by: Sudipm Mukherjee Reviewed-by: Steven Rostedt (VMware) Cc: Sudipm Mukherjee Cc: linux-trace-devel@vger.kernel.org Link: http://lore.kernel.org/lkml/20191207111440.6574-1-sudipm.mukherjee@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 475feec0c41ad71cb7d02f0310e56256606b57c5 Author: Takashi Iwai Date: Mon Dec 16 16:12:24 2019 +0100 ALSA: hda - Downgrade error message for single-cmd fallback We made the error message for the CORB/RIRB communication clearer by upgrading to dev_WARN() so that user can notice better. But this struck us like a boomerang: now it caught syzbot and reported back as a fatal issue although it's not really any too serious bug that worth for stopping the whole system. OK, OK, let's be softy, downgrade it to the standard dev_err() again. Fixes: dd65f7e19c69 ("ALSA: hda - Show the fatal CORB/RIRB error more clearly") Reported-by: syzbot+b3028ac3933f5c466389@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20191216151224.30013-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 6bd5ce6089b561f5392460bfb654dea89356ab1b Author: Tetsuo Handa Date: Mon Dec 16 19:16:48 2019 +0900 tomoyo: Suppress RCU warning at list_for_each_entry_rcu(). John Garry has reported that allmodconfig kernel on arm64 causes flood of "RCU-list traversed in non-reader section!!" warning. I don't know what change caused this warning, but this warning is safe because TOMOYO uses SRCU lock instead. Let's suppress this warning by explicitly telling that the caller is holding SRCU lock. Reported-and-tested-by: John Garry Signed-off-by: Tetsuo Handa commit 61e3acd8c693a14fc69b824cb5b08d02cb90a6e7 Author: Andrew Donnellan Date: Tue Dec 10 00:22:21 2019 +1100 powerpc: Fix __clear_user() with KUAP enabled The KUAP implementation adds calls in clear_user() to enable and disable access to userspace memory. However, it doesn't add these to __clear_user(), which is used in the ptrace regset code. As there's only one direct user of __clear_user() (the regset code), and the time taken to set the AMR for KUAP purposes is going to dominate the cost of a quick access_ok(), there's not much point having a separate path. Rename __clear_user() to __arch_clear_user(), and make __clear_user() just call clear_user(). Reported-by: syzbot+f25ecf4b2982d8c7a640@syzkaller-ppc64.appspotmail.com Reported-by: Daniel Axtens Suggested-by: Michael Ellerman Fixes: de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection") Signed-off-by: Andrew Donnellan [mpe: Use __arch_clear_user() for the asm version like arm64 & nds32] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191209132221.15328-1-ajd@linux.ibm.com commit e352f576d345e5bf1fb62c8559851448a6c1d9cd Author: David Hildenbrand Date: Mon Dec 16 11:30:58 2019 +0100 powerpc/pseries/cmm: fix managed page counts when migrating pages between zones Commit 63341ab03706 (virtio-balloon: fix managed page counts when migrating pages between zones) fixed a long existing BUG in the virtio-balloon driver when pages would get migrated between zones. I did not try to reproduce on powerpc, but looking at the code, the same should apply to powerpc/cmm ever since it started using the balloon compaction infrastructure (luckily just recently). In case we have to migrate a ballon page to a newpage of another zone, the managed page count of both zones is wrong. Paired with memory offlining (which will adjust the managed page count), we can trigger kernel crashes and all kinds of different symptoms. Fix it by properly adjusting the managed page count when migrating if the zone changed. We'll temporarily modify the totalram page count. If this ever becomes a problem, we can fine tune by providing helpers that don't touch the totalram pages (e.g., adjust_zone_managed_page_count()). Fixes: fe030c9b85e6 ("powerpc/pseries/cmm: Implement balloon compaction") Signed-off-by: David Hildenbrand Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191216103058.4958-1-david@redhat.com commit 0601546f23fb70d84b807e73cfe8e789d054c98d Author: Christophe Leroy Date: Sat Dec 14 08:10:29 2019 +0000 powerpc/8xx: fix bogus __init on mmu_mapin_ram_chunk() Remove __init qualifier for mmu_mapin_ram_chunk() as it is called by mmu_mark_initmem_nx() and mmu_mark_rodata_ro() which are not __init functions. At the same time, mark it static as it is only used in this file. Reported-by: kbuild test robot Fixes: a2227a277743 ("powerpc/32: Don't populate page tables for block mapped pages except on the 8xx") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/56648921986a6b3e7315b1fbbf4684f21bd2dea8.1576310997.git.christophe.leroy@c-s.fr commit 63aa6a692595d47a0785297b481072086b9272d2 Author: Christophe Leroy Date: Thu Dec 12 17:47:24 2019 +0000 spi: fsl: use platform_get_irq() instead of of_irq_to_resource() Unlike irq_of_parse_and_map() which has a dummy definition on SPARC, of_irq_to_resource() hasn't. But as platform_get_irq() can be used instead and is generic, use it. Reported-by: kbuild test robot Suggested-by: Mark Brown Fixes: 3194d2533eff ("spi: fsl: don't map irq during probe") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Link: https://lore.kernel.org/r/091a277fd0b3356dca1e29858c1c96983fc9cb25.1576172743.git.christophe.leroy@c-s.fr Signed-off-by: Mark Brown commit 007773e16a6f3f49d1439554078c3ba8af131998 Author: Michael Walle Date: Wed Dec 11 20:57:30 2019 +0100 spi: nxp-fspi: Ensure width is respected in spi-mem operations Make use of a core helper to ensure the desired width is respected when calling spi-mem operators. Otherwise only the SPI controller will be matched with the flash chip, which might lead to wrong widths. Also consider the width specified by the user in the device tree. Fixes: a5356aef6a90 ("spi: spi-mem: Add driver for NXP FlexSPI controller") Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20191211195730.26794-1-michael@walle.cc Signed-off-by: Mark Brown commit 62a1923cc8fe095912e6213ed5de27abbf1de77e Author: Andreas Kemnade Date: Wed Dec 11 23:16:00 2019 +0100 regulator: rn5t618: fix module aliases platform device aliases were missing, preventing autoloading of module. Fixes: 811b700630ff ("regulator: rn5t618: add driver for Ricoh RN5T618 regulators") Signed-off-by: Andreas Kemnade Link: https://lore.kernel.org/r/20191211221600.29438-1-andreas@kemnade.info Signed-off-by: Mark Brown commit 0d3010fa442429f8780976758719af05592ff19f Author: Daniele Palmas Date: Fri Dec 13 14:56:15 2019 +0100 USB: serial: option: add Telit ME910G1 0x110a composition This patch adds the following Telit ME910G1 composition: 0x110a: tty, tty, tty, rmnet Signed-off-by: Daniele Palmas Cc: stable Signed-off-by: Johan Hovold commit 556672d75ff486e0b6786056da624131679e0576 Author: Shengjiu Wang Date: Wed Dec 11 19:57:22 2019 +0800 ASoC: wm8962: fix lambda value According to user manual, it is required that FLL_LAMBDA > 0 in all cases (Integer and Franctional modes). Fixes: 9a76f1ff6e29 ("ASoC: Add initial WM8962 CODEC driver") Signed-off-by: Shengjiu Wang Acked-by: Charles Keepax Link: https://lore.kernel.org/r/1576065442-19763-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 2c92dd20304f505b6ef43d206fff21bda8f1f0ae Author: Faiz Abbas Date: Fri Dec 6 17:13:26 2019 +0530 mmc: sdhci: Update the tuning failed messages to pr_debug level Tuning support in DDR50 speed mode was added in SD Specifications Part1 Physical Layer Specification v3.01. Its not possible to distinguish between v3.00 and v3.01 from the SCR and that is why since commit 4324f6de6d2e ("mmc: core: enable CMD19 tuning for DDR50 mode") tuning failures are ignored in DDR50 speed mode. Cards compatible with v3.00 don't respond to CMD19 in DDR50 and this error gets printed during enumeration and also if retune is triggered at any time during operation. Update the printk level to pr_debug so that these errors don't lead to false error reports. Signed-off-by: Faiz Abbas Cc: stable@vger.kernel.org # v4.4+ Link: https://lore.kernel.org/r/20191206114326.15856-1-faiz_abbas@ti.com Signed-off-by: Ulf Hansson commit 8b6dc6b2d60221e90703babbc141f063b8a07e72 Author: Rasmus Villemoes Date: Wed Dec 4 09:54:46 2019 +0100 mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support" This reverts commit 5dd195522562542bc6ebe6e7bd47890d8b7ca93c. First, the fix seems to be plain wrong, since the erratum suggests waiting 5ms before setting setting SYSCTL[RSTD], but this msleep() happens after the call of sdhci_reset() which is where that bit gets set (if SDHCI_RESET_DATA is in mask). Second, walking the whole device tree to figure out if some node has a "fsl,p2020-esdhc" compatible string is hugely expensive - about 70 to 100 us on our mpc8309 board. Walking the device tree is done under a raw_spin_lock, so this is obviously really bad on an -rt system, and a waste of time on all. In fact, since esdhc_reset() seems to get called around 100 times per second, that mpc8309 now spends 0.8% of its time determining that it is not a p2020. Whether those 100 calls/s are normal or due to some other bug or misconfiguration, regularly hitting a 100 us non-preemptible window is unacceptable. Signed-off-by: Rasmus Villemoes Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191204085447.27491-1-linux@rasmusvillemoes.dk Signed-off-by: Ulf Hansson commit 8f34e5bd7024d1ffebddd82d7318b1be17be9e9a Author: Chaotian Jing Date: Wed Dec 4 15:19:58 2019 +0800 mmc: mediatek: fix CMD_TA to 2 for MT8173 HS200/HS400 mode there is a chance that always get response CRC error after HS200 tuning, the reason is that need set CMD_TA to 2. this modification is only for MT8173. Signed-off-by: Chaotian Jing Tested-by: Hsin-Yi Wang Cc: stable@vger.kernel.org Fixes: 1ede5cb88a29 ("mmc: mediatek: Use data tune for CMD line tune") Link: https://lore.kernel.org/r/20191204071958.18553-1-chaotian.jing@mediatek.com Signed-off-by: Ulf Hansson commit fa56ac9792265354b565f28def7164e7d7db2b1e Author: Veerabhadrarao Badiganti Date: Tue Nov 26 10:19:16 2019 +0000 mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG register The DDR_CONFIG register offset got updated after a specific minor version of sdcc V4. This offset change has not been properly taken care of while updating register changes for sdcc V5. Correcting proper offset for this register. Also updating this register value to reflect the recommended RCLK delay. Signed-off-by: Veerabhadrarao Badiganti Link: https://lore.kernel.org/r/0101016ea738ec72-fa0f852d-20f8-474a-80b2-4b0ef63b132c-000000@us-west-2.amazonses.com Fixes: f15358885dda ("mmc: sdhci-msm: Define new Register address map") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 07bcc411567cb96f9d1fc84fff8d387118a2920d Author: Faiz Abbas Date: Thu Nov 28 16:34:22 2019 +0530 Revert "mmc: sdhci: Fix incorrect switch to HS mode" This reverts commit c894e33ddc1910e14d6f2a2016f60ab613fd8b37. This commit aims to treat SD High speed and SDR25 as the same while setting UHS Timings in HOST_CONTROL2 which leads to failures with some SD cards in AM65x. Revert this commit. The issue this commit was trying to fix can be implemented in a platform specific callback instead of common sdhci code. Cc: Signed-off-by: Faiz Abbas Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20191128110422.25917-1-faiz_abbas@ti.com Signed-off-by: Ulf Hansson commit 9e65527ac3bab5480529d1ad07d4d228cc0295cd Author: Paul Cercueil Date: Tue Dec 10 17:44:46 2019 +0100 pinctrl: ingenic: Fixup PIN_CONFIG_OUTPUT config JZ4760 support was added in parallel of the previous patch so this one slipped through. The first SoC to use the new register is the JZ4760 and not the JZ4770, fix it here. Fixes: 7009d046a601 ("pinctrl: ingenic: Handle PIN_CONFIG_OUTPUT config") Signed-off-by: Paul Cercueil Link: https://lore.kernel.org/r/20191210164446.53912-1-paul@crapouillou.net [Folded into OF dependency] Signed-off-by: Linus Walleij commit 286e7beaa4cc7734894ee214569de4669ed9891e Author: Thierry Reding Date: Fri Dec 13 14:00:34 2019 +0100 gpio: tegra186: Allow building on Tegra194-only configurations The driver is compatible with both Tegra186 and Tegra194, but currently it cannot be selected if only Tegra194 support is enabled. Allow builds with only Tegra194 support enabled to select this driver. While at it, select this driver by default on Tegra194 builds because it is an essential part of the system. Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20191213130034.219227-1-thierry.reding@gmail.com Signed-off-by: Linus Walleij commit 5665a1febfe7bbb8c166fcf16856ef2730f947c0 Author: Matt Roper Date: Thu Dec 12 16:15:10 2019 -0800 drm/i915/tgl: Drop Wa#1178 The TGL workaround database no longer shows Wa #1178 (or anything similar under different workaround names/numbers) so we should be able to drop it. In fact Swati just discovered that applying this workaround is the root cause of some power well enable failures we've been seeing in CI (gitlab issue 498). Once we stop applying this WA, TGL no longer utilizes any of the special handling provided by icl_combo_phy_aux_power_well_ops so we can just drop back to using the standard hsw-style power well ops instead. v3: Drop now-unused _TGL_AUX_ANAOVRD1_C definition too. (Lucas) Closes: https://gitlab.freedesktop.org/drm/intel/issues/498 Fixes: deea06b47574 ("drm/i915/tgl: apply Display WA #1178 to fix type C dongles") Cc: Lucas De Marchi Cc: Swati Sharma Cc: Imre Deak Signed-off-by: Matt Roper Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20191213001511.678070-3-matthew.d.roper@intel.com (cherry picked from commit ab3402581d0fa58e63e36875995f43ab02b4d0a0) Signed-off-by: Joonas Lahtinen commit 2eeab8eb1e3a04a644cbcb8c568c26c66ea12f02 Author: Matt Roper Date: Thu Dec 12 16:15:09 2019 -0800 drm/i915/ehl: Define EHL powerwells independently of ICL Outputs C and D on EHL are combo PHY outputs and thus should not be using the same TC AUX power well handlers as ICL. And even though icl_combo_phy_aux_power_well_ops works okay for EHL/JSL combo PHYs none of its special handling is actually necessary for this platform: * EHL/JSL don't actually need to program PORT_CL_DW12 * Display WA #1178 does not apply to EHL/JSL Thus we can simply drop back to using our standard "hsw-style" power well ops for EHL AUX power wells. Bspec: 4301 Fixes: f722b8c1e2a2 ("drm/i915/ehl: All EHL ports are combo phys") Cc: Jose Souza Cc: Bob Paauwe Cc: Vivek Kasireddy Cc: Lucas De Marchi Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20191213001511.678070-2-matthew.d.roper@intel.com Reviewed-by: Lucas De Marchi (cherry picked from commit e8ab8d669d046a8e9b07707d2f00b9ba3e25d0ae) Signed-off-by: Joonas Lahtinen commit 242bff7fc515d8e5275e5b8cd8c9c85a8d037dbf Author: Chris Wilson Date: Thu Dec 12 15:42:24 2019 +0000 drm/i915: Set fence_work.ops before dma_fence_init Since dma_fence_init may call ops (because of a meaningless trace_dma_fence), we need to set the worker ops prior to that call. Reported-by: Vince Weaver Fixes: 8e458fe2ee05 ("drm/i915: Generalise the clflush dma-worker") Signed-off-by: Chris Wilson Cc: Matthew Auld Cc: Vince Weaver Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20191212154224.1631531-1-chris@chris-wilson.co.uk (cherry picked from commit 1bc9865d8df3e1c6857a27c4b2b8a9ce8f027349) Signed-off-by: Joonas Lahtinen commit 99de95360faa769d970059c5b16abf85c53d7b31 Author: Chris Wilson Date: Tue Dec 10 15:13:32 2019 +0000 drm/i915: Copy across scheduler behaviour flags across submit fences We want the bonded request to have the same scheduler properties as its master so that it is placed at the same depth in the queue. For example, consider we have requests A, B and B', where B & B' are a bonded pair to run in parallel on two engines. A -> B \- B' B will run after A and so may be scheduled on an idle engine and wait on A using a semaphore. B' sees B being executed and so enters the queue on the same engine as A. As B' did not inherit the semaphore-chain from B, it may have higher precedence than A and so preempts execution. However, B' then sits on a semaphore waiting for B, who is waiting for A, who is blocked by B. Ergo B' needs to inherit the scheduler properties from B (i.e. the semaphore chain) so that it is scheduled with the same priority as B and will not be executed ahead of Bs dependencies. Furthermore, to prevent the priorities changing via the expose fence on B', we need to couple in the dependencies for PI. This requires us to relax our sanity-checks that dependencies are strictly in order. v2: Synchronise (B, B') execution on all platforms, regardless of using a scheduler, any no-op syncs should be elided. Fixes: ee1136908e9b ("drm/i915/execlists: Virtual engine bonding") Closes: https://gitlab.freedesktop.org/drm/intel/issues/464 Testcase: igt/gem_exec_balancer/bonded-chain Testcase: igt/gem_exec_balancer/bonded-semaphore Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191210151332.3902215-1-chris@chris-wilson.co.uk (cherry picked from commit c81471f5e95c79c55687282ff6800f112b5d560b) Signed-off-by: Joonas Lahtinen commit fbc44a0b34a10e6cbe86b41617aaff25292d9a4c Author: Animesh Manna Date: Thu Dec 5 18:05:13 2019 +0530 drm/i915/dsb: Fix in mmio offset calculation of DSB instance As the current usage is restricted to first DSB instance per pipe, so existing code could not catch the issue to calculate the mmio offset of different DSB instance per pipe. Corrected the offset calculation. Fixes: a6e58d9a2e04 ("drm/i915/dsb: Check DSB engine status.") Signed-off-by: Animesh Manna Reviewed-by: Anshuman Gupta Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20191205123513.22603-1-animesh.manna@intel.com (cherry picked from commit d04a661a2c7169b48782aa5e9d85d4b4383d562e) Signed-off-by: Joonas Lahtinen commit 6fc232db9e8cd50b9b83534de9cd91ace711b2d7 Author: Aditya Pakki Date: Sun Dec 15 09:34:08 2019 -0600 rfkill: Fix incorrect check to avoid NULL pointer dereference In rfkill_register, the struct rfkill pointer is first derefernced and then checked for NULL. This patch removes the BUG_ON and returns an error to the caller in case rfkill is NULL. Signed-off-by: Aditya Pakki Link: https://lore.kernel.org/r/20191215153409.21696-1-pakki001@umn.edu Signed-off-by: Johannes Berg commit 97583f1d43b4f14312745085a7d565f0b76aa4ca Merge: d1eef1c61974 68a1fdf2451f Author: Greg Kroah-Hartman Date: Mon Dec 16 10:12:43 2019 +0100 Merge tag 'misc-habanalabs-fixes-2019-12-14' of git://people.freedesktop.org/~gabbayo/linux into char-misc-linus Oded writes: This tag contains the following fixes: - change dev_err to dev_err_ratelimited in hl_cs_wait_ioctl() as this can be called by the user multiple times and can spam the kernel log. - Eliminate GCC warnings by removing unused variables. * tag 'misc-habanalabs-fixes-2019-12-14' of git://people.freedesktop.org/~gabbayo/linux: habanalabs: remove variable 'val' set but not used habanalabs: rate limit error msg on waiting for CS commit 0b416c3e1345fd696db4c422643468d844410877 Author: Jens Axboe Date: Sun Dec 15 10:57:46 2019 -0700 io_uring: fix sporadic -EFAULT from IORING_OP_RECVMSG If we have to punt the recvmsg to async context, we copy all the context. But since the iovec used can be either on-stack (if small) or dynamically allocated, if it's on-stack, then we need to ensure we reset the iov pointer. If we don't, then we're reusing old stack data, and that can lead to -EFAULTs if things get overwritten. Ensure we retain the right pointers for the iov, and free it as well if we end up having to go beyond UIO_FASTIOV number of vectors. Fixes: 03b1230ca12a ("io_uring: ensure async punted sendmsg/recvmsg requests copy data") Reported-by: 李通洲 Signed-off-by: Jens Axboe commit 26a7a47510ed12cbbce689184c8d6b63062b4fb9 Author: Dmitry Osipenko Date: Mon Nov 18 19:45:08 2019 +0300 cpufreq: dt-platdev: Blacklist NVIDIA Tegra20 and Tegra30 SoCs Both NVIDIA Tegra20 and Tegra30 SoCs should be blacklisted because CPU OPPs use supported_hw and thus platdev isn't suitable for these SoCs. Currently cpufreq-dt driver produces a bit annoying warning splats during boot because valid OPPs are not found, this will be fixed once tegra20-cpufreq driver will be update to support cpufreq-dt. The warnings will also happen on older stable kernels using newer device-trees, thus this patch should be backported to stable kernels as well. Cc: Reported-by: Jon Hunter Fixes: 4053aa65c517 ("ARM: tegra: cardhu-a04: Add CPU Operating Performance Points") Signed-off-by: Dmitry Osipenko Signed-off-by: Viresh Kumar commit 59034b9d6af8ccc1de0a265ca90b3aa967bae19f Author: H. Nikolaus Schaller Date: Sun Dec 15 08:49:02 2019 +0100 ARM: bcm: Add missing sentinel to bcm2711_compat[] commit 781fa0a95424 ("ARM: bcm: Add support for BCM2711 SoC") breaks boot of many other platforms (e.g. OMAP or i.MX6) if CONFIG_ARCH_BCM2835 is enabled in addition to some multiplatform config (e.g. omap2plus_defconfig). The symptom is that the OMAP based board does not show any activity beyond "Starting Kernel ..." even with earlycon. Reverting the mentioned commit makes it work again. The real fix is to add the missing NULL sentinel to the bcm2711_compat[] variable-length array. Fixes: 781fa0a95424 ("ARM: bcm: Add support for BCM2711 SoC") Acked-by: Stefan Wahren Signed-off-by: H. Nikolaus Schaller Signed-off-by: Florian Fainelli commit d82d47d5d8a6d40bb622cef31b6c6fa09cbd01ea Author: Randy Dunlap Date: Sun Dec 8 20:31:32 2019 -0800 jbd2: fix kernel-doc notation warning Fix kernel-doc warning by inserting a beginning '*' character for the kernel-doc line. ../include/linux/jbd2.h:461: warning: bad line: journal. These are dirty buffers and revoke descriptor blocks. Link: https://lore.kernel.org/r/53e3ce27-ceae-560d-0fd4-f95728a33e12@infradead.org Cc: stable@kernel.org Signed-off-by: Randy Dunlap Signed-off-by: Theodore Ts'o commit 69000d82eee1b41d88afc75861153b7e514bb777 Author: Phong Tran Date: Fri Dec 13 22:33:07 2019 +0700 ext4: use RCU API in debug_print_tree struct ext4_sb_info.system_blks was marked __rcu. But access the pointer without using RCU lock and dereference. Sparse warning with __rcu notation: block_validity.c:139:29: warning: incorrect type in argument 1 (different address spaces) block_validity.c:139:29: expected struct rb_root const * block_validity.c:139:29: got struct rb_root [noderef] * Link: https://lore.kernel.org/r/20191213153306.30744-1-tranmanphong@gmail.com Reviewed-by: Jan Kara Signed-off-by: Phong Tran Signed-off-by: Theodore Ts'o commit d1eef1c619749b2a57e514a3fa67d9a516ffa919 Author: Linus Torvalds Date: Sun Dec 15 15:16:08 2019 -0800 Linux 5.5-rc2 commit 9803387c55f7d2ce69aa64340c5fdc6b3027dbc8 Author: Theodore Ts'o Date: Sun Dec 15 01:09:03 2019 -0500 ext4: validate the debug_want_extra_isize mount option at parse time Instead of setting s_want_extra_size and then making sure that it is a valid value afterwards, validate the field before we set it. This avoids races and other problems when remounting the file system. Link: https://lore.kernel.org/r/20191215063020.GA11512@mit.edu Cc: stable@kernel.org Signed-off-by: Theodore Ts'o Reported-and-tested-by: syzbot+4a39a025912b265cacef@syzkaller.appspotmail.com commit 9603e22104439ddfa6a077f1a0e5d8c662beec6c Merge: 1522d9da40bd dc2316eba73f Author: Linus Torvalds Date: Sun Dec 15 14:58:13 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Doug Ledford: "A small collection of -rc fixes. Mostly. One API addition, but that's because we wanted to use it in a fix. There's also a bug fix that is going to render the 5.5 kernel's soft-RoCE driver incompatible with all soft-RoCE versions prior, but it's required to actually implement the protocol according to the RoCE spec and required in order for the soft-RoCE driver to be able to successfully work with actual RoCE hardware. Summary: - Update Steve Wise info - Fix for soft-RoCE crc calculations (will break back compatibility, but only with the soft-RoCE driver, which has had this bug since it was introduced and it is an on-the-wire bug, but will make soft-RoCE fully compatible with real RoCE hardware) - cma init fixup - counters oops fix - fix for mlx4 init/teardown sequence - fix for mkx5 steering rules - introduce a cleanup API, which isn't a fix, but we want to use it in the next fix - fix for mlx5 memory management that uses API in previous patch" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: IB/mlx5: Fix device memory flows IB/core: Introduce rdma_user_mmap_entry_insert_range() API IB/mlx5: Fix steering rule of drop and count IB/mlx4: Follow mirror sequence of device add during device removal RDMA/counter: Prevent auto-binding a QP which are not tracked with res rxe: correctly calculate iCRC for unaligned payloads Update mailmap info for Steve Wise RDMA/cma: add missed unregister_pernet_subsys in init failure commit d195a66e367b3d24fdd3c3565f37ab7c6882b9d2 Author: Brian Gianforcaro Date: Fri Dec 13 03:09:50 2019 -0800 io_uring: fix stale comment and a few typos - Fix a few typos found while reading the code. - Fix stale io_get_sqring comment referencing s->sqe, the 's' parameter was renamed to 'req', but the comment still holds. Signed-off-by: Brian Gianforcaro Signed-off-by: Jens Axboe commit 1522d9da40bdfe502c91163e6d769332897201fa Merge: b01d7cb41ff5 bc3e8f5d42d5 Author: Linus Torvalds Date: Sun Dec 15 12:27:31 2019 -0800 Merge tag 'riscv/for-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "Two minor build fixes: - Fix builds of the ELF loader when built with 'make -j1' (nommu only) - Fix CONFIG_SOC_SIFIVE builds when CONFIG_TTY is disabled (found during randconfig testing)" * tag 'riscv/for-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: only select serial sifive if TTY is enabled riscv: Fix build dependency for loader commit b01d7cb41ff51b7779977de601a984406e2a5ba9 Merge: 2e6d304515ba c673ec61ade8 Author: Linus Torvalds Date: Sun Dec 15 12:24:44 2019 -0800 Merge tag 'for-linus-5.5b-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Two fixes: one for a resource accounting bug in some configurations and a fix for another patch which went into rc1" * tag 'for-linus-5.5b-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/balloon: fix ballooned page accounting without hotplug enabled xen-blkback: prevent premature module unload commit aeea5eae4fd54e94d820ed17ea3b238160be723e Author: Sven Schnelle Date: Sun Dec 15 20:09:27 2019 +0100 parisc: add missing __init annotation compilation failed with: MODPOST vmlinux.o WARNING: vmlinux.o(.text.unlikely+0xa0c): Section mismatch in reference from the function walk_lower_bus() to the function .init.text:walk_native_bus() The function walk_lower_bus() references the function __init walk_native_bus(). This is often because walk_lower_bus lacks a __init annotation or the annotation of walk_native_bus is wrong. FATAL: modpost: Section mismatches detected. Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them. make[2]: *** [/home/svens/linux/parisc-linux/src/scripts/Makefile.modpost:64: __modpost] Error 1 make[1]: *** [/home/svens/linux/parisc-linux/src/Makefile:1077: vmlinux] Error 2 make[1]: Leaving directory '/home/svens/linux/parisc-linux/build' make: *** [Makefile:179: sub-make] Error 2 Signed-off-by: Sven Schnelle Signed-off-by: Helge Deller commit e16260c21f87b16a33ae8ecac9e8c79f3a8b89bd Author: Sven Schnelle Date: Sun Dec 15 20:10:39 2019 +0100 parisc: fix compilation when KEXEC=n and KEXEC_FILE=y Fix compilation when the CONFIG_KEXEC_FILE=y and CONFIG_KEXEC=n. Reported-by: kbuild test robot Signed-off-by: Sven Schnelle Signed-off-by: Helge Deller commit fd42bfd1bb31f9a521be6b4f1bd89b85abc08d20 Author: Paul Durrant Date: Fri Dec 13 13:20:40 2019 +0000 xen-netback: avoid race that can lead to NULL pointer dereference In function xenvif_disconnect_queue(), the value of queue->rx_irq is zeroed *before* queue->task is stopped. Unfortunately that task may call notify_remote_via_irq(queue->rx_irq) and calling that function with a zero value results in a NULL pointer dereference in evtchn_from_irq(). This patch simply re-orders things, stopping all tasks before zero-ing the irq values, thereby avoiding the possibility of the race. Fixes: 2ac061ce97f4 ("xen/netback: cleanup init and deinit code") Signed-off-by: Paul Durrant Acked-by: Wei Liu Signed-off-by: Jakub Kicinski commit 2e6d304515ba9936d85265ad93dddc4c13c17d06 Merge: 510c9788991c 8243186f0cc7 Author: Linus Torvalds Date: Sun Dec 15 11:36:12 2019 -0800 Merge branch 'remove-ksys-mount-dup' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull ksys_mount() and ksys_dup() removal from Dominik Brodowski: "This small series replaces all in-kernel calls to the userspace-focused ksys_mount() and ksys_dup() with calls to kernel-centric functions: For each replacement of ksys_mount() with do_mount(), one needs to verify that the first and third parameter (char *dev_name, char *type) are strings allocated in kernelspace and that the fifth parameter (void *data) is either NULL or refers to a full page (only occurence in init/do_mounts.c::do_mount_root()). The second and fourth parameters (char *dir_name, unsigned long flags) are passed by ksys_mount() to do_mount() unchanged, and therefore do not require particular care. Moreover, instead of pretending to be userspace, the opening of /dev/console as stdin/stdout/stderr can be implemented using in-kernel functions as well. Thereby, ksys_dup() can be removed for good" [ This doesn't get rid of the special "kernel init runs with KERNEL_DS" case, but it at least removes _some_ of the users of "treat kernel pointers as user pointers for our magical init sequence". One day we'll hopefully be rid of it all, and can initialize our init_thread addr_limit to USER_DS. - Linus ] * 'remove-ksys-mount-dup' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: fs: remove ksys_dup() init: unify opening /dev/console as stdin/stdout/stderr init: use do_mount() instead of ksys_mount() initrd: use do_mount() instead of ksys_mount() devtmpfs: use do_mount() instead of ksys_mount() commit 858ce8ca62ea1530f2779d0e3f934b0176e663c3 Author: Cristian Birsan Date: Fri Dec 13 18:33:11 2019 +0200 net: usb: lan78xx: Fix error message format specifier Display the return code as decimal integer. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Signed-off-by: Cristian Birsan Signed-off-by: Jakub Kicinski commit 479a0d1376f6d97c60871442911f1394d4446a25 Author: Vishal Kulkarni Date: Fri Dec 13 06:39:39 2019 +0530 cxgb4: Fix kernel panic while accessing sge_info The sge_info debugfs collects offload queue info even when offload capability is disabled and leads to panic. [ 144.139871] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 144.139874] CR2: 0000000000000000 CR3: 000000082d456005 CR4: 00000000001606e0 [ 144.139876] Call Trace: [ 144.139887] sge_queue_start+0x12/0x30 [cxgb4] [ 144.139897] seq_read+0x1d4/0x3d0 [ 144.139906] full_proxy_read+0x50/0x70 [ 144.139913] vfs_read+0x89/0x140 [ 144.139916] ksys_read+0x55/0xd0 [ 144.139924] do_syscall_64+0x5b/0x1d0 [ 144.139933] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 144.139936] RIP: 0033:0x7f4b01493990 Fix this crash by skipping the offload queue access in sge_qinfo when offload capability is disabled Signed-off-by: Herat Ramani Signed-off-by: Vishal Kulkarni Signed-off-by: Jakub Kicinski commit 86434744fedf0cfe07a9eee3f4632c0e25c1d136 Author: Ursula Braun Date: Thu Dec 12 22:35:58 2019 +0100 net/smc: add fallback check to connect() FASTOPEN setsockopt() or sendmsg() may switch the SMC socket to fallback mode. Once fallback mode is active, the native TCP socket functions are called. Nevertheless there is a small race window, when FASTOPEN setsockopt/sendmsg runs in parallel to a connect(), and switch the socket into fallback mode before connect() takes the sock lock. Make sure the SMC-specific connect setup is omitted in this case. This way a syzbot-reported refcount problem is fixed, triggered by different threads running non-blocking connect() and FASTOPEN_KEY setsockopt. Reported-by: syzbot+96d3f9ff6a86d37e44c8@syzkaller.appspotmail.com Fixes: 6d6dd528d5af ("net/smc: fix refcount non-blocking connect() -part 2") Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: Jakub Kicinski commit 9b2079c046a9d6c9c73a4ec33816678565ee01f3 Author: Russell King Date: Fri Dec 13 10:06:30 2019 +0000 net: phylink: fix interface passed to mac_link_up A mismerge between the following two commits: c678726305b9 ("net: phylink: ensure consistent phy interface mode") 27755ff88c0e ("net: phylink: Add phylink_mac_link_{up, down} wrapper functions") resulted in the wrong interface being passed to the mac_link_up() function. Fix this up. Fixes: b4b12b0d2f02 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net") Signed-off-by: Russell King Signed-off-by: Jakub Kicinski commit 6dd504b0fd1039c6e5d391e97cf5c4ee592aefcb Author: Thadeu Lima de Souza Cascardo Date: Fri Dec 13 07:39:02 2019 -0300 selftests: net: tls: remove recv_rcvbuf test This test only works when [1] is applied, which was rejected. Basically, the errors are reported and cleared. In this particular case of tls sockets, following reads will block. The test case was originally submitted with the rejected patch, but, then, was included as part of a different patchset, possibly by mistake. [1] https://lore.kernel.org/netdev/20191007035323.4360-2-jakub.kicinski@netronome.com/#t Thanks Paolo Pisati for pointing out the original patchset where this appeared. Fixes: 65190f77424d (selftests/tls: add a test for fragmented messages) Reported-by: Paolo Pisati Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Jakub Kicinski commit 8ed001c966b0dd812a1cc57ae4b9c7b6d1454a25 Merge: 5d485ed88d48 6a902c0f3199 Author: Jakub Kicinski Date: Sat Dec 14 17:16:12 2019 -0800 Merge branch 'gtp-fix-several-bugs-in-gtp-module' Taehee Yoo says: ==================== gtp: fix several bugs in gtp module This patchset fixes several bugs in the GTP module. 1. Do not allow adding duplicate TID and ms_addr pdp context. In the current code, duplicate TID and ms_addr pdp context could be added. So, RX and TX path could find correct pdp context. 2. Fix wrong condition in ->dumpit() callback. ->dumpit() callback is re-called if dump packet size is too big. So, before return, it saves last position and then restart from last dump position. TID value is used to find last dump position. GTP module allows adding zero TID value. But ->dumpit() callback ignores zero TID value. So, dump would not work correctly if dump packet size too big. 3. Fix use-after-free in ipv4_pdp_find(). RX and TX patch always uses gtp->tid_hash and gtp->addr_hash. but while packet processing, these hash pointer would be freed. So, use-after-free would occur. 4. Fix panic because of zero size hashtable GTP hashtable size could be set by user-space. If hashsize is set to 0, hashtable will not work and panic will occur. ==================== Signed-off-by: Jakub Kicinski commit 6a902c0f31993ab02e1b6ea7085002b9c9083b6a Author: Taehee Yoo Date: Wed Dec 11 08:23:48 2019 +0000 gtp: avoid zero size hashtable GTP default hashtable size is 1024 and userspace could set specific hashtable size with IFLA_GTP_PDP_HASHSIZE. If hashtable size is set to 0 from userspace, hashtable will not work and panic will occur. Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 94dc550a5062030569d4aa76e10e50c8fc001930 Author: Taehee Yoo Date: Wed Dec 11 08:23:34 2019 +0000 gtp: fix an use-after-free in ipv4_pdp_find() ipv4_pdp_find() is called in TX packet path of GTP. ipv4_pdp_find() internally uses gtp->tid_hash to lookup pdp context. In the current code, gtp->tid_hash and gtp->addr_hash are freed by ->dellink(), which is gtp_dellink(). But gtp_dellink() would be called while packets are processing. So, gtp_dellink() should not free gtp->tid_hash and gtp->addr_hash. Instead, dev->priv_destructor() would be used because this callback is called after all packet processing safely. Test commands: ip link add veth1 type veth peer name veth2 ip a a 172.0.0.1/24 dev veth1 ip link set veth1 up ip a a 172.99.0.1/32 dev lo gtp-link add gtp1 & gtp-tunnel add gtp1 v1 200 100 172.99.0.2 172.0.0.2 ip r a 172.99.0.2/32 dev gtp1 ip link set gtp1 mtu 1500 ip netns add ns2 ip link set veth2 netns ns2 ip netns exec ns2 ip a a 172.0.0.2/24 dev veth2 ip netns exec ns2 ip link set veth2 up ip netns exec ns2 ip a a 172.99.0.2/32 dev lo ip netns exec ns2 ip link set lo up ip netns exec ns2 gtp-link add gtp2 & ip netns exec ns2 gtp-tunnel add gtp2 v1 100 200 172.99.0.1 172.0.0.1 ip netns exec ns2 ip r a 172.99.0.1/32 dev gtp2 ip netns exec ns2 ip link set gtp2 mtu 1500 hping3 172.99.0.2 -2 --flood & ip link del gtp1 Splat looks like: [ 72.568081][ T1195] BUG: KASAN: use-after-free in ipv4_pdp_find.isra.12+0x130/0x170 [gtp] [ 72.568916][ T1195] Read of size 8 at addr ffff8880b9a35d28 by task hping3/1195 [ 72.569631][ T1195] [ 72.569861][ T1195] CPU: 2 PID: 1195 Comm: hping3 Not tainted 5.5.0-rc1 #199 [ 72.570547][ T1195] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 72.571438][ T1195] Call Trace: [ 72.571764][ T1195] dump_stack+0x96/0xdb [ 72.572171][ T1195] ? ipv4_pdp_find.isra.12+0x130/0x170 [gtp] [ 72.572761][ T1195] print_address_description.constprop.5+0x1be/0x360 [ 72.573400][ T1195] ? ipv4_pdp_find.isra.12+0x130/0x170 [gtp] [ 72.573971][ T1195] ? ipv4_pdp_find.isra.12+0x130/0x170 [gtp] [ 72.574544][ T1195] __kasan_report+0x12a/0x16f [ 72.575014][ T1195] ? ipv4_pdp_find.isra.12+0x130/0x170 [gtp] [ 72.575593][ T1195] kasan_report+0xe/0x20 [ 72.576004][ T1195] ipv4_pdp_find.isra.12+0x130/0x170 [gtp] [ 72.576577][ T1195] gtp_build_skb_ip4+0x199/0x1420 [gtp] [ ... ] [ 72.647671][ T1195] BUG: unable to handle page fault for address: ffff8880b9a35d28 [ 72.648512][ T1195] #PF: supervisor read access in kernel mode [ 72.649158][ T1195] #PF: error_code(0x0000) - not-present page [ 72.649849][ T1195] PGD a6c01067 P4D a6c01067 PUD 11fb07067 PMD 11f939067 PTE 800fffff465ca060 [ 72.652958][ T1195] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 72.653834][ T1195] CPU: 2 PID: 1195 Comm: hping3 Tainted: G B 5.5.0-rc1 #199 [ 72.668062][ T1195] RIP: 0010:ipv4_pdp_find.isra.12+0x86/0x170 [gtp] [ ... ] [ 72.679168][ T1195] Call Trace: [ 72.679603][ T1195] gtp_build_skb_ip4+0x199/0x1420 [gtp] [ 72.681915][ T1195] ? ipv4_pdp_find.isra.12+0x170/0x170 [gtp] [ 72.682513][ T1195] ? lock_acquire+0x164/0x3b0 [ 72.682966][ T1195] ? gtp_dev_xmit+0x35e/0x890 [gtp] [ 72.683481][ T1195] gtp_dev_xmit+0x3c2/0x890 [gtp] [ ... ] Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 94a6d9fb88df43f92d943c32b84ce398d50bf49f Author: Taehee Yoo Date: Wed Dec 11 08:23:17 2019 +0000 gtp: fix wrong condition in gtp_genl_dump_pdp() gtp_genl_dump_pdp() is ->dumpit() callback of GTP module and it is used to dump pdp contexts. it would be re-executed because of dump packet size. If dump packet size is too big, it saves current dump pointer (gtp interface pointer, bucket, TID value) then it restarts dump from last pointer. Current GTP code allows adding zero TID pdp context but dump code ignores zero TID value. So, last dump pointer will not be found. In addition, this patch adds missing rcu_read_lock() in gtp_genl_dump_pdp(). Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 6b01b1d9b2d38dc84ac398bfe9f00baff06a31e5 Author: Taehee Yoo Date: Wed Dec 11 08:23:00 2019 +0000 gtp: do not allow adding duplicate tid and ms_addr pdp context GTP RX packet path lookups pdp context with TID. If duplicate TID pdp contexts are existing in the list, it couldn't select correct pdp context. So, TID value should be unique. GTP TX packet path lookups pdp context with ms_addr. If duplicate ms_addr pdp contexts are existing in the list, it couldn't select correct pdp context. So, ms_addr value should be unique. Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 5d485ed88d48f8101a2067348e267c0aaf4ed486 Author: Mahesh Bandewar Date: Fri Dec 6 15:44:55 2019 -0800 bonding: fix active-backup transition after link failure After the recent fix in commit 1899bb325149 ("bonding: fix state transition issue in link monitoring"), the active-backup mode with miimon initially come-up fine but after a link-failure, both members transition into backup state. Following steps to reproduce the scenario (eth1 and eth2 are the slaves of the bond): ip link set eth1 up ip link set eth2 down sleep 1 ip link set eth2 up ip link set eth1 down cat /sys/class/net/eth1/bonding_slave/state cat /sys/class/net/eth2/bonding_slave/state Fixes: 1899bb325149 ("bonding: fix state transition issue in link monitoring") CC: Jay Vosburgh Signed-off-by: Mahesh Bandewar Acked-by: Jay Vosburgh Signed-off-by: Jakub Kicinski commit 510c9788991c58827373bca719d8cffa4d65f846 Merge: 07c4b9e9f71a 3d519d6d388b Author: Linus Torvalds Date: Sat Dec 14 16:10:22 2019 -0800 Merge tag 'Wimplicit-fallthrough-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull fall through fix from Gustavo Silva: "Fix compile error on sh by marking expected switch fall-through" * tag 'Wimplicit-fallthrough-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: sh: kgdb: Mark expected switch fall-throughs commit a70fd5ac2ea787cafe07b69dadd16b3648ad64ac Author: yangerkun Date: Fri Dec 13 09:49:00 2019 +0800 ext4: reserve revoke credits in __ext4_new_inode It's possible that __ext4_new_inode will release the xattr block, so it will trigger a warning since there is revoke credits will be 0 if the handle == NULL. The below scripts can reproduce it easily. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3861 at fs/jbd2/revoke.c:374 jbd2_journal_revoke+0x30e/0x540 fs/jbd2/revoke.c:374 ... __ext4_forget+0x1d7/0x800 fs/ext4/ext4_jbd2.c:248 ext4_free_blocks+0x213/0x1d60 fs/ext4/mballoc.c:4743 ext4_xattr_release_block+0x55b/0x780 fs/ext4/xattr.c:1254 ext4_xattr_block_set+0x1c2c/0x2c40 fs/ext4/xattr.c:2112 ext4_xattr_set_handle+0xa7e/0x1090 fs/ext4/xattr.c:2384 __ext4_set_acl+0x54d/0x6c0 fs/ext4/acl.c:214 ext4_init_acl+0x218/0x2e0 fs/ext4/acl.c:293 __ext4_new_inode+0x352a/0x42b0 fs/ext4/ialloc.c:1151 ext4_mkdir+0x2e9/0xbd0 fs/ext4/namei.c:2774 vfs_mkdir+0x386/0x5f0 fs/namei.c:3811 do_mkdirat+0x11c/0x210 fs/namei.c:3834 do_syscall_64+0xa1/0x530 arch/x86/entry/common.c:294 ... ------------------------------------- scripts: mkfs.ext4 /dev/vdb mount /dev/vdb /mnt cd /mnt && mkdir dir && for i in {1..8}; do setfacl -dm "u:user_"$i":rx" dir; done mkdir dir/dir1 && mv dir/dir1 ./ sh repro.sh && add some user [root@localhost ~]# cat repro.sh while [ 1 -eq 1 ]; do rm -rf dir rm -rf dir1/dir1 mkdir dir for i in {1..8}; do setfacl -dm "u:test"$i":rx" dir; done setfacl -m "u:user_9:rx" dir & mkdir dir1/dir1 & done Before exec repro.sh, dir1 has inherit the default acl from dir, and xattr block of dir1 dir is not the same, so the h_refcount of these two dir's xattr block will be 1. Then repro.sh can trigger the warning with the situation show as below. The last h_refcount can be clear with mkdir, and __ext4_new_inode has not reserved revoke credits, so the warning will happened, fix it by reserve revoke credits in __ext4_new_inode. Thread 1 Thread 2 mkdir dir set default acl(will create a xattr block blk1 and the refcount of ext4_xattr_header will be 1) ... mkdir dir1/dir1 ->....->ext4_init_acl ->__ext4_set_acl(set default acl, will reuse blk1, and h_refcount will be 2) setfacl->ext4_set_acl->... ->ext4_xattr_block_set(will create new block blk2 to store xattr) ->__ext4_set_acl(set access acl, since h_refcount of blk1 is 2, will create blk3 to store xattr) ->ext4_xattr_release_block(dec h_refcount of blk1 to 1) ->ext4_xattr_release_block(dec h_refcount and since it is 0, will release the block and trigger the warning) Link: https://lore.kernel.org/r/20191213014900.47228-1-yangerkun@huawei.com Reported-by: Hulk Robot Reviewed-by: Jan Kara Signed-off-by: yangerkun Signed-off-by: Theodore Ts'o commit 7f420d64a08c1dcd65b27be82a27cf2bdb2e7847 Author: Dan Carpenter Date: Fri Dec 13 21:50:11 2019 +0300 ext4: unlock on error in ext4_expand_extra_isize() We need to unlock the xattr before returning on this error path. Cc: stable@kernel.org # 4.13 Fixes: c03b45b853f5 ("ext4, project: expand inode extra size if possible") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20191213185010.6k7yl2tck3wlsdkt@kili.mountain Signed-off-by: Theodore Ts'o commit 707d1a2f601bea6110a5633054253c0cb71b44c1 Author: Theodore Ts'o Date: Sun Dec 8 19:43:46 2019 -0500 ext4: optimize __ext4_check_dir_entry() Make __ext4_check_dir_entry() a bit easier to understand, and reduce the object size of the function by over 11%. Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20191209004346.38526-1-tytso@mit.edu Signed-off-by: Theodore Ts'o commit 109ba779d6cca2d519c5dd624a3276d03e21948e Author: Jan Kara Date: Mon Dec 2 18:02:13 2019 +0100 ext4: check for directory entries too close to block end ext4_check_dir_entry() currently does not catch a case when a directory entry ends so close to the block end that the header of the next directory entry would not fit in the remaining space. This can lead to directory iteration code trying to access address beyond end of current buffer head leading to oops. CC: stable@vger.kernel.org Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20191202170213.4761-3-jack@suse.cz Signed-off-by: Theodore Ts'o commit 64d4ce892383b2ad6d782e080d25502f91bf2a38 Author: Jan Kara Date: Mon Dec 2 18:02:12 2019 +0100 ext4: fix ext4_empty_dir() for directories with holes Function ext4_empty_dir() doesn't correctly handle directories with holes and crashes on bh->b_data dereference when bh is NULL. Reorganize the loop to use 'offset' variable all the times instead of comparing pointers to current direntry with bh->b_data pointer. Also add more strict checking of '.' and '..' directory entries to avoid entering loop in possibly invalid state on corrupted filesystems. References: CVE-2019-19037 CC: stable@vger.kernel.org Fixes: 4e19d6b65fb4 ("ext4: allow directory holes") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20191202170213.4761-2-jack@suse.cz Signed-off-by: Theodore Ts'o commit 7ae1629d4db0d68d6c332bcb4f0457b4fc7ab4aa Merge: ed56dd8f60cf ee699f89bdba Author: Jakub Kicinski Date: Sat Dec 14 13:01:17 2019 -0800 Merge branch 'bnx2x-bug-fixes' Manish Chopra says: ==================== bnx2x: bug fixes This series has two driver changes, one to fix some unexpected hardware behaviour casued during the parity error recovery in presence of SR-IOV VFs and another one related for fixing resource management in the driver among the PFs configured on an engine. Please consider applying it to "net". V1->V2: ======= Fix the compilation errors reported by kbuild test robot on the patch #1 with CONFIG_BNX2X_SRIOV=n ==================== Signed-off-by: Jakub Kicinski commit ee699f89bdbaa19c399804504241b5c531b48888 Author: Manish Chopra Date: Wed Dec 11 09:59:56 2019 -0800 bnx2x: Fix logic to get total no. of PFs per engine Driver doesn't calculate total number of PFs configured on a given engine correctly which messed up resources in the PFs loaded on that engine, leading driver to exceed configuration of resources (like vlan filters etc.) beyond the limit per engine, which ended up with asserts from the firmware. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: Jakub Kicinski commit 7113f796bbbced2470cd6d7379d50d7a7a78bf34 Author: Manish Chopra Date: Wed Dec 11 09:59:55 2019 -0800 bnx2x: Do not handle requests from VFs after parity Parity error from the hardware will cause PF to lose the state of their VFs due to PF's internal reload and hardware reset following the parity error. Restrict any configuration request from the VFs after the parity as it could cause unexpected hardware behavior, only way for VFs to recover would be to trigger FLR on VFs and reload them. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: Jakub Kicinski commit 07c4b9e9f71aa4bc74009f710fc5a745e10981bf Merge: f61cf8decb37 bba340c79bfe Author: Linus Torvalds Date: Sat Dec 14 12:51:57 2019 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "24 fixes, all in drivers. The lion's share (16) are qla2xxx and the rest are iscsi (3), ufs (2), smarpqi, lpfc and libsas" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (24 commits) scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func scsi: iscsi: Fix a potential deadlock in the timeout handler scsi: smartpqi: Update attribute name to `driver_version` scsi: libsas: stop discovering if oob mode is disconnected scsi: ufs: Disable autohibern8 feature in Cadence UFS scsi: iscsi: qla4xxx: fix double free in probe scsi: ufs: Give an unique ID to each ufs-bsg scsi: qla2xxx: Add debug dump of LOGO payload and ELS IOCB scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI scsi: qla2xxx: Don't defer relogin unconditonally scsi: qla2xxx: Send Notify ACK after N2N PLOGI scsi: qla2xxx: Configure local loop for N2N target scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length scsi: qla2xxx: Don't call qlt_async_event twice scsi: qla2xxx: Allow PLOGI in target mode scsi: qla2xxx: Change discovery state before PLOGI scsi: qla2xxx: Drop superfluous INIT_WORK of del_work scsi: qla2xxx: Initialize free_work before flushing it scsi: qla2xxx: Use explicit LOGO in target mode scsi: qla2xxx: Ignore NULL pointer in tcm_qla2xxx_free_mcmd ... commit ed56dd8f60cf3d56ca1416288b09eec27bdd5413 Author: Arnd Bergmann Date: Wed Dec 11 13:56:10 2019 +0100 net: ethernet: ti: build cpsw-common for switchdev Without the common part of the driver, the new file fails to link: drivers/net/ethernet/ti/cpsw_new.o: In function `cpsw_probe': cpsw_new.c:(.text+0x312c): undefined reference to `ti_cm_get_macid' Use the same Makefile hack as before, and build cpsw-common.o for any driver that needs it. Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac") Signed-off-by: Arnd Bergmann Reviewed-by: Grygorii Strashko Signed-off-by: Jakub Kicinski commit 99e9fe2248f9bd86dd10e773c90c9b54055b1d92 Author: Arnd Bergmann Date: Wed Dec 11 13:56:09 2019 +0100 net: ethernet: ti: select PAGE_POOL for switchdev driver The new driver misses a dependency: drivers/net/ethernet/ti/cpsw_new.o: In function `cpsw_rx_handler': cpsw_new.c:(.text+0x259c): undefined reference to `__page_pool_put_page' cpsw_new.c:(.text+0x25d0): undefined reference to `page_pool_alloc_pages' drivers/net/ethernet/ti/cpsw_priv.o: In function `cpsw_fill_rx_channels': cpsw_priv.c:(.text+0x22d8): undefined reference to `page_pool_alloc_pages' cpsw_priv.c:(.text+0x2420): undefined reference to `__page_pool_put_page' drivers/net/ethernet/ti/cpsw_priv.o: In function `cpsw_create_xdp_rxqs': cpsw_priv.c:(.text+0x2624): undefined reference to `page_pool_create' drivers/net/ethernet/ti/cpsw_priv.o: In function `cpsw_run_xdp': cpsw_priv.c:(.text+0x2dc8): undefined reference to `__page_pool_put_page' Other drivers use 'select' for PAGE_POOL, so do the same here. Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac") Signed-off-by: Arnd Bergmann Acked-by: Ilias Apalodimas Acked-by: Jesper Dangaard Brouer Reviewed-by: Grygorii Strashko Signed-off-by: Jakub Kicinski commit f61cf8decb37e7244247129163bf69b45dd3b1cd Merge: 894554c1ca79 16981742717b Author: Linus Torvalds Date: Sat Dec 14 12:49:20 2019 -0800 Merge tag 'char-misc-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are six small fixes for some reported char/misc driver issues: - fix build warnings with new 'awk' with the raid6 code - four interconnect driver bugfixes - binder fix for reported problem All of these except the binder fix have been in linux-next with no reported issues. The binder fix is "new" but Todd says it is good as he has tested it :)" * tag 'char-misc-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: binder: fix incorrect calculation for num_valid interconnect: qcom: msm8974: Walk the list safely on node removal interconnect: qcom: qcs404: Walk the list safely on node removal interconnect: qcom: sdm845: Walk the list safely on node removal interconnect: qcom: Fix Kconfig indentation lib: raid6: fix awk build warnings commit 894554c1ca793ad96a26b7c9f1eedd043e9e8164 Merge: aff2a52507bf eecd37e105f0 Author: Linus Torvalds Date: Sat Dec 14 12:45:36 2019 -0800 Merge tag 'driver-core-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are two small driver core fixes to resolve some reported issues The first is to handle the much-reported (by the build systems) problem that superH does not boot anymore. The second handles an issue in the new platform logic that a number of people ran into with the automated tests in kbuild Both of these have been in linux-next with no reported issues" * tag 'driver-core-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: drivers: Fix boot problem on SuperH of/platform: Unconditionally pause/resume sync state during kernel init commit aff2a52507bfeb4d44d6a69f6f8d7ca3bcb9b50d Merge: a1b85b3bf9f9 4bcd9eae7310 Author: Linus Torvalds Date: Sat Dec 14 12:43:57 2019 -0800 Merge tag 'staging-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/IIO fixes from Greg KH: "Here are a number of small staging and IIO driver fixes for reported issues for 5.5-rc2 Nothing major, a bunch of tiny IIO driver issues resolved, and some staging driver fixes for things that people ran into with 5.5-rc1. Full details are in the shortlog. All of these have been in linux-next with no reported issues" * tag 'staging-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (28 commits) fbtft: Fix the initialization from property algorithm staging: rtl8712: fix interface sanity check staging: rtl8188eu: fix interface sanity check staging: gigaset: add endpoint-type sanity check staging: gigaset: fix illegal free on probe errors staging: gigaset: fix general protection fault on probe staging: vchiq: call unregister_chrdev_region() when driver registration fails staging: exfat: fix multiple definition error of `rename_file' staging/wlan-ng: add CRC32 dependency in Kconfig staging: hp100: Fix build error without ETHERNET staging: fbtft: Do not hardcode SPI CS polarity inversion staging: exfat: properly support discard in clr_alloc_bitmap() staging/octeon: Mark Ethernet driver as BROKEN iio: adc: max9611: Fix too short conversion time delay iio: ad7949: fix channels mixups iio: imu: st_lsm6dsx: do not power-off accel if events are enabled iio: imu: st_lsm6dsx: track hw FIFO buffering with fifo_mask iio: imu: st_lsm6dsx: fix decimation factor estimation iio: imu: inv_mpu6050: fix temperature reporting using bad unit iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting ... commit a1b85b3bf9f9922bdc1428cd2ac4528786a05da7 Merge: 81d559849aa4 3c3caae4cd6e Author: Linus Torvalds Date: Sat Dec 14 12:40:39 2019 -0800 Merge tag 'usb-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB driver fixes for reported issues for 5.5-rc2 There's the usual gadget and xhci fixes, as well as some other problems that syzbot has been finding during it's fuzzing runs. Full details are in the shortlog. All of these have been in linux-next with no reported issues" * tag 'usb-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (21 commits) usb: dwc3: pci: add ID for the Intel Comet Lake -H variant xhci: make sure interrupts are restored to correct state xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. xhci: Increase STS_HALT timeout in xhci_suspend() usb: xhci: only set D3hot for pci device xhci: fix USB3 device initiated resume race with roothub autosuspend xhci: Fix memory leak in xhci_add_in_port() USB: Fix incorrect DMA allocations for local memory pool drivers usb: gadget: fix wrong endpoint desc usb: dwc3: ep0: Clear started flag on completion usb: dwc3: gadget: Clear started flag for non-IOC usb: dwc3: gadget: Fix logical condition USB: atm: ueagle-atm: add missing endpoint check USB: adutux: fix interface sanity check USB: idmouse: fix interface sanity checks USB: serial: io_edgeport: fix epic endpoint lookup usb: mon: Fix a deadlock in usbmon between mmap and read usb: common: usb-conn-gpio: Don't log an error on probe deferral usb: core: urb: fix URB structure initialization function usb: typec: fix use after free in typec_register_port() ... commit 81d559849aa4d972a2d297840eefdd20c4054131 Merge: f791ede32a14 3e39ce266a27 Author: Linus Torvalds Date: Sat Dec 14 12:34:37 2019 -0800 Merge tag 's390-5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Add support for KASAN_VMALLOC feature. - Remove the last user of problematic diag 0x44 call. - Adjust sampling interval and avoid sample data block overflow condition on pressure in perf code. - Prefer EOPNOTSUPP over ENOTSUPP and comments fixes. * tag 's390-5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/kasan: add KASAN_VMALLOC support s390: remove last diag 0x44 caller s390/uv: use EOPNOTSUPP instead of ENOTSUPP s390/cpum_sf: Avoid SBD overflow condition in irq handler s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits s390/test_unwind: fix spelling mistake "reqister" -> "register" s390/spinlock: remove confusing comment in arch_spin_lock_wait commit f791ede32a14151a313783e1105049a137bc13c8 Merge: 103a022d6bc5 84faa307249b Author: Linus Torvalds Date: Sat Dec 14 12:32:28 2019 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix another build problem for Wireguard without Crypto" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: arm/curve25519 - add arch-specific key generation function commit 103a022d6bc5962947f36414ac5c5d4d3d3aaea3 Merge: 81c64b0bd090 d9191319358d Author: Linus Torvalds Date: Sat Dec 14 11:44:14 2019 -0800 Merge tag '5.5-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cfis fixes from Steve French: "Three small smb3 fixes: this addresses two recent issues reported in additional testing during rc1, a refcount underflow and a problem with an intermittent crash in SMB2_open_init" * tag '5.5-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: CIFS: Close cached root handle only if it has a lease SMB3: Fix crash in SMB2_open_init due to uninitialized field in compounding path smb3: fix refcount underflow warning on unmount when no directory leases commit c39ea5cba5a2e97fc01b78c85208bf31383b399c Author: Haiyang Zhang Date: Wed Dec 11 14:26:27 2019 -0800 hv_netvsc: Fix tx_table init in rndis_set_subchannel() Host can provide send indirection table messages anytime after RSS is enabled by calling rndis_filter_set_rss_param(). So the host provided table values may be overwritten by the initialization in rndis_set_subchannel(). To prevent this problem, move the tx_table initialization before calling rndis_filter_set_rss_param(). Fixes: a6fb6aa3cfa9 ("hv_netvsc: Set tx_table to equal weight after subchannels open") Signed-off-by: Haiyang Zhang Signed-off-by: Jakub Kicinski commit 81c64b0bd0900405b4e55f3d48a2fc7dd5e1676c Merge: e31736d9fae8 35c6cb41686c Author: Linus Torvalds Date: Sat Dec 14 11:13:54 2019 -0800 Merge tag 'ovl-fixes-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fixes from Miklos Szeredi: "Fix some bugs and documentation" * tag 'ovl-fixes-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: docs: filesystems: overlayfs: Fix restview warnings docs: filesystems: overlayfs: Rename overlayfs.txt to .rst ovl: relax WARN_ON() on rename to self ovl: fix corner case of non-unique st_dev;st_ino ovl: don't use a temp buf for encoding real fh ovl: make sure that real fid is 32bit aligned in memory ovl: fix lookup failure on multi lower squashfs commit f3f2364ea14d1cf6bf966542f31eadcf178f1577 Author: Russell King Date: Tue Dec 10 22:33:05 2019 +0000 net: marvell: mvpp2: phylink requires the link interrupt phylink requires the MAC to report when its link status changes when operating in inband modes. Failure to report link status changes means that phylink has no idea when the link events happen, which results in either the network interface's carrier remaining up or remaining permanently down. For example, with a fiber module, if the interface is brought up and link is initially established, taking the link down at the far end will cut the optical power. The SFP module's LOS asserts, we deactivate the link, and the network interface reports no carrier. When the far end is brought back up, the SFP module's LOS deasserts, but the MAC may be slower to establish link. If this happens (which in my tests is a certainty) then phylink never hears that the MAC has established link with the far end, and the network interface is stuck reporting no carrier. This means the interface is non-functional. Avoiding the link interrupt when we have phylink is basically not an option, so remove the !port->phylink from the test. Fixes: 4bb043262878 ("net: mvpp2: phylink support") Tested-by: Sven Auhagen Tested-by: Antoine Tenart Signed-off-by: Russell King Signed-off-by: Jakub Kicinski commit cd1263b6dcfdf0e938946441295d8fcfe1654d3a Merge: 5c9934b6767b 216808c6ba6d Author: Jakub Kicinski Date: Sat Dec 14 09:57:36 2019 -0800 Merge branch 'tcp-take-care-of-empty-skbs-in-write-queue' Eric Dumazet says: ==================== tcp: take care of empty skbs in write queue We understood recently that TCP sockets could have an empty skb at the tail of the write queue, leading to various problems. This patch series : 1) Make sure we do not send an empty packet since this was unintended and causing crashes in old kernels. 2) Change tcp_write_queue_empty() to not be fooled by the presence of an empty skb. 3) Fix a bug that could trigger suboptimal epoll() application behavior under memory pressure. ==================== Signed-off-by: Jakub Kicinski commit 6fd739c04ffd877641b01371f9fde67901e7f9cb Author: Takashi Iwai Date: Sat Dec 14 18:52:17 2019 +0100 ALSA: hda: Fix regression by strip mask fix The commit e38e486d66e2 ("ALSA: hda: Modify stream stripe mask only when needed") tried to address the regression by the unconditional application of the stripe mask, but this caused yet another regression for the previously working devices. Namely, the patch clears the azx_dev->stripe flag at snd_hdac_stream_clear(), but this may be called multiple times before restarting the stream, so this ended up with clearance of the flag for the whole time. This patch fixes the regression by moving the azx_dev->stripe flag clearance at the counter-part, the close callback of HDMI codec driver instead. Fixes: e38e486d66e2 ("ALSA: hda: Modify stream stripe mask only when needed") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205855 BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204477 Cc: Link: https://lore.kernel.org/r/20191214175217.31852-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 42fb6b1d41eb5905d77c06cad2e87b70289bdb76 Author: Takashi Iwai Date: Fri Dec 13 09:51:11 2019 +0100 ALSA: hda/ca0132 - Fix work handling in delayed HP detection CA0132 has the delayed HP jack detection code that is invoked from the unsol handler, but it does a few weird things: it contains the cancel of a work inside the work handler, and yet it misses the cancel-sync call at (runtime-)suspend. This patch addresses those issues. Fixes: 15c2b3cc09a3 ("ALSA: hda/ca0132 - Fix possible workqueue stall") Cc: Link: https://lore.kernel.org/r/20191213085111.22855-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit cb04fc3b6b076f67d228a0b7d096c69ad486c09c Author: Takashi Iwai Date: Fri Dec 13 09:51:10 2019 +0100 ALSA: hda/ca0132 - Avoid endless loop Introduce a timeout to dspio_clear_response_queue() so that it won't be caught in an endless loop even if the hardware doesn't respond properly. Fixes: a73d511c4867 ("ALSA: hda/ca0132: Add unsol handler for DSP and jack detection") Cc: Link: https://lore.kernel.org/r/20191213085111.22855-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit 377bc0cfabce0244632dada19060839ced4e6949 Author: Takashi Iwai Date: Fri Dec 13 09:51:09 2019 +0100 ALSA: hda/ca0132 - Keep power on during processing DSP response We need to keep power on while processing the DSP response via unsol event. Each snd_hda_codec_read() call does the power management, so it should work normally, but still it's safer to keep the power up for the whole function. Fixes: a73d511c4867 ("ALSA: hda/ca0132: Add unsol handler for DSP and jack detection") Cc: Link: https://lore.kernel.org/r/20191213085111.22855-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit add9d56d7b3781532208afbff5509d7382fb6efe Author: Takashi Iwai Date: Wed Dec 11 16:57:42 2019 +0100 ALSA: pcm: Avoid possible info leaks from PCM stream buffers The current PCM code doesn't initialize explicitly the buffers allocated for PCM streams, hence it might leak some uninitialized kernel data or previous stream contents by mmapping or reading the buffer before actually starting the stream. Since this is a common problem, this patch simply adds the clearance of the buffer data at hw_params callback. Although this does only zero-clear no matter which format is used, which doesn't mean the silence for some formats, but it should be OK because the intention is just to clear the previous data on the buffer. Reported-by: Lionel Koenig Cc: Link: https://lore.kernel.org/r/20191211155742.3213-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 68a1fdf2451f38b4ada0607eb6e1303f8a02e0b7 Author: Chen Wandun Date: Tue Dec 10 19:06:56 2019 +0800 habanalabs: remove variable 'val' set but not used Fixes gcc '-Wunused-but-set-variable' warning: drivers/misc/habanalabs/goya/goya.c: In function goya_pldm_init_cpu: drivers/misc/habanalabs/goya/goya.c:2195:6: warning: variable val set but not used [-Wunused-but-set-variable] drivers/misc/habanalabs/goya/goya.c: In function goya_hw_init: drivers/misc/habanalabs/goya/goya.c:2505:6: warning: variable val set but not used [-Wunused-but-set-variable] Fixes: 9494a8dd8d22 ("habanalabs: add h/w queues module") Signed-off-by: Chen Wandun Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 018e0e3594f7dcd029d258e368c485e742fa9cdb Author: Oded Gabbay Date: Tue Dec 3 10:12:10 2019 +0200 habanalabs: rate limit error msg on waiting for CS In case a user submits a CS, and the submission fails, and the user doesn't check the return value and instead use the error return value as a valid sequence number of a CS and ask to wait on it, the driver will print an error and return an error code for that wait. The real problem happens if now the user ignores the error of the wait, and try to wait again and again. This can lead to a flood of error messages from the driver and even soft lockup event. Signed-off-by: Oded Gabbay Reviewed-by: Tomer Tayar commit 16981742717b04644a41052570fb502682a315d2 Author: Todd Kjos Date: Fri Dec 13 12:25:31 2019 -0800 binder: fix incorrect calculation for num_valid For BINDER_TYPE_PTR and BINDER_TYPE_FDA transactions, the num_valid local was calculated incorrectly causing the range check in binder_validate_ptr() to miss out-of-bounds offsets. Fixes: bde4a19fc04f ("binder: use userspace pointer as base of buffer space") Signed-off-by: Todd Kjos Cc: stable Link: https://lore.kernel.org/r/20191213202531.55010-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman commit fd2ab2f6610b2bec70e626c38de8a4242fa88e48 Author: Masahiro Yamada Date: Mon Dec 9 12:51:48 2019 +0900 scripts/kallsyms: fix offset overflow of kallsyms_relative_base Since commit 5e5c4fa78745 ("scripts/kallsyms: shrink table before sorting it"), kallsyms_relative_base can be larger than _text, which causes overflow when building the 32-bit kernel. https://lkml.org/lkml/2019/12/7/156 This is because _text is, unless --all-symbols is specified, now trimmed from the symbol table before record_relative_base() is called. Handle the offset signedness also for kallsyms_relative_base. Introduce a new helper, output_address(), to reduce the code duplication. Fixes: 5e5c4fa78745 ("scripts/kallsyms: shrink table before sorting it") Reported-by: Olof Johansson Signed-off-by: Masahiro Yamada commit c8f3dea90e38194dae542c5d56e05d30447e58cb Author: Masahiro Yamada Date: Fri Dec 6 22:03:02 2019 +0900 mkcompile_h: use printf for LINUX_COMPILE_BY Commit 858805b336be ("kbuild: add $(BASH) to run scripts with bash-extension") shed light on portability issues. Here is another one. Since commit f07726048d59 ("Fix handling of backlash character in LINUX_COMPILE_BY name"), we must escape a backslash contained in LINUX_COMPILE_BY. This is not working on such distros as Ubuntu. As the POSIX spec [1] says, if any of the operands contain a backslash ( '\' ) character, the results are implementation-defined. The actual shell of /bin/sh could be bash, dash, etc. depending on distros, and the behavior of builtin echo command is different among them. The bash builtin echo, unless -e is given, copies the arguments to stdout without expanding escape sequences (BSD-like behavior). The dash builtin echo, in contrast, adopts System V behavior, which does expand escape sequences without any option given. Even non-builtin /bin/echo behaves differently depending on the system. Due to these variations, echo is considered as a non-portable command. Using printf is the common solution to avoid the portability issue. [1] https://pubs.opengroup.org/onlinepubs/009695399/utilities/echo.html Fixes: 858805b336be ("kbuild: add $(BASH) to run scripts with bash-extension") Reported-by: XXing Wei Signed-off-by: Masahiro Yamada commit e8193650bf38bf531f19de36ae3afdee32627191 Author: Masahiro Yamada Date: Fri Dec 6 22:03:01 2019 +0900 mkcompile_h: git rid of UTS_TRUNCATE from LINUX_COMPILE_{BY,HOST} UTS_VERSION is set to struct uts_namespace, hence a too long string should be truncated so it fits in 64 characters. On the other hand, LINUX_COMPILE_BY/HOST are not set to uts_namespace. They are just used in the banners, which do not have specific length limitation. I dug into the git history, but I could not find the reason why these two strings must fit in 64 characters. Remove them. Now that UTS_VERSION is the only user of UTS_TRUNCATE, I squashed it. Signed-off-by: Masahiro Yamada commit eefb8c124fd969e9a174ff2bedff86aa305a7438 Author: Dmitry Golovin Date: Thu Dec 5 00:54:41 2019 +0200 x86/boot: kbuild: allow readelf executable to be specified Introduce a new READELF variable to top-level Makefile, so the name of readelf binary can be specified. Before this change the name of the binary was hardcoded to "$(CROSS_COMPILE)readelf" which might not be present for every toolchain. This allows to build with LLVM Object Reader by using make parameter READELF=llvm-readelf. Link: https://github.com/ClangBuiltLinux/linux/issues/771 Signed-off-by: Dmitry Golovin Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 216808c6ba6d00169fd2aa928ec3c0e63bef254f Author: Eric Dumazet Date: Thu Dec 12 12:55:31 2019 -0800 tcp: refine rule to allow EPOLLOUT generation under mem pressure At the time commit ce5ec440994b ("tcp: ensure epoll edge trigger wakeup when write queue is empty") was added to the kernel, we still had a single write queue, combining rtx and write queues. Once we moved the rtx queue into a separate rb-tree, testing if sk_write_queue is empty has been suboptimal. Indeed, if we have packets in the rtx queue, we probably want to delay the EPOLLOUT generation at the time incoming packets will free them, making room, but more importantly avoiding flooding application with EPOLLOUT events. Solution is to use tcp_rtx_and_write_queues_empty() helper. Fixes: 75c119afe14f ("tcp: implement rb-tree based retransmit queue") Signed-off-by: Eric Dumazet Cc: Jason Baron Cc: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Signed-off-by: Jakub Kicinski commit ee2aabd3fc2eef4c1a0ebdadccc76fbff74b94fc Author: Eric Dumazet Date: Thu Dec 12 12:55:30 2019 -0800 tcp: refine tcp_write_queue_empty() implementation Due to how tcp_sendmsg() is implemented, we can have an empty skb at the tail of the write queue. Most [1] tcp_write_queue_empty() callers want to know if there is anything to send (payload and/or FIN) Instead of checking if the sk_write_queue is empty, we need to test if tp->write_seq == tp->snd_nxt [1] tcp_send_fin() was the only caller that expected to see if an skb was in the write queue, I have changed the code to reuse the tcp_write_queue_tail() result. Signed-off-by: Eric Dumazet Cc: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Signed-off-by: Jakub Kicinski commit 1f85e6267caca44b30c54711652b0726fadbb131 Author: Eric Dumazet Date: Thu Dec 12 12:55:29 2019 -0800 tcp: do not send empty skb from tcp_write_xmit() Backport of commit fdfc5c8594c2 ("tcp: remove empty skb from write queue in error cases") in linux-4.14 stable triggered various bugs. One of them has been fixed in commit ba2ddb43f270 ("tcp: Don't dequeue SYN/FIN-segments from write-queue"), but we still have crashes in some occasions. Root-cause is that when tcp_sendmsg() has allocated a fresh skb and could not append a fragment before being blocked in sk_stream_wait_memory(), tcp_write_xmit() might be called and decide to send this fresh and empty skb. Sending an empty packet is not only silly, it might have caused many issues we had in the past with tp->packets_out being out of sync. Fixes: c65f7f00c587 ("[TCP]: Simplify SKB data portion allocation with NETIF_F_SG.") Signed-off-by: Eric Dumazet Cc: Christoph Paasch Acked-by: Neal Cardwell Cc: Jason Baron Acked-by: Soheil Hassas Yeganeh Signed-off-by: Jakub Kicinski commit 5c9934b6767b16ba60be22ec3cbd4379ad64170d Author: Eric Dumazet Date: Thu Dec 12 10:32:13 2019 -0800 6pack,mkiss: fix possible deadlock We got another syzbot report [1] that tells us we must use write_lock_irq()/write_unlock_irq() to avoid possible deadlock. [1] WARNING: inconsistent lock state 5.5.0-rc1-syzkaller #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-R} usage. syz-executor826/9605 [HC1[1]:SC0[0]:HE0:SE1] takes: ffffffff8a128718 (disc_data_lock){+-..}, at: sp_get.isra.0+0x1d/0xf0 drivers/net/ppp/ppp_synctty.c:138 {HARDIRQ-ON-W} state was registered at: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4485 __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline] _raw_write_lock_bh+0x33/0x50 kernel/locking/spinlock.c:319 sixpack_close+0x1d/0x250 drivers/net/hamradio/6pack.c:657 tty_ldisc_close.isra.0+0x119/0x1a0 drivers/tty/tty_ldisc.c:489 tty_set_ldisc+0x230/0x6b0 drivers/tty/tty_ldisc.c:585 tiocsetd drivers/tty/tty_io.c:2337 [inline] tty_ioctl+0xe8d/0x14f0 drivers/tty/tty_io.c:2597 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe irq event stamp: 3946 hardirqs last enabled at (3945): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline] hardirqs last enabled at (3945): [] _raw_spin_unlock_irq+0x23/0x80 kernel/locking/spinlock.c:199 hardirqs last disabled at (3946): [] trace_hardirqs_off_thunk+0x1a/0x1c arch/x86/entry/thunk_64.S:42 softirqs last enabled at (2658): [] spin_unlock_bh include/linux/spinlock.h:383 [inline] softirqs last enabled at (2658): [] clusterip_netdev_event+0x46f/0x670 net/ipv4/netfilter/ipt_CLUSTERIP.c:222 softirqs last disabled at (2656): [] spin_lock_bh include/linux/spinlock.h:343 [inline] softirqs last disabled at (2656): [] clusterip_netdev_event+0x1bb/0x670 net/ipv4/netfilter/ipt_CLUSTERIP.c:196 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(disc_data_lock); lock(disc_data_lock); *** DEADLOCK *** 5 locks held by syz-executor826/9605: #0: ffff8880a905e198 (&tty->legacy_mutex){+.+.}, at: tty_lock+0xc7/0x130 drivers/tty/tty_mutex.c:19 #1: ffffffff899a56c0 (rcu_read_lock){....}, at: mutex_spin_on_owner+0x0/0x330 kernel/locking/mutex.c:413 #2: ffff8880a496a2b0 (&(&i->lock)->rlock){-.-.}, at: spin_lock include/linux/spinlock.h:338 [inline] #2: ffff8880a496a2b0 (&(&i->lock)->rlock){-.-.}, at: serial8250_interrupt+0x2d/0x1a0 drivers/tty/serial/8250/8250_core.c:116 #3: ffffffff8c104048 (&port_lock_key){-.-.}, at: serial8250_handle_irq.part.0+0x24/0x330 drivers/tty/serial/8250/8250_port.c:1823 #4: ffff8880a905e090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref+0x22/0x90 drivers/tty/tty_ldisc.c:288 stack backtrace: CPU: 1 PID: 9605 Comm: syz-executor826 Not tainted 5.5.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_usage_bug.cold+0x327/0x378 kernel/locking/lockdep.c:3101 valid_state kernel/locking/lockdep.c:3112 [inline] mark_lock_irq kernel/locking/lockdep.c:3309 [inline] mark_lock+0xbb4/0x1220 kernel/locking/lockdep.c:3666 mark_usage kernel/locking/lockdep.c:3554 [inline] __lock_acquire+0x1e55/0x4a00 kernel/locking/lockdep.c:3909 lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4485 __raw_read_lock include/linux/rwlock_api_smp.h:149 [inline] _raw_read_lock+0x32/0x50 kernel/locking/spinlock.c:223 sp_get.isra.0+0x1d/0xf0 drivers/net/ppp/ppp_synctty.c:138 sixpack_write_wakeup+0x25/0x340 drivers/net/hamradio/6pack.c:402 tty_wakeup+0xe9/0x120 drivers/tty/tty_io.c:536 tty_port_default_wakeup+0x2b/0x40 drivers/tty/tty_port.c:50 tty_port_tty_wakeup+0x57/0x70 drivers/tty/tty_port.c:387 uart_write_wakeup+0x46/0x70 drivers/tty/serial/serial_core.c:104 serial8250_tx_chars+0x495/0xaf0 drivers/tty/serial/8250/8250_port.c:1761 serial8250_handle_irq.part.0+0x2a2/0x330 drivers/tty/serial/8250/8250_port.c:1834 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1820 [inline] serial8250_default_handle_irq+0xc0/0x150 drivers/tty/serial/8250/8250_port.c:1850 serial8250_interrupt+0xf1/0x1a0 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x15d/0x970 kernel/irq/handle.c:149 handle_irq_event_percpu+0x74/0x160 kernel/irq/handle.c:189 handle_irq_event+0xa7/0x134 kernel/irq/handle.c:206 handle_edge_irq+0x25e/0x8d0 kernel/irq/chip.c:830 generic_handle_irq_desc include/linux/irqdesc.h:156 [inline] do_IRQ+0xde/0x280 arch/x86/kernel/irq.c:250 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:607 RIP: 0010:cpu_relax arch/x86/include/asm/processor.h:685 [inline] RIP: 0010:mutex_spin_on_owner+0x247/0x330 kernel/locking/mutex.c:579 Code: c3 be 08 00 00 00 4c 89 e7 e8 e5 06 59 00 4c 89 e0 48 c1 e8 03 42 80 3c 38 00 0f 85 e1 00 00 00 49 8b 04 24 a8 01 75 96 f3 90 2f fe ff ff 0f 0b e8 0d 19 09 00 84 c0 0f 85 ff fd ff ff 48 c7 RSP: 0018:ffffc90001eafa20 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffd7 RAX: 0000000000000000 RBX: ffff88809fd9e0c0 RCX: 1ffffffff13266dd RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000 RBP: ffffc90001eafa60 R08: 1ffff11013d22898 R09: ffffed1013d22899 R10: ffffed1013d22898 R11: ffff88809e9144c7 R12: ffff8880a905e138 R13: ffff88809e9144c0 R14: 0000000000000000 R15: dffffc0000000000 mutex_optimistic_spin kernel/locking/mutex.c:673 [inline] __mutex_lock_common kernel/locking/mutex.c:962 [inline] __mutex_lock+0x32b/0x13c0 kernel/locking/mutex.c:1106 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1121 tty_lock+0xc7/0x130 drivers/tty/tty_mutex.c:19 tty_release+0xb5/0xe90 drivers/tty/tty_io.c:1665 __fput+0x2ff/0x890 fs/file_table.c:280 ____fput+0x16/0x20 fs/file_table.c:313 task_work_run+0x145/0x1c0 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x8e7/0x2ef0 kernel/exit.c:797 do_group_exit+0x135/0x360 kernel/exit.c:895 __do_sys_exit_group kernel/exit.c:906 [inline] __se_sys_exit_group kernel/exit.c:904 [inline] __x64_sys_exit_group+0x44/0x50 kernel/exit.c:904 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x43fef8 Code: Bad RIP value. RSP: 002b:00007ffdb07d2338 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043fef8 RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 RBP: 00000000004bf730 R08: 00000000000000e7 R09: ffffffffffffffd0 R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000000001 R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000 Fixes: 6e4e2f811bad ("6pack,mkiss: fix lock inconsistency") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Arnd Bergmann Signed-off-by: Jakub Kicinski commit 8dbd76e79a16b45b2ccb01d2f2e08dbf64e71e40 Author: Eric Dumazet Date: Fri Dec 13 18:20:41 2019 -0800 tcp/dccp: fix possible race __inet_lookup_established() Michal Kubecek and Firo Yang did a very nice analysis of crashes happening in __inet_lookup_established(). Since a TCP socket can go from TCP_ESTABLISH to TCP_LISTEN (via a close()/socket()/listen() cycle) without a RCU grace period, I should not have changed listeners linkage in their hash table. They must use the nulls protocol (Documentation/RCU/rculist_nulls.txt), so that a lookup can detect a socket in a hash list was moved in another one. Since we added code in commit d296ba60d8e2 ("soreuseport: Resolve merge conflict for v4/v6 ordering fix"), we have to add hlist_nulls_add_tail_rcu() helper. Fixes: 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood") Signed-off-by: Eric Dumazet Reported-by: Michal Kubecek Reported-by: Firo Yang Reviewed-by: Michal Kubecek Link: https://lore.kernel.org/netdev/20191120083919.GH27852@unicorn.suse.cz/ Signed-off-by: Jakub Kicinski commit 8f9cc1ee296275d27770245cbd247a4952bbb2be Author: Thomas Falcon Date: Wed Dec 11 09:38:39 2019 -0600 net/ibmvnic: Fix typo in retry check This conditional is missing a bang, with the intent being to break when the retry count reaches zero. Fixes: 476d96ca9cc5 ("ibmvnic: Bound waits for device queries") Suggested-by: Juliet Kim Signed-off-by: Thomas Falcon Signed-off-by: Jakub Kicinski commit 2beb6d2901a3f73106485d560c49981144aeacb1 Author: Hangbin Liu Date: Wed Dec 11 22:20:16 2019 +0800 ipv6/addrconf: only check invalid header values when NETLINK_F_STRICT_CHK is set In commit 4b1373de73a3 ("net: ipv6: addr: perform strict checks also for doit handlers") we add strict check for inet6_rtm_getaddr(). But we did the invalid header values check before checking if NETLINK_F_STRICT_CHK is set. This may break backwards compatibility if user already set the ifm->ifa_prefixlen, ifm->ifa_flags, ifm->ifa_scope in their netlink code. I didn't move the nlmsg_len check because I thought it's a valid check. Reported-by: Jianlin Shi Fixes: 4b1373de73a3 ("net: ipv6: addr: perform strict checks also for doit handlers") Signed-off-by: Hangbin Liu Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit 1021dcf19db1387bc0db26d14bbcba719923a466 Author: Anson Huang Date: Fri Dec 13 14:02:30 2019 -0800 Input: imx_sc_key - only take the valid data from SCU firmware as key state When reading key state from SCU, the response data from SCU firmware is 4 bytes due to MU message protocol, but ONLY the first byte is the key state, other 3 bytes could be some dirty data, so we should ONLY take the first byte as key state to avoid reporting incorrect state. Signed-off-by: Anson Huang Fixes: 688f1dfb69b4 ("Input: keyboard - imx_sc: Add i.MX system controller key support") Link: https://lore.kernel.org/r/1576202909-1661-1-git-send-email-Anson.Huang@nxp.com Signed-off-by: Dmitry Torokhov commit 03b06e3f83523ded51aa822f58c083fbde08feb5 Author: Arnd Bergmann Date: Tue Dec 10 20:56:34 2019 +0100 ptp: clockmatrix: add I2C dependency Without I2C, we get a link failure: drivers/ptp/ptp_clockmatrix.o: In function `idtcm_xfer.isra.3': ptp_clockmatrix.c:(.text+0xcc): undefined reference to `i2c_transfer' drivers/ptp/ptp_clockmatrix.o: In function `idtcm_driver_init': ptp_clockmatrix.c:(.init.text+0x14): undefined reference to `i2c_register_driver' drivers/ptp/ptp_clockmatrix.o: In function `idtcm_driver_exit': ptp_clockmatrix.c:(.exit.text+0x10): undefined reference to `i2c_del_driver' Fixes: 3a6ba7dc7799 ("ptp: Add a ptp clock driver for IDT ClockMatrix.") Signed-off-by: Arnd Bergmann Reviewed-by: Vincent Cheng Signed-off-by: Jakub Kicinski commit 6adc4601c2a1ac87b4ab8ed0cb55db6efd0264e8 Author: Jonathan Lemon Date: Tue Dec 10 08:39:46 2019 -0800 bnxt: apply computed clamp value for coalece parameter After executing "ethtool -C eth0 rx-usecs-irq 0", the box becomes unresponsive, likely due to interrupt livelock. It appears that a minimum clamp value for the irq timer is computed, but is never applied. Fix by applying the corrected clamp value. Fixes: 74706afa712d ("bnxt_en: Update interrupt coalescing logic.") Signed-off-by: Jonathan Lemon Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 5133498f4ad1123a5ffd4c08df6431dab882cc32 Author: Lorenz Bauer Date: Fri Dec 13 18:08:17 2019 +0000 bpf: Clear skb->tstamp in bpf_redirect when necessary Redirecting a packet from ingress to egress by using bpf_redirect breaks if the egress interface has an fq qdisc installed. This is the same problem as fixed in 'commit 8203e2d844d3 ("net: clear skb->tstamp in forwarding paths") Clear skb->tstamp when redirecting into the egress path. Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.") Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") Signed-off-by: Lorenz Bauer Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/bpf/20191213180817.2510-1-lmb@cloudflare.com commit 692b93af71fb6795887affd6a281e4f91407489f Author: Vivien Didelot Date: Thu Dec 12 12:59:08 2019 -0500 mailmap: add entry for myself I no longer work at Savoir-faire Linux but even though MAINTAINERS is up-to-date, some emails are still sent to my old email address. Signed-off-by: Vivien Didelot Signed-off-by: Jakub Kicinski commit 9c3194dd93b067d0a9fd84d516de69f438dbc9c2 Author: Subash Abhinov Kasiviswanathan Date: Thu Dec 12 04:00:15 2019 +0000 MAINTAINERS: Add maintainers for rmnet Add myself and Sean as maintainers for rmnet driver. Signed-off-by: Sean Tranchetti Signed-off-by: Subash Abhinov Kasiviswanathan Signed-off-by: Jakub Kicinski commit e31736d9fae841e8a1612f263136454af10f476a Merge: 1482e664fe35 e32ea127d81c Author: Linus Torvalds Date: Fri Dec 13 15:05:00 2019 -0800 Merge tag 'nios2-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2 Pull nios2 fix from Ley Foon Tan: "Fix nios2 ioremap regression" * tag 'nios2-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2: nios2: Fix ioremap commit 1482e664fe353775c48d3f9d3e5059b9853d4d99 Merge: dd79b5361a6a ee9b280e17dc Author: Linus Torvalds Date: Fri Dec 13 15:03:25 2019 -0800 Merge tag 'devicetree-fixes-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fixes from Rob Herring: - Fix for dependency tracking caused by unittest interaction - Fix some schema errors in Tegra memory controller schema - Update Maxime Ripard's email address - Review fixes to TI cpsw-switch - Add wakeup-source prop for STM32 rproc. Got dropped in the schema conversion. * tag 'devicetree-fixes-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/platform: Unconditionally pause/resume sync state during kernel init dt-bindings: memory-controllers: tegra: Fix type references dt-bindings: Change maintainer address dt-bindings: net: ti: cpsw-switch: update to fix comments dt-bindings: remoteproc: stm32: add wakeup-source property commit cb222aed03d798fc074be55e59d9a112338ee784 Author: Dmitry Torokhov Date: Fri Dec 13 14:56:16 2019 -0800 Input: add safety guards to input_set_keycode() If we happen to have a garbage in input device's keycode table with values too big we'll end up doing clear_bit() with offset way outside of our bitmaps, damaging other objects within an input device or even outside of it. Let's add sanity checks to the returned old keycodes. Reported-by: syzbot+c769968809f9359b07aa@syzkaller.appspotmail.com Reported-by: syzbot+76f3a30e88d256644c78@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20191207212757.GA245964@dtor-ws Signed-off-by: Dmitry Torokhov commit f729a1b0f8df7091cea3729fc0e414f5326e1163 Author: Arnd Bergmann Date: Fri Dec 13 14:06:58 2019 -0800 Input: input_event - fix struct padding on sparc64 Going through all uses of timeval, I noticed that we screwed up input_event in the previous attempts to fix it: The time fields now match between kernel and user space, but all following fields are in the wrong place. Add the required padding that is implied by the glibc timeval definition to fix the layout, and use a struct initializer to avoid leaking kernel stack data. Fixes: 141e5dcaa735 ("Input: input_event - fix the CONFIG_SPARC64 mixup") Fixes: 2e746942ebac ("Input: input_event - provide override for sparc64") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20191213204936.3643476-2-arnd@arndb.de Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit add218099472805a06bc334852d8e2af5d74e4ac Author: Dmitry Torokhov Date: Fri Dec 13 14:03:56 2019 -0800 Input: uinput - always report EPOLLOUT uinput device is always available for writing so we should always report EPOLLOUT and EPOLLWRNORM bits, not only when there is nothing to read from the device. Fixes: d4b675e1b527 ("Input: uinput - fix returning EPOLLOUT from uinput_poll") Reported-by: Linus Torvalds Link: https://lore.kernel.org/r/20191209202254.GA107567@dtor-ws Signed-off-by: Dmitry Torokhov commit dd79b5361a6ab3def4a577843ebfecd75b634c8b Merge: 1d76c0792a0a 63b9b80e9f5b Author: Linus Torvalds Date: Fri Dec 13 14:58:24 2019 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Some fixes and cleanup patches" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_balloon: divide/multiply instead of shifts virtio_balloon: name cleanups virtio-balloon: fix managed page counts when migrating pages between zones commit 1d76c0792a0a12529b4d7b052d511dff9cc1b273 Merge: 3b2ee614cb4a ca01e7987463 Author: Linus Torvalds Date: Fri Dec 13 14:52:03 2019 -0800 Merge tag 'pci-v5.5-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fix from Bjorn Helgaas: "Fix rockchip outbound ATU issue that prevented Google Kevin Chromebooks from booting (Enric Balletbo i Serra)" * tag 'pci-v5.5-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: rockchip: Fix IO outbound ATU register number commit 3b2ee614cb4accb75080f00586bd762b0eab219c Merge: 6bd2c87aaffe 8c9312a925ad Author: Linus Torvalds Date: Fri Dec 13 14:45:40 2019 -0800 Merge branch 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: - removal of an old API where all in-kernel users have been converted as of this merge window. - a kdoc fix - a new helper that will make dependencies for the next API conversion a tad easier * 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: add helper to check if a client has a driver attached i2c: fix header file kernel-doc warning i2c: remove i2c_new_dummy() API commit 6bd2c87aaffe0b58ce65233fe922b9eb5f7d9a85 Merge: b61c56227bf5 4c84515da809 Author: Linus Torvalds Date: Fri Dec 13 14:43:26 2019 -0800 Merge tag 'pm-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These add PM QoS support to devfreq and fix a few issues in that subsystem, fix two cpuidle issues and do one minor cleanup in there, and address an ACPI power management problem related to devices with special power management requirements, like fans. Specifics: - Add PM QoS support, based on the frequency QoS introduced during the 5.4 cycle, to devfreq (Leonard Crestez). - Fix some assorted devfreq issues (Leonard Crestez). - Fix an unintentional cpuidle behavior change (introduced during the 5.4 cycle) related to the active polling time limit (Marcelo Tosatti). - Fix a recently introduced cpuidle helper function and do a minor cleanup in the cpuidle core (Rafael Wysocki). - Avoid adding devices with special power management requirements, like fans, to the generic ACPI PM domain (Rafael Wysocki)" * tag 'pm-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle: Drop unnecessary type cast in cpuidle_poll_time() cpuidle: Fix cpuidle_driver_state_disabled() ACPI: PM: Avoid attaching ACPI PM domain to certain devices cpuidle: use first valid target residency as poll time PM / devfreq: Use PM QoS for sysfs min/max_freq PM / devfreq: Add PM QoS support PM / devfreq: Don't fail devfreq_dev_release if not in list PM / devfreq: Introduce get_freq_range helper PM / devfreq: Set scaling_max_freq to max on OPP notifier error PM / devfreq: Fix devfreq_notifier_call returning errno commit b61c56227bf5a2ca5e146cebcdf50b2e15e4c973 Merge: b2cb931d724b 5815bdfd7f54 Author: Linus Torvalds Date: Fri Dec 13 14:40:38 2019 -0800 Merge tag 'sound-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A small collection of fixes. The main changes are fixes for a couple of regressions in AMD HD-audio and FireWire that were introduced in 5.5-rc1. The rest are small fixes for echoaudio and FireWire, as well as a usual Dell HD-audio fixup" * tag 'sound-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Line-out jack doesn't work on a Dell AIO ALSA: hda/hdmi - Fix duplicate unref of pci_dev ALSA: fireface: fix return value in error path of isochronous resources reservation ALSA: oxfw: fix return value in error path of isochronous resources reservation ALSA: firewire-motu: fix double unlocked 'motu->mutex' ALSA: echoaudio: simplify get_audio_levels commit b2cb931d724b08def6e833541a37b08ebd59ab43 Merge: f1fcd7786ec8 d16f0f614000 Author: Linus Torvalds Date: Fri Dec 13 14:36:45 2019 -0800 Merge tag 'drm-fixes-2019-12-13' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Usual round of rc2 fixes. i915 and amdgpu leading the charge, but a few others in here, including some nouveau fixes, all seems pretty for rc2, but hey it's a Fri 13th pull so I'm sure it'll cause untold bad fortune. dma-buf: - memory leak fix - expand MAINTAINERS scope core: - fix mode matching for drivers not using picture_aspect_ratio nouveau: - panel scaling fix - MST BPC fix - atomic fixes i915: - GPU hang on idle transition - GLK+ FBC corruption fix - non-priv OA access on Tigerlake - HDCP state fix - CI found race fixes amdgpu: - renoir DC fixes - GFX8 fence flush alignment with userspace - Arcturus power profile fix - DC aux + i2c over aux fixes - GPUVM invalidation semaphore fixes - gfx10 golden registers update mgag200: - expand startadd fix panfrost: - devfreq fix - memory fixes mcde: - DSI pointer deref fix" * tag 'drm-fixes-2019-12-13' of git://anongit.freedesktop.org/drm/drm: (51 commits) drm/amdgpu: add invalidate semaphore limit for SRIOV in gmc10 drm/amdgpu: add invalidate semaphore limit for SRIOV and picasso in gmc9 drm/amdgpu: avoid using invalidate semaphore for picasso Revert "drm/amdgpu: dont schedule jobs while in reset" drm/amdgpu: fix license on Kconfig and Makefiles drm/amdgpu/gfx10: update gfx golden settings for navi14 drm/amdgpu/gfx10: update gfx golden settings drm/amdgpu/gfx10: update gfx golden settings for navi14 drm/amdgpu/gfx10: update gfx golden settings drm/i915: Serialise with remote retirement drm/amd/display: include linux/slab.h where needed drm/amd/display: fix undefined struct member reference drm/nouveau/kms/nv50-: fix panel scaling drm/nouveau/kms/nv50-: Limit MST BPC to 8 drm/nouveau/kms/nv50-: Store the bpc we're using in nv50_head_atom drm/nouveau/kms/nv50-: Call outp_atomic_check_view() before handling PBN drm/nouveau: Fix drm-core using atomic code-paths on pre-nv50 hardware drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit drm/i915/gt: Detect if we miss WaIdleLiteRestore drm/i915/hdcp: Nuke intel_hdcp_transcoder_config() ... commit f1fcd7786ec8e316b69860ab856f29f346a9b301 Merge: 5bd831a469e0 5addeae1bedc Author: Linus Torvalds Date: Fri Dec 13 14:27:19 2019 -0800 Merge tag 'for-linus-20191212' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - stable fix for the bi_size overflow. Not a corruption issue, but a case wher we could merge but disallowed (Andreas) - NVMe pull request via Keith, with various fixes. - MD pull request from Song. - Merge window regression fix for the rq passthrough stats (Logan) - Remove unused blkcg_drain_queue() function (Guoqing) * tag 'for-linus-20191212' of git://git.kernel.dk/linux-block: blk-cgroup: remove blkcg_drain_queue block: fix NULL pointer dereference in account statistics with IDE md: make sure desc_nr less than MD_SB_DISKS md: raid1: check rdev before reference in raid1_sync_request func raid5: need to set STRIPE_HANDLE for batch head block: fix "check bi_size overflow before merge" nvme/pci: Fix read queue count nvme/pci Limit write queue sizes to possible cpus nvme/pci: Fix write and poll queue types nvme/pci: Remove last_cq_head nvme: Namepace identification descriptor list is optional nvme-fc: fix double-free scenarios on hw queues nvme: else following return is not needed nvme: add error message on mismatching controller ids nvme_fc: add module to ops template to allow module references nvmet-loop: Avoid preallocating big SGL for data nvme-fc: Avoid preallocating big SGL for data nvme-rdma: Avoid preallocating big SGL for data commit 5bd831a469e0c8368fe02b21157ea5c731f84967 Merge: 15da849c910d 9e3aa61ae3e0 Author: Linus Torvalds Date: Fri Dec 13 14:24:54 2019 -0800 Merge tag 'io_uring-5.5-20191212' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: - A tweak to IOSQE_IO_LINK (also marked for stable) to allow links that don't sever if the result is < 0. This is mostly for linked timeouts, where if we ask for a pure timeout we always get -ETIME. This makes links useless for that case, hence allow a case where it works. - Five minor optimizations to fix and improve cases that regressed since v5.4. - An SQTHREAD locking fix. - A sendmsg/recvmsg iov assignment fix. - Net fix where read_iter/write_iter don't honor IOCB_NOWAIT, and subsequently ensuring that works for io_uring. - Fix a case where for an invalid opcode we might return -EBADF instead of -EINVAL, if the ->fd of that sqe was set to an invalid fd value. * tag 'io_uring-5.5-20191212' of git://git.kernel.dk/linux-block: io_uring: ensure we return -EINVAL on unknown opcode io_uring: add sockets to list of files that support non-blocking issue net: make socket read/write_iter() honor IOCB_NOWAIT io_uring: only hash regular files for async work execution io_uring: run next sqe inline if possible io_uring: don't dynamically allocate poll data io_uring: deferred send/recvmsg should assign iov io_uring: sqthread should grab ctx->uring_lock for submissions io-wq: briefly spin for new work after finishing work io-wq: remove worker->wait waitqueue io_uring: allow unbreakable links commit 15da849c910da05622c75c5741dd6e176a8b6fe2 Merge: 22ff311af9c7 7fc979f8204f Author: Linus Torvalds Date: Fri Dec 13 14:13:15 2019 -0800 Merge tag 'for-5.5/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM multipath by restoring full path selector functionality for bio-based configurations that don't haave a SCSI device handler. - Fix dm-btree removal to ensure non-root btree nodes have at least (max_entries / 3) entries. This resolves userspace thin_check utility's report of "too few entries in btree_node". - Fix both the DM thin-provisioning and dm-clone targets to properly flush the data device prior to metadata commit. This resolves the potential for inconsistency across a power loss event when the data device has a volatile writeback cache. - Small documentation fixes to dm-clone and dm-integrity. * tag 'for-5.5/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: docs: dm-integrity: remove reference to ARC4 dm thin: Flush data device before committing metadata dm thin metadata: Add support for a pre-commit callback dm clone: Flush destination device before committing metadata dm clone metadata: Use a two phase commit dm clone metadata: Track exact changes per transaction dm btree: increase rebalance threshold in __rebalance2() dm: add dm-clone to the documentation index dm mpath: remove harmful bio-based optimization commit 22ff311af9c7d0eca4e9d276e95c4793a6ecf84f Merge: 37d4e84f765b c593642c8be0 Author: Linus Torvalds Date: Fri Dec 13 14:02:12 2019 -0800 Merge tag 'sizeof_field-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull FIELD_SIZEOF conversion from Kees Cook: "A mostly mechanical treewide conversion from FIELD_SIZEOF() to sizeof_field(). This avoids the redundancy of having 2 macros (actually 3) doing the same thing, and consolidates on sizeof_field(). While "field" is not an accurate name, it is the common name used in the kernel, and doesn't result in any unintended innuendo. As there are still users of FIELD_SIZEOF() in -next, I will clean up those during this coming development cycle and send the final old macro removal patch at that time" * tag 'sizeof_field-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: treewide: Use sizeof_field() macro MIPS: OCTEON: Replace SIZEOF_FIELD() macro commit 913e73c77d48aeeb50c16450a653dca9c71ae2e2 Author: Frederic Barrat Date: Mon Dec 9 11:55:13 2019 +0100 ocxl: Fix potential memory leak on context creation If we couldn't fully init a context, we were leaking memory. Fixes: b9721d275cc2 ("ocxl: Allow external drivers to use OpenCAPI contexts") Signed-off-by: Frederic Barrat Acked-by: Andrew Donnellan Reviewed-by: Greg Kurz Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191209105513.8566-1-fbarrat@linux.ibm.com commit 099bc4812f09155da77eeb960a983470249c9ce1 Author: Christophe Leroy Date: Mon Dec 9 06:19:08 2019 +0000 powerpc/irq: fix stack overflow verification Before commit 0366a1c70b89 ("powerpc/irq: Run softirqs off the top of the irq stack"), check_stack_overflow() was called by do_IRQ(), before switching to the irq stack. In that commit, do_IRQ() was renamed __do_irq(), and is now executing on the irq stack, so check_stack_overflow() has just become almost useless. Move check_stack_overflow() call in do_IRQ() to do the check while still on the current stack. Fixes: 0366a1c70b89 ("powerpc/irq: Run softirqs off the top of the irq stack") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/e033aa8116ab12b7ca9a9c75189ad0741e3b9b5f.1575872340.git.christophe.leroy@c-s.fr commit 9a4b8148562d76d3c31a937f9b61d32308b5c974 Merge: 89f33b984a51 e709ed70d122 Author: Olof Johansson Date: Fri Dec 13 12:43:33 2019 -0800 Merge tag 'omap-for-v5.5/fixes-rc1-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Fixes for omap variants for v5.5-rc1 cycle This series of changes contains fixes for issues recently noticed: - The ti-sysc interconnect target module driver needs fixes for mstandby quirk handling and reset delay - We need to configure am335x-sancloud-bbe to use rgmii-id mode because of the phy changes done earlier - NET_SWITCHDEV is no longer selected in Kconfig but a dependency and we must enable CONFIG_NET_SWITCHDEV to have TI_CPSW_SWITCHDEV - We are still relying on DEBUG_FS at least for PM configuration, let's add it back - We need to update compatible for am437x-gp/epos-evm because of the recent changes to use generic panels * tag 'omap-for-v5.5/fixes-rc1-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: bus: ti-sysc: Fix missing reset delay handling ARM: dts: am437x-gp/epos-evm: fix panel compatible ARM: omap2plus_defconfig: Add back DEBUG_FS ARM: omap2plus_defconfig: enable NET_SWITCHDEV ARM: dts: am335x-sancloud-bbe: fix phy mode bus: ti-sysc: Fix missing force mstandby quirk handling Link: https://lore.kernel.org/r/pull-1576254925-709310@atomide.com Signed-off-by: Olof Johansson commit 279b1fed09eaa921379c6f1e3347e4161ef5f76a Merge: d935bd50dd14 2688302bf192 Author: Linus Walleij Date: Fri Dec 13 14:24:41 2019 +0100 Merge tag 'gpio-v5.5-rc2-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes gpio fixes for v5.5-rc2 - fix gpio-xtensa build failure - fix a regression in gpio-mockup - fix a gcc warning in gpio-aspeed - fix a section mismatch problem in xgs-iproc - fix a problem with emulated open-drain outputs in gpiolib core - switch to bitops in gpio-pca953x after converting the driver to using bitmap - add a missed file to MAINTAINERS entry commit fbd542971aa1e9ec33212afe1d9b4f1106cd85a1 Author: Anand Jain Date: Thu Dec 5 19:39:07 2019 +0800 btrfs: send: remove WARN_ON for readonly mount We log warning if root::orphan_cleanup_state is not set to ORPHAN_CLEANUP_DONE in btrfs_ioctl_send(). However if the filesystem is mounted as readonly we skip the orphan item cleanup during the lookup and root::orphan_cleanup_state remains at the init state 0 instead of ORPHAN_CLEANUP_DONE (2). So during send in btrfs_ioctl_send() we hit the warning as below. WARN_ON(send_root->orphan_cleanup_state != ORPHAN_CLEANUP_DONE); WARNING: CPU: 0 PID: 2616 at /Volumes/ws/btrfs-devel/fs/btrfs/send.c:7090 btrfs_ioctl_send+0xb2f/0x18c0 [btrfs] :: RIP: 0010:btrfs_ioctl_send+0xb2f/0x18c0 [btrfs] :: Call Trace: :: _btrfs_ioctl_send+0x7b/0x110 [btrfs] btrfs_ioctl+0x150a/0x2b00 [btrfs] :: do_vfs_ioctl+0xa9/0x620 ? __fget+0xac/0xe0 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x49/0x130 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Reproducer: mkfs.btrfs -fq /dev/sdb mount /dev/sdb /btrfs btrfs subvolume create /btrfs/sv1 btrfs subvolume snapshot -r /btrfs/sv1 /btrfs/ss1 umount /btrfs mount -o ro /dev/sdb /btrfs btrfs send /btrfs/ss1 -f /tmp/f The warning exists because having orphan inodes could confuse send and cause it to fail or produce incorrect streams. The two cases that would cause such send failures, which are already fixed are: 1) Inodes that were unlinked - these are orphanized and remain with a link count of 0. These caused send operations to fail because it expected to always find at least one path for an inode. However this is no longer a problem since send is now able to deal with such inodes since commit 46b2f4590aab ("Btrfs: fix send failure when root has deleted files still open") and treats them as having been completely removed (the state after an orphan cleanup is performed). 2) Inodes that were in the process of being truncated. These resulted in send not knowing about the truncation and potentially issue write operations full of zeroes for the range from the new file size to the old file size. This is no longer a problem because we no longer create orphan items for truncation since commit f7e9e8fc792f ("Btrfs: stop creating orphan items for truncate"). As such before these commits, the WARN_ON here provided a clue in case something went wrong. Instead of being a warning against the root::orphan_cleanup_state value, it could have been more accurate by checking if there were actually any orphan items, and then issue a warning only if any exists, but that would be more expensive to check. Since orphanized inodes no longer cause problems for send, just remove the warning. Reported-by: Christoph Anton Mitterer Link: https://lore.kernel.org/linux-btrfs/21cb5e8d059f6e1496a903fa7bfc0a297e2f5370.camel@scientia.net/ CC: stable@vger.kernel.org # 4.19+ Suggested-by: Filipe Manana Reviewed-by: Filipe Manana Signed-off-by: Anand Jain Signed-off-by: David Sterba commit ca1aa2818a53875cfdd175fb5e9a2984e997cce9 Author: Josef Bacik Date: Fri Dec 6 09:37:18 2019 -0500 btrfs: do not leak reloc root if we fail to read the fs root If we fail to read the fs root corresponding with a reloc root we'll just break out and free the reloc roots. But we remove our current reloc_root from this list higher up, which means we'll leak this reloc_root. Fix this by adding ourselves back to the reloc_roots list so we are properly cleaned up. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9bc574de590510eff899c3ca8dbaf013566b5efe Author: Josef Bacik Date: Fri Dec 6 09:37:17 2019 -0500 btrfs: skip log replay on orphaned roots My fsstress modifications coupled with generic/475 uncovered a failure to mount and replay the log if we hit a orphaned root. We do not want to replay the log for an orphan root, but it's completely legitimate to have an orphaned root with a log attached. Fix this by simply skipping replaying the log. We still need to pin it's root node so that we do not overwrite it while replaying other logs, as we re-read the log root at every stage of the replay. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 714cd3e8cba6841220dce9063a7388a81de03825 Author: Josef Bacik Date: Fri Dec 6 11:39:00 2019 -0500 btrfs: handle ENOENT in btrfs_uuid_tree_iterate If we get an -ENOENT back from btrfs_uuid_iter_rem when iterating the uuid tree we'll just continue and do btrfs_next_item(). However we've done a btrfs_release_path() at this point and no longer have a valid path. So increment the key and go back and do a normal search. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit c7e54b5102bf3614cadb9ca32d7be73bad6cecf0 Author: Josef Bacik Date: Fri Dec 6 09:37:15 2019 -0500 btrfs: abort transaction after failed inode updates in create_subvol We can just abort the transaction here, and in fact do that for every other failure in this function except these two cases. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 147271e35ba267506dde6550f58ccf8d287db3ef Author: Filipe Manana Date: Thu Dec 5 16:58:41 2019 +0000 Btrfs: fix hole extent items with a zero size after range cloning Normally when cloning a file range if we find an implicit hole at the end of the range we assume it is because the NO_HOLES feature is enabled. However that is not always the case. One well known case [1] is when we have a power failure after mixing buffered and direct IO writes against the same file. In such cases we need to punch a hole in the destination file, and if the NO_HOLES feature is not enabled, we need to insert explicit file extent items to represent the hole. After commit 690a5dbfc51315 ("Btrfs: fix ENOSPC errors, leading to transaction aborts, when cloning extents"), we started to insert file extent items representing the hole with an item size of 0, which is invalid and should be 53 bytes (the size of a btrfs_file_extent_item structure), resulting in all sorts of corruptions and invalid memory accesses. This is detected by the tree checker when we attempt to write a leaf to disk. The problem can be sporadically triggered by test case generic/561 from fstests. That test case does not exercise power failure and creates a new filesystem when it starts, so it does not use a filesystem created by any previous test that tests power failure. However the test does both buffered and direct IO writes (through fsstress) and it's precisely that which is creating the implicit holes in files. That happens even before the commit mentioned earlier. I need to investigate why we get those implicit holes to check if there is a real problem or not. For now this change fixes the regression of introducing file extent items with an item size of 0 bytes. Fix the issue by calling btrfs_punch_hole_range() without passing a btrfs_clone_extent_info structure, which ensures file extent items are inserted to represent the hole with a correct item size. We were passing a btrfs_clone_extent_info with a value of 0 for its 'item_size' field, which was causing the insertion of file extent items with an item size of 0. [1] https://www.spinics.net/lists/linux-btrfs/msg75350.html Reported-by: David Sterba Fixes: 690a5dbfc51315 ("Btrfs: fix ENOSPC errors, leading to transaction aborts, when cloning extents") Signed-off-by: Filipe Manana Reviewed-by: Josef Bacik Signed-off-by: David Sterba commit 6609fee8897ac475378388238456c84298bff802 Author: Filipe Manana Date: Fri Dec 6 12:27:39 2019 +0000 Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues When a tree mod log user no longer needs to use the tree it calls btrfs_put_tree_mod_seq() to remove itself from the list of users and delete all no longer used elements of the tree's red black tree, which should be all elements with a sequence number less then our equals to the caller's sequence number. However the logic is broken because it can delete and free elements from the red black tree that have a sequence number greater then the caller's sequence number: 1) At a point in time we have sequence numbers 1, 2, 3 and 4 in the tree mod log; 2) The task which got assigned the sequence number 1 calls btrfs_put_tree_mod_seq(); 3) Sequence number 1 is deleted from the list of sequence numbers; 4) The current minimum sequence number is computed to be the sequence number 2; 5) A task using sequence number 2 is at tree_mod_log_rewind() and gets a pointer to one of its elements from the red black tree through a call to tree_mod_log_search(); 6) The task with sequence number 1 iterates the red black tree of tree modification elements and deletes (and frees) all elements with a sequence number less then or equals to 2 (the computed minimum sequence number) - it ends up only leaving elements with sequence numbers of 3 and 4; 7) The task with sequence number 2 now uses the pointer to its element, already freed by the other task, at __tree_mod_log_rewind(), resulting in a use-after-free issue. When CONFIG_DEBUG_PAGEALLOC=y it produces a trace like the following: [16804.546854] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [16804.547451] CPU: 0 PID: 28257 Comm: pool Tainted: G W 5.4.0-rc8-btrfs-next-51 #1 [16804.548059] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 [16804.548666] RIP: 0010:rb_next+0x16/0x50 (...) [16804.550581] RSP: 0018:ffffb948418ef9b0 EFLAGS: 00010202 [16804.551227] RAX: 6b6b6b6b6b6b6b6b RBX: ffff90e0247f6600 RCX: 6b6b6b6b6b6b6b6b [16804.551873] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff90e0247f6600 [16804.552504] RBP: ffff90dffe0d4688 R08: 0000000000000001 R09: 0000000000000000 [16804.553136] R10: ffff90dffa4a0040 R11: 0000000000000000 R12: 000000000000002e [16804.553768] R13: ffff90e0247f6600 R14: 0000000000001663 R15: ffff90dff77862b8 [16804.554399] FS: 00007f4b197ae700(0000) GS:ffff90e036a00000(0000) knlGS:0000000000000000 [16804.555039] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [16804.555683] CR2: 00007f4b10022000 CR3: 00000002060e2004 CR4: 00000000003606f0 [16804.556336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [16804.556968] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [16804.557583] Call Trace: [16804.558207] __tree_mod_log_rewind+0xbf/0x280 [btrfs] [16804.558835] btrfs_search_old_slot+0x105/0xd00 [btrfs] [16804.559468] resolve_indirect_refs+0x1eb/0xc70 [btrfs] [16804.560087] ? free_extent_buffer.part.19+0x5a/0xc0 [btrfs] [16804.560700] find_parent_nodes+0x388/0x1120 [btrfs] [16804.561310] btrfs_check_shared+0x115/0x1c0 [btrfs] [16804.561916] ? extent_fiemap+0x59d/0x6d0 [btrfs] [16804.562518] extent_fiemap+0x59d/0x6d0 [btrfs] [16804.563112] ? __might_fault+0x11/0x90 [16804.563706] do_vfs_ioctl+0x45a/0x700 [16804.564299] ksys_ioctl+0x70/0x80 [16804.564885] ? trace_hardirqs_off_thunk+0x1a/0x20 [16804.565461] __x64_sys_ioctl+0x16/0x20 [16804.566020] do_syscall_64+0x5c/0x250 [16804.566580] entry_SYSCALL_64_after_hwframe+0x49/0xbe [16804.567153] RIP: 0033:0x7f4b1ba2add7 (...) [16804.568907] RSP: 002b:00007f4b197adc88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [16804.569513] RAX: ffffffffffffffda RBX: 00007f4b100210d8 RCX: 00007f4b1ba2add7 [16804.570133] RDX: 00007f4b100210d8 RSI: 00000000c020660b RDI: 0000000000000003 [16804.570726] RBP: 000055de05a6cfe0 R08: 0000000000000000 R09: 00007f4b197add44 [16804.571314] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4b197add48 [16804.571905] R13: 00007f4b197add40 R14: 00007f4b100210d0 R15: 00007f4b197add50 (...) [16804.575623] ---[ end trace 87317359aad4ba50 ]--- Fix this by making btrfs_put_tree_mod_seq() skip deletion of elements that have a sequence number equals to the computed minimum sequence number, and not just elements with a sequence number greater then that minimum. Fixes: bd989ba359f2ac ("Btrfs: add tree modification log functions") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit ad1d8c439978ede77cbf73cbdd11bafe810421a5 Author: Filipe Manana Date: Mon Dec 2 11:01:03 2019 +0000 Btrfs: make tree checker detect checksum items with overlapping ranges Having checksum items, either on the checksums tree or in a log tree, that represent ranges that overlap each other is a sign of a corruption. Such case confuses the checksum lookup code and can result in not being able to find checksums or find stale checksums. So add a check for such case. This is motivated by a recent fix for a case where a log tree had checksum items covering ranges that overlap each other due to extent cloning, and resulted in missing checksums after replaying the log tree. It also helps detect past issues such as stale and outdated checksums due to overlapping, commit 27b9a8122ff71a ("Btrfs: fix csum tree corruption, duplicate and outdated checksums"). CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 40e046acbd2f369cfbf93c3413639c66514cec2d Author: Filipe Manana Date: Thu Dec 5 16:58:30 2019 +0000 Btrfs: fix missing data checksums after replaying a log tree When logging a file that has shared extents (reflinked with other files or with itself), we can end up logging multiple checksum items that cover overlapping ranges. This confuses the search for checksums at log replay time causing some checksums to never be added to the fs/subvolume tree. Consider the following example of a file that shares the same extent at offsets 0 and 256Kb: [ bytenr 13893632, offset 64Kb, len 64Kb ] 0 64Kb [ bytenr 13631488, offset 64Kb, len 192Kb ] 64Kb 256Kb [ bytenr 13893632, offset 0, len 256Kb ] 256Kb 512Kb When logging the inode, at tree-log.c:copy_items(), when processing the file extent item at offset 0, we log a checksum item covering the range 13959168 to 14024704, which corresponds to 13893632 + 64Kb and 13893632 + 64Kb + 64Kb, respectively. Later when processing the extent item at offset 256K, we log the checksums for the range from 13893632 to 14155776 (which corresponds to 13893632 + 256Kb). These checksums get merged with the checksum item for the range from 13631488 to 13893632 (13631488 + 256Kb), logged by a previous fsync. So after this we get the two following checksum items in the log tree: (...) item 6 key (EXTENT_CSUM EXTENT_CSUM 13631488) itemoff 3095 itemsize 512 range start 13631488 end 14155776 length 524288 item 7 key (EXTENT_CSUM EXTENT_CSUM 13959168) itemoff 3031 itemsize 64 range start 13959168 end 14024704 length 65536 The first one covers the range from the second one, they overlap. So far this does not cause a problem after replaying the log, because when replaying the file extent item for offset 256K, we copy all the checksums for the extent 13893632 from the log tree to the fs/subvolume tree, since searching for an checksum item for bytenr 13893632 leaves us at the first checksum item, which covers the whole range of the extent. However if we write 64Kb to file offset 256Kb for example, we will not be able to find and copy the checksums for the last 128Kb of the extent at bytenr 13893632, referenced by the file range 384Kb to 512Kb. After writing 64Kb into file offset 256Kb we get the following extent layout for our file: [ bytenr 13893632, offset 64K, len 64Kb ] 0 64Kb [ bytenr 13631488, offset 64Kb, len 192Kb ] 64Kb 256Kb [ bytenr 14155776, offset 0, len 64Kb ] 256Kb 320Kb [ bytenr 13893632, offset 64Kb, len 192Kb ] 320Kb 512Kb After fsync'ing the file, if we have a power failure and then mount the filesystem to replay the log, the following happens: 1) When replaying the file extent item for file offset 320Kb, we lookup for the checksums for the extent range from 13959168 (13893632 + 64Kb) to 14155776 (13893632 + 256Kb), through a call to btrfs_lookup_csums_range(); 2) btrfs_lookup_csums_range() finds the checksum item that starts precisely at offset 13959168 (item 7 in the log tree, shown before); 3) However that checksum item only covers 64Kb of data, and not 192Kb of data; 4) As a result only the checksums for the first 64Kb of data referenced by the file extent item are found and copied to the fs/subvolume tree. The remaining 128Kb of data, file range 384Kb to 512Kb, doesn't get the corresponding data checksums found and copied to the fs/subvolume tree. 5) After replaying the log userspace will not be able to read the file range from 384Kb to 512Kb, because the checksums are missing and resulting in an -EIO error. The following steps reproduce this scenario: $ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt/sdc $ xfs_io -f -c "pwrite -S 0xa3 0 256K" /mnt/sdc/foobar $ xfs_io -c "fsync" /mnt/sdc/foobar $ xfs_io -c "pwrite -S 0xc7 256K 256K" /mnt/sdc/foobar $ xfs_io -c "reflink /mnt/sdc/foobar 320K 0 64K" /mnt/sdc/foobar $ xfs_io -c "fsync" /mnt/sdc/foobar $ xfs_io -c "pwrite -S 0xe5 256K 64K" /mnt/sdc/foobar $ xfs_io -c "fsync" /mnt/sdc/foobar $ mount /dev/sdc /mnt/sdc $ md5sum /mnt/sdc/foobar md5sum: /mnt/sdc/foobar: Input/output error $ dmesg | tail [165305.003464] BTRFS info (device sdc): no csum found for inode 257 start 401408 [165305.004014] BTRFS info (device sdc): no csum found for inode 257 start 405504 [165305.004559] BTRFS info (device sdc): no csum found for inode 257 start 409600 [165305.005101] BTRFS info (device sdc): no csum found for inode 257 start 413696 [165305.005627] BTRFS info (device sdc): no csum found for inode 257 start 417792 [165305.006134] BTRFS info (device sdc): no csum found for inode 257 start 421888 [165305.006625] BTRFS info (device sdc): no csum found for inode 257 start 425984 [165305.007278] BTRFS info (device sdc): no csum found for inode 257 start 430080 [165305.008248] BTRFS warning (device sdc): csum failed root 5 ino 257 off 393216 csum 0x1337385e expected csum 0x00000000 mirror 1 [165305.009550] BTRFS warning (device sdc): csum failed root 5 ino 257 off 393216 csum 0x1337385e expected csum 0x00000000 mirror 1 Fix this simply by deleting first any checksums, from the log tree, for the range of the extent we are logging at copy_items(). This ensures we do not get checksum items in the log tree that have overlapping ranges. This is a long time issue that has been present since we have the clone (and deduplication) ioctl, and can happen both when an extent is shared between different files and within the same file. A test case for fstests follows soon. CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit b6293c821ea8fa2a631a2112cd86cd435effeb8b Author: Dan Carpenter Date: Tue Dec 3 14:24:58 2019 +0300 btrfs: return error pointer from alloc_test_extent_buffer Callers of alloc_test_extent_buffer have not correctly interpreted the return value as error pointer, as alloc_test_extent_buffer should behave as alloc_extent_buffer. The self-tests were unaffected but btrfs_find_create_tree_block could call both functions and that would cause problems up in the call chain. Fixes: faa2dbf004e8 ("Btrfs: add sanity tests for new qgroup accounting code") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Dan Carpenter Reviewed-by: David Sterba Signed-off-by: David Sterba commit cf93e15eca0bcb457b6a85b3480c1e379407dd26 Author: David Sterba Date: Wed Nov 27 16:10:54 2019 +0100 btrfs: fix devs_max constraints for raid1c3 and raid1c4 The value 0 for devs_max means to spread the allocated chunks over all available devices, eg. stripe for RAID0 or RAID5. This got mistakenly copied to the RAID1C3/4 profiles. The intention is to have exactly 3 and 4 copies respectively. Fixes: 47e6f7423b91 ("btrfs: add support for 3-copy replication (raid1c3)") Fixes: 8d6fac0087e5 ("btrfs: add support for 4-copy replication (raid1c4)") Signed-off-by: David Sterba commit 994bf9cd78aa382c0c3c70b7cf9c00f7529176c2 Author: Andreas Färber Date: Fri Nov 8 22:38:52 2019 +0100 btrfs: tree-checker: Fix error format string for size_t Argument BTRFS_FILE_EXTENT_INLINE_DATA_START is defined as offsetof(), which returns type size_t, so we need %zu instead of %lu. This fixes a build warning on 32-bit ARM: ../fs/btrfs/tree-checker.c: In function 'check_extent_data_item': ../fs/btrfs/tree-checker.c:230:43: warning: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'unsigned int' [-Wformat=] 230 | "invalid item size, have %u expect [%lu, %u)", | ~~^ | long unsigned int | %u Fixes: 153a6d299956 ("btrfs: tree-checker: Check item size before reading file extent type") Acked-by: Geert Uytterhoeven Signed-off-by: Andreas Färber Reviewed-by: David Sterba Signed-off-by: David Sterba commit 943eb3bf25f4a7b745dd799e031be276aa104d82 Author: Josef Bacik Date: Tue Nov 19 13:59:20 2019 -0500 btrfs: don't double lock the subvol_sem for rename exchange If we're rename exchanging two subvols we'll try to lock this lock twice, which is bad. Just lock once if either of the ino's are subvols. Fixes: cdd1fedf8261 ("btrfs: add support for RENAME_EXCHANGE and RENAME_WHITEOUT") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit db8fe64f9ce61d1d89d3c3c34d111a43afb9f053 Author: Josef Bacik Date: Tue Nov 19 13:59:00 2019 -0500 btrfs: handle error in btrfs_cache_block_group We have a BUG_ON(ret < 0) in find_free_extent from btrfs_cache_block_group. If we fail to allocate our ctl we'll just panic, which is not good. Instead just go on to another block group. If we fail to find a block group we don't want to return ENOSPC, because really we got a ENOMEM and that's the root of the problem. Save our return from btrfs_cache_block_group(), and then if we still fail to make our allocation return that ret so we get the right error back. Tested with inject-error.py from bcc. Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit f72ff01df9cf5db25c76674cac16605992d15467 Author: Josef Bacik Date: Tue Nov 19 13:59:35 2019 -0500 btrfs: do not call synchronize_srcu() in inode_tree_del Testing with the new fsstress uncovered a pretty nasty deadlock with lookup and snapshot deletion. Process A unlink -> final iput -> inode_tree_del -> synchronize_srcu(subvol_srcu) Process B btrfs_lookup <- srcu_read_lock() acquired here -> btrfs_iget -> find inode that has I_FREEING set -> __wait_on_freeing_inode() We're holding the srcu_read_lock() while doing the iget in order to make sure our fs root doesn't go away, and then we are waiting for the inode to finish freeing. However because the free'ing process is doing a synchronize_srcu() we deadlock. Fix this by dropping the synchronize_srcu() in inode_tree_del(). We don't need people to stop accessing the fs root at this point, we're only adding our empty root to the dead roots list. A larger much more invasive fix is forthcoming to address how we deal with fs roots, but this fixes the immediate problem. Fixes: 76dda93c6ae2 ("Btrfs: add snapshot/subvolume destroy ioctl") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit fa2cdb1762d15f701b83efa60b04f0d04e71bf89 Author: Geert Uytterhoeven Date: Mon Dec 9 11:13:27 2019 +0100 ARM: shmobile: defconfig: Restore debugfs support Since commit 0e4a459f56c32d3e ("tracing: Remove unnecessary DEBUG_FS dependency"), CONFIG_DEBUG_FS is no longer auto-enabled. This breaks booting Debian 9, as systemd needs debugfs: [FAILED] Failed to mount /sys/kernel/debug. See 'systemctl status sys-kernel-debug.mount' for details. [DEPEND] Dependency failed for Local File Systems. ... You are in emergGive root password for maintenance (or press Control-D to continue): Fix this by enabling CONFIG_DEBUG_FS explicitly. See also commit 18977008f44c66bd ("ARM: multi_v7_defconfig: Restore debugfs support"). Signed-off-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/20191209101327.26571-1-geert+renesas@glider.be commit 4f3882177240a1f55e45a3d241d3121341bead78 Author: Dmitry Torokhov Date: Sat Dec 7 13:05:18 2019 -0800 HID: hid-input: clear unmapped usages We should not be leaving half-mapped usages with potentially invalid keycodes, as that may confuse hidinput_find_key() when the key is located by index, which may end up feeding way too large keycode into the VT keyboard handler and cause OOB write there: BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline] BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722 ... kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118 input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145 input_pass_values drivers/input/input.c:949 [inline] input_set_keycode+0x290/0x320 drivers/input/input.c:954 evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882 evdev_do_ioctl drivers/input/evdev.c:1150 [inline] Cc: stable@vger.kernel.org Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com Signed-off-by: Dmitry Torokhov Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit fcb970581dd900675c4371c2b688a57924a8368c Author: Filipe Manana Date: Thu Dec 5 16:57:39 2019 +0000 Btrfs: fix cloning range with a hole when using the NO_HOLES feature When using the NO_HOLES feature if we clone a range that contains a hole and a temporary ENOSPC happens while dropping extents from the target inode's range, we can end up failing and aborting the transaction with -EEXIST or with a corrupt file extent item, that has a length greater than it should and overlaps with other extents. For example when cloning the following range from inode A to inode B: Inode A: extent A1 extent A2 [ ----------- ] [ hole, implicit, 4MB length ] [ ------------- ] 0 1MB 5MB 6MB Range to clone: [1MB, 6MB) Inode B: extent B1 extent B2 extent B3 extent B4 [ ---------- ] [ --------- ] [ ---------- ] [ ---------- ] 0 1MB 1MB 2MB 2MB 5MB 5MB 6MB Target range: [1MB, 6MB) (same as source, to make it easier to explain) The following can happen: 1) btrfs_punch_hole_range() gets -ENOSPC from __btrfs_drop_extents(); 2) At that point, 'cur_offset' is set to 1MB and __btrfs_drop_extents() set 'drop_end' to 2MB, meaning it was able to drop only extent B2; 3) We then compute 'clone_len' as 'drop_end' - 'cur_offset' = 2MB - 1MB = 1MB; 4) We then attempt to insert a file extent item at inode B with a file offset of 5MB, which is the value of clone_info->file_offset. This fails with error -EEXIST because there's already an extent at that offset (extent B4); 5) We abort the current transaction with -EEXIST and return that error to user space as well. Another example, for extent corruption: Inode A: extent A1 extent A2 [ ----------- ] [ hole, implicit, 10MB length ] [ ------------- ] 0 1MB 11MB 12MB Inode B: extent B1 extent B2 [ ----------- ] [ --------- ] [ ----------------------------- ] 0 1MB 1MB 5MB 5MB 12MB Target range: [1MB, 12MB) (same as source, to make it easier to explain) 1) btrfs_punch_hole_range() gets -ENOSPC from __btrfs_drop_extents(); 2) At that point, 'cur_offset' is set to 1MB and __btrfs_drop_extents() set 'drop_end' to 5MB, meaning it was able to drop only extent B2; 3) We then compute 'clone_len' as 'drop_end' - 'cur_offset' = 5MB - 1MB = 4MB; 4) We then insert a file extent item at inode B with a file offset of 11MB which is the value of clone_info->file_offset, and a length of 4MB (the value of 'clone_len'). So we get 2 extents items with ranges that overlap and an extent length of 4MB, larger then the extent A2 from inode A (1MB length); 5) After that we end the transaction, balance the btree dirty pages and then start another or join the previous transaction. It might happen that the transaction which inserted the incorrect extent was committed by another task so we end up with extent corruption if a power failure happens. So fix this by making sure we attempt to insert the extent to clone at the destination inode only if we are past dropping the sub-range that corresponds to a hole. Fixes: 690a5dbfc51315 ("Btrfs: fix ENOSPC errors, leading to transaction aborts, when cloning extents") Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 37d02592f11bb76e4ab1dcaa5b8a2a0715403207 Author: Nikolay Borisov Date: Mon Nov 18 14:16:44 2019 +0200 btrfs: Fix error messages in qgroup_rescan_init The branch of qgroup_rescan_init which is executed from the mount path prints wrong errors messages. The textual print out in case BTRFS_QGROUP_STATUS_FLAG_RESCAN/BTRFS_QGROUP_STATUS_FLAG_ON are not set are transposed. Fix it by exchanging their place. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit fd0913768701612fc2b8ab9c8a5c019133e8d978 Author: Pavel Balan Date: Wed Nov 27 03:23:29 2019 +0000 HID: Add quirk for incorrect input length on Lenovo Y720 Apply it to the Lenovo Y720 gaming laptop I2C peripheral then. This fixes dmesg being flooded with errors visible on un-suspend in Linux Mint 19 Cinnamon. Example of error log: <...> [ 4.326588] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4) [ 4.326845] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4) [ 4.327095] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4) [ 4.327341] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4) [ 4.327609] i2c_hid i2c-ITE33D1:00: i2c_hid_get_input: incomplete report (2/4) <...> Example of fixed log (debug on) <...> [ 3731.333183] i2c_hid i2c-ITE33D1:00: input: 02 00 [ 3731.333581] i2c_hid i2c-ITE33D1:00: input: 02 00 [ 3731.333842] i2c_hid i2c-ITE33D1:00: input: 02 00 [ 3731.334107] i2c_hid i2c-ITE33D1:00: input: 02 00 [ 3731.334367] i2c_hid i2c-ITE33D1:00: input: 02 00 <...> [jkosina@suse.cz: rebase onto more recent codebase] Signed-off-by: Pavel Balan Signed-off-by: Jiri Kosina commit 8fabc623238e68b3ac63c0dd1657bf86c1fa33af Author: Mike Rapoport Date: Wed Dec 4 14:35:24 2019 +0200 powerpc: Ensure that swiotlb buffer is allocated from low memory Some powerpc platforms (e.g. 85xx) limit DMA-able memory way below 4G. If a system has more physical memory than this limit, the swiotlb buffer is not addressable because it is allocated from memblock using top-down mode. Force memblock to bottom-up mode before calling swiotlb_init() to ensure that the swiotlb buffer is DMA-able. Reported-by: Christian Zigotzky Signed-off-by: Mike Rapoport Reviewed-by: Christoph Hellwig Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191204123524.22919-1-rppt@kernel.org commit e5a52a1d15c79bb48a430fb263852263ec1d3f11 Author: Hans Verkuil Date: Sat Dec 7 23:43:23 2019 +0100 media: pulse8-cec: fix lost cec_transmit_attempt_done() call The periodic PING command could interfere with the result of a CEC transmit, causing a lost cec_transmit_attempt_done() call. Signed-off-by: Hans Verkuil Cc: # for v4.10 and up Signed-off-by: Mauro Carvalho Chehab commit ac479b51f3f4aaa852b5d3f00ecfb9290230cf64 Author: Hans Verkuil Date: Wed Dec 11 12:47:57 2019 +0100 media: cec: check 'transmit_in_progress', not 'transmitting' Currently wait_event_interruptible_timeout is called in cec_thread_func() when adap->transmitting is set. But if the adapter is unconfigured while transmitting, then adap->transmitting is set to NULL. But the hardware is still actually transmitting the message, and that's indicated by adap->transmit_in_progress and we should wait until that is finished or times out before transmitting new messages. As the original commit says: adap->transmitting is the userspace view, adap->transmit_in_progress reflects the hardware state. However, if adap->transmitting is NULL and adap->transmit_in_progress is true, then wait_event_interruptible is called (no timeout), which can get stuck indefinitely if the CEC driver is flaky and never marks the transmit-in-progress as 'done'. So test against transmit_in_progress when deciding whether to use the timeout variant or not, instead of testing against adap->transmitting. Signed-off-by: Hans Verkuil Fixes: 32804fcb612b ("media: cec: keep track of outstanding transmits") Cc: # for v4.19 and up Signed-off-by: Mauro Carvalho Chehab commit 95c29d46ab2a517e4c26d0a07300edca6768db17 Author: Hans Verkuil Date: Sat Dec 7 23:48:09 2019 +0100 media: cec: avoid decrementing transmit_queue_sz if it is 0 WARN if transmit_queue_sz is 0 but do not decrement it. The CEC adapter will become unresponsive if it goes below 0 since then it thinks there are 4 billion messages in the queue. Obviously this should not happen, but a driver bug could cause this. Signed-off-by: Hans Verkuil Cc: # for v4.12 and up Signed-off-by: Mauro Carvalho Chehab commit cec935ce69fc386f13959578deb40963ebbb85c3 Author: Hans Verkuil Date: Wed Dec 4 08:52:08 2019 +0100 media: cec: CEC 2.0-only bcast messages were ignored Some messages are allowed to be a broadcast message in CEC 2.0 only, and should be ignored by CEC 1.4 devices. Unfortunately, the check was wrong, causing such messages to be marked as invalid under CEC 2.0. Signed-off-by: Hans Verkuil Cc: # for v4.10 and up Signed-off-by: Mauro Carvalho Chehab commit 656c21d6af5d9279dd7b51ca7a4a71008127044b Author: Srikar Dronamraju Date: Thu Dec 5 14:02:18 2019 +0530 powerpc/shared: Use static key to detect shared processor With the static key shared processor available, is_shared_processor() can return without having to query the lppaca structure. Signed-off-by: Srikar Dronamraju Acked-by: Phil Auld Acked-by: Waiman Long Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191213035036.6913-2-mpe@ellerman.id.au commit 14c73bd344da60abaf7da3ea2e7733ddda35bbac Author: Srikar Dronamraju Date: Thu Dec 5 14:02:17 2019 +0530 powerpc/vcpu: Assume dedicated processors as non-preempt With commit 247f2f6f3c70 ("sched/core: Don't schedule threads on pre-empted vCPUs"), the scheduler avoids preempted vCPUs to schedule tasks on wakeup. This leads to wrong choice of CPU, which in-turn leads to larger wakeup latencies. Eventually, it leads to performance regression in latency sensitive benchmarks like soltp, schbench etc. On Powerpc, vcpu_is_preempted() only looks at yield_count. If the yield_count is odd, the vCPU is assumed to be preempted. However yield_count is increased whenever the LPAR enters CEDE state (idle). So any CPU that has entered CEDE state is assumed to be preempted. Even if vCPU of dedicated LPAR is preempted/donated, it should have right of first-use since they are supposed to own the vCPU. On a Power9 System with 32 cores: # lscpu Architecture: ppc64le Byte Order: Little Endian CPU(s): 128 On-line CPU(s) list: 0-127 Thread(s) per core: 8 Core(s) per socket: 1 Socket(s): 16 NUMA node(s): 2 Model: 2.2 (pvr 004e 0202) Model name: POWER9 (architected), altivec supported Hypervisor vendor: pHyp Virtualization type: para L1d cache: 32K L1i cache: 32K L2 cache: 512K L3 cache: 10240K NUMA node0 CPU(s): 0-63 NUMA node1 CPU(s): 64-127 # perf stat -a -r 5 ./schbench v5.4 v5.4 + patch Latency percentiles (usec) Latency percentiles (usec) 50.0000th: 45 50.0th: 45 75.0000th: 62 75.0th: 63 90.0000th: 71 90.0th: 74 95.0000th: 77 95.0th: 78 *99.0000th: 91 *99.0th: 82 99.5000th: 707 99.5th: 83 99.9000th: 6920 99.9th: 86 min=0, max=10048 min=0, max=96 Latency percentiles (usec) Latency percentiles (usec) 50.0000th: 45 50.0th: 46 75.0000th: 61 75.0th: 64 90.0000th: 72 90.0th: 75 95.0000th: 79 95.0th: 79 *99.0000th: 691 *99.0th: 83 99.5000th: 3972 99.5th: 85 99.9000th: 8368 99.9th: 91 min=0, max=16606 min=0, max=117 Latency percentiles (usec) Latency percentiles (usec) 50.0000th: 45 50.0th: 46 75.0000th: 61 75.0th: 64 90.0000th: 71 90.0th: 75 95.0000th: 77 95.0th: 79 *99.0000th: 106 *99.0th: 83 99.5000th: 2364 99.5th: 84 99.9000th: 7480 99.9th: 90 min=0, max=10001 min=0, max=95 Latency percentiles (usec) Latency percentiles (usec) 50.0000th: 45 50.0th: 47 75.0000th: 62 75.0th: 65 90.0000th: 72 90.0th: 75 95.0000th: 78 95.0th: 79 *99.0000th: 93 *99.0th: 84 99.5000th: 108 99.5th: 85 99.9000th: 6792 99.9th: 90 min=0, max=17681 min=0, max=117 Latency percentiles (usec) Latency percentiles (usec) 50.0000th: 46 50.0th: 45 75.0000th: 62 75.0th: 64 90.0000th: 73 90.0th: 75 95.0000th: 79 95.0th: 79 *99.0000th: 113 *99.0th: 82 99.5000th: 2724 99.5th: 83 99.9000th: 6184 99.9th: 93 min=0, max=9887 min=0, max=111 Performance counter stats for 'system wide' (5 runs): context-switches 43,373 ( +- 0.40% ) 44,597 ( +- 0.55% ) cpu-migrations 1,211 ( +- 5.04% ) 220 ( +- 6.23% ) page-faults 15,983 ( +- 5.21% ) 15,360 ( +- 3.38% ) Waiman Long suggested using static_keys. Fixes: 247f2f6f3c70 ("sched/core: Don't schedule threads on pre-empted vCPUs") Cc: stable@vger.kernel.org # v4.18+ Reported-by: Parth Shah Reported-by: Ihor Pasichnyk Tested-by: Juri Lelli Acked-by: Waiman Long Reviewed-by: Gautham R. Shenoy Signed-off-by: Srikar Dronamraju Acked-by: Phil Auld Reviewed-by: Vaidyanathan Srinivasan Tested-by: Parth Shah [mpe: Move the key and setting of the key to pseries/setup.c] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191213035036.6913-1-mpe@ellerman.id.au commit d5a362149c4db2939a3d97e63fd2108489c60b41 Author: Rahul Tanwar Date: Thu Dec 5 11:01:31 2019 +0800 pinctrl: Modify Kconfig to fix linker error Fix below linker error ld: drivers/pinctrl/pinctrl-equilibrium.o: in function `pinconf_generic_dt_node_to_map_all': pinctrl-equilibrium.c:(.text+0xb): undefined reference to `pinconf_generic_dt_node_to_map' Caused by below commit 1948d5c51dba ("pinctrl: Add pinmux & GPIO controller driver for a new SoC") by adding 'depends on OF' in Kconfig driver entry. Reported-by: Randy Dunlap > Signed-off-by: Rahul Tanwar Link: https://lore.kernel.org/r/ba937f271d1a2173828a2325990d62cb36d61595.1575514110.git.rahul.tanwar@linux.intel.com Acked-by: Randy Dunlap # build-tested Signed-off-by: Linus Walleij commit a64556654b77e109152f97d7965ef1a5b7383035 Merge: 6ba2fd391ac5 b9a19bdbc843 Author: Linus Walleij Date: Fri Dec 13 11:01:10 2019 +0100 Merge tag 'intel-pinctrl-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into fixes intel-pinctrl for v5.5-2 * Fix Baytrail silicon issue by using a global lock * Fix North community pin names that user will assume their functions * Convert Cherryview and Baytrail to pass IRQ chip along with GPIO one The following is an automated git shortlog grouped by driver: baytrail: - Pass irqchip when adding gpiochip - Add GPIO <-> pin mapping ranges via callback - Update North Community pin list - Really serialize all register accesses cherryview: - Pass irqchip when adding gpiochip - Add GPIO <-> pin mapping ranges via callback - Split out irq hw-init into a separate helper function commit 6ba2fd391ac58c1a26874f10c3054a1ea4aca2d0 Author: Alexandre Torgue Date: Wed Dec 4 15:41:06 2019 +0100 pinctrl: pinmux: fix a possible null pointer in pinmux_can_be_used_for_gpio This commit adds a check on ops pointer to avoid a kernel panic when ops->strict is used. Indeed, on some pinctrl driver (at least for pinctrl-stmfx) the pinmux ops is not implemented. Let's assume than gpio can be used in this case. Fixes: 472a61e777fe ("pinctrl/gpio: Take MUX usage into account") Signed-off-by: Alexandre Torgue Link: https://lore.kernel.org/r/20191204144106.10876-1-alexandre.torgue@st.com Signed-off-by: Linus Walleij commit 911bde0fe5ccd7e55760be9d6dcc67a8850fcc12 Author: Toke Høiland-Jørgensen Date: Thu Dec 12 12:14:37 2019 +0100 mac80211: Turn AQL into an NL80211_EXT_FEATURE Instead of just having an airtime flag in debugfs, turn AQL into a proper NL80211_EXT_FEATURE, so drivers can turn it on when they are ready, and so we also expose the presence of the feature to userspace. This also has the effect of flipping the default, so drivers have to opt in to using AQL instead of getting it by default with TXQs. To keep functionality the same as pre-patch, we set this feature for ath10k (which is where it is needed the most). While we're at it, split out the debugfs interface so AQL gets its own per-station debugfs file instead of using the 'airtime' file. [Johannes:] This effectively disables AQL for iwlwifi, where it fixes a number of issues: * TSO in iwlwifi is causing underflows and associated warnings in AQL * HE (802.11ax) rates aren't reported properly so at HE rates, AQL could never have a valid estimate (it'd use 6 Mbps instead of up to 2400!) Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20191212111437.224294-1-toke@redhat.com Fixes: 3ace10f5b5ad ("mac80211: Implement Airtime-based Queue Limit (AQL)") Signed-off-by: Johannes Berg commit 4c84515da8099f4bab5d9312a0ffaf40f14aa87b Merge: e8ad8d5108e0 d4d814017697 b9ea0bae260f Author: Rafael J. Wysocki Date: Fri Dec 13 10:29:45 2019 +0100 Merge branches 'pm-cpuidle' and 'acpi-pm' * pm-cpuidle: cpuidle: Drop unnecessary type cast in cpuidle_poll_time() cpuidle: Fix cpuidle_driver_state_disabled() cpuidle: use first valid target residency as poll time * acpi-pm: ACPI: PM: Avoid attaching ACPI PM domain to certain devices commit c07a0254c89e4bb69ca781cd488baa5b628e2754 Author: Hans de Goede Date: Thu Oct 24 13:59:09 2019 +0200 HID: asus: Ignore Asus vendor-page usage-code 0xff events At least on a T100HA an Asus vendor-page usage-code 0xff event is send on every suspend and again on resume, resulting in the following warning: asus 0003:0B05:1807.0002: Unmapped Asus vendor usagepage code 0xff being logged twice on every suspend/resume. This commit silences the "Unmapped Asus vendor usagepage code ..." warning for usage-code 0xff to avoid these warnings being logged. Signed-off-by: Hans de Goede Signed-off-by: Jiri Kosina commit 8f18eca9ebc57d6b150237033f6439242907e0ba Author: Hans de Goede Date: Tue Nov 19 15:57:11 2019 +0100 HID: ite: Add USB id match for Acer SW5-012 keyboard dock The Acer SW5-012 2-in-1 keyboard dock uses a Synaptics S91028 touchpad which is connected to an ITE 8595 USB keyboard controller chip. This keyboard has the same quirk for its rfkill / airplane mode hotkey as other keyboards with the ITE 8595 chip, it only sends a single release event when pressed and released, it never sends a press event. This commit adds this keyboards USB id to the hid-ite id-table, fixing the rfkill key not working on this keyboard. Signed-off-by: Hans de Goede Signed-off-by: Jiri Kosina commit c62f7cd8ed066a93a243643ebf57ca99f754388e Author: Priit Laes Date: Sun Dec 1 00:22:09 2019 +0200 HID: Add quirk for Xin-Mo Dual Controller Without the quirk, joystick shows up as single controller for both first and second player pads/pins. Signed-off-by: Priit Laes Signed-off-by: Jiri Kosina commit e548f749b096133d6da3dd7235ecfc6bd67be306 Author: Dan Carpenter Date: Tue Nov 26 15:09:39 2019 +0300 mac80211: airtime: Fix an off by one in ieee80211_calc_rx_airtime() This code was copied from mt76 and inherited an off by one bug from there. The > should be >= so that we don't read one element beyond the end of the array. Fixes: db3e1c40cf2f ("mac80211: Import airtime calculation code from mt76") Reported-by: Toke Høiland-Jørgensen Signed-off-by: Dan Carpenter Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20191126120910.ftr4t7me3by32aiz@kili.mountain Signed-off-by: Johannes Berg commit 56cb31e185adb61f930743a9b70e700a43625386 Author: Stefan Bühler Date: Tue Nov 26 11:05:44 2019 +0100 cfg80211: fix double-free after changing network namespace If wdev->wext.keys was initialized it didn't get reset to NULL on unregister (and it doesn't get set in cfg80211_init_wdev either), but wdev is reused if unregister was triggered through cfg80211_switch_netns. The next unregister (for whatever reason) will try to free wdev->wext.keys again. Signed-off-by: Stefan Bühler Link: https://lore.kernel.org/r/20191126100543.782023-1-stefan.buehler@tik.uni-stuttgart.de Signed-off-by: Johannes Berg commit 753ffad3d6243303994227854d951ff5c70fa9e0 Author: Fredrik Olofsson Date: Tue Nov 19 14:34:51 2019 +0100 mac80211: fix TID field in monitor mode transmit Fix overwriting of the qos_ctrl.tid field for encrypted frames injected on a monitor interface. While qos_ctrl.tid is not encrypted, it's used as an input into the encryption algorithm so it's protected, and thus cannot be modified after encryption. For injected frames, the encryption may already have been done in userspace, so we cannot change any fields. Before passing the frame to the driver, the qos_ctrl.tid field is updated from skb->priority. Prior to dbd50a851c50 skb->priority was updated in ieee80211_select_queue_80211(), but this function is no longer always called. Update skb->priority in ieee80211_monitor_start_xmit() so that the value is stored, and when later code 'modifies' the TID it really sets it to the same value as before, preserving the encryption. Fixes: dbd50a851c50 ("mac80211: only allocate one queue when using iTXQs") Signed-off-by: Fredrik Olofsson Link: https://lore.kernel.org/r/20191119133451.14711-1-fredrik.olofsson@anyfinetworks.com [rewrite commit message based on our discussion] Signed-off-by: Johannes Berg commit c673ec61ade89bf2f417960f986bc25671762efb Author: Juergen Gross Date: Thu Dec 12 15:17:50 2019 +0100 xen/balloon: fix ballooned page accounting without hotplug enabled When CONFIG_XEN_BALLOON_MEMORY_HOTPLUG is not defined reserve_additional_memory() will set balloon_stats.target_pages to a wrong value in case there are still some ballooned pages allocated via alloc_xenballooned_pages(). This will result in balloon_process() no longer be triggered when ballooned pages are freed in batches. Reported-by: Nicholas Tsirakis Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit fa2ac657f9783f0891b2935490afe9a7fd29d3fa Author: Paul Durrant Date: Tue Dec 10 14:53:05 2019 +0000 xen-blkback: prevent premature module unload Objects allocated by xen_blkif_alloc come from the 'blkif_cache' kmem cache. This cache is destoyed when xen-blkif is unloaded so it is necessary to wait for the deferred free routine used for such objects to complete. This necessity was missed in commit 14855954f636 "xen-blkback: allow module to be cleanly unloaded". This patch fixes the problem by taking/releasing extra module references in xen_blkif_alloc/free() respectively. Signed-off-by: Paul Durrant Reviewed-by: Roger Pau Monné Signed-off-by: Juergen Gross commit d9191319358da13ee6a332fb9bf745f2181a612a Author: Pavel Shilovsky Date: Tue Dec 10 11:44:52 2019 -0800 CIFS: Close cached root handle only if it has a lease SMB2_tdis() checks if a root handle is valid in order to decide whether it needs to close the handle or not. However if another thread has reference for the handle, it may end up with putting the reference twice. The extra reference that we want to put during the tree disconnect is the reference that has a directory lease. So, track the fact that we have a directory lease and close the handle only in that case. Signed-off-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit e0fc5b1153b81571d6ff80902a54c3eb13319b33 Author: Steve French Date: Mon Dec 9 22:34:10 2019 -0600 SMB3: Fix crash in SMB2_open_init due to uninitialized field in compounding path Ran into an intermittent crash in SMB2_open_init+0x2f6/0x970 due to oparms.cifs_sb not being initialized when called from: smb2_compound_op+0x45d/0x1690 Zero the whole oparms struct in the compounding path before setting up the oparms so we don't risk any uninitialized fields. Fixes: fdef665ba44a ("smb3: fix mode passed in on create for modetosid mount option") Signed-off-by: Steve French Acked-by: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky commit d16f0f61400074dbc75797ca5ef5c3d50f6c0ddf Merge: 82e50ec8868d f271fe185613 Author: Dave Airlie Date: Fri Dec 13 14:50:01 2019 +1000 Merge tag 'drm-fixes-5.5-2019-12-12' of git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.5-2019-12-12: amdgpu: - DC fixes for renoir - Gfx8 fence flush align with mesa - Power profile fix for arcturus - Freesync fix - DC I2c over aux fix - DC aux defer fix - GPU reset fix - GPUVM invalidation semaphore fixes for PCO and SR-IOV - Golden settings updates for gfx10 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20191212223211.8034-1-alexander.deucher@amd.com commit 82e50ec8868db4afe2243f4391c3eca6e8593e2e Merge: 7315c0edb416 750bde2fd4ff Author: Dave Airlie Date: Fri Dec 13 14:44:08 2019 +1000 Merge tag 'drm-intel-fixes-2019-12-12' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix user reported issue #673: GPU hang on transition to idle - Avoid corruption on the top of the screen on GLK+ by disabling FBC - Fix non-privileged access to OA on Tigerlake - Fix HDCP code not to touch global state when just computing commit - Fix CI splat by saving irqstate around virtual_context_destroy - Serialise context retirement possibly on another CPU Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20191212100759.GA22260@jlahtine-desk.ger.corp.intel.com commit 7315c0edb416b9bbfaa51277bd1b3ad35661222a Merge: cdf1d28ced9d 0a5239985a3b Author: Dave Airlie Date: Fri Dec 13 14:32:30 2019 +1000 Merge tag 'drm-misc-next-fixes-2019-12-12' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes -mgag200: more startadd mitigation (Thomas) -panfrost: devfreq fix + several memory fixes (Steven, Boris) Cc: Boris Brezillon Cc: Steven Price Cc: Thomas Zimmermann Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20191212140145.GA145200@art_vandelay commit 9f674c811740b5db4b34668b72d47f6e7b879b0a Author: Tina Zhang Date: Fri Dec 13 11:23:14 2019 +0800 drm/i915/gvt: Pin vgpu dma address before using Dma-buf display uses the vgpu dma address saved in the guest part GGTT table which is updated by vCPU thread. In host side, when the dma address is used by qemu ui thread, gvt-g must make sure the dma address is validated before letting it go to the HW. Invalid guest dma address will easily cause DMA fault and make GPU hang. v2: Rebase Fixes: e546e281d33d ("drm/i915/gvt: Dmabuf support for GVT-g") Acked-by: Zhenyu Wang Signed-off-by: Tina Zhang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20191212141342.3417-1-tina.zhang@intel.com commit 4fc0a3ca721da2bfbab0fdf248bd76d7e6bc232f Author: Zhenyu Wang Date: Thu Dec 12 16:46:14 2019 +0800 drm/i915/gvt: set guest display buffer as readonly We shouldn't allow write for exposed guest display buffer which doesn't make sense. So explicitly set read only flag for display dmabuf allocated object. Fixes: e546e281d33d ("drm/i915/gvt: Dmabuf support for GVT-g") Cc: Tina Zhang Acked-by: Tina Zhang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20191212084614.1100-1-zhenyuw@linux.intel.com commit d3ab06f432891bfcb9e28a9d183e7f7c50f8d951 Merge: 66d9506440bb c3a5fd15ed0c Author: Stephen Boyd Date: Thu Dec 12 19:00:01 2019 -0800 Merge tag 'imx-clk-fixes-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into clk-fixes Pull i.MX clk fixes from Shawn Guo: - Add missing lock to divider in the composite driver for exclusive register access - Add missing sentinel for ulp_div_table in clk-imx7ulp driver - Fix clk_pll14xx_wait_lock() function which calls into readl_poll_timeout() with incorrect parameter * tag 'imx-clk-fixes-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: clk: imx: pll14xx: fix clk_pll14xx_wait_lock clk: imx: clk-imx7ulp: Add missing sentinel of ulp_div_table clk: imx: clk-composite-8m: add lock to gate/mux commit 66d9506440bb05289eb4867059e7b8c6ed209717 Author: Jerome Brunet Date: Tue Dec 3 09:08:05 2019 +0100 clk: walk orphan list on clock provider registration So far, we walked the orphan list every time a new clock was registered in CCF. This was fine since the clocks were only referenced by name. Now that the clock can be referenced through DT, it is not enough: * Controller A register first a reference clocks from controller B through DT. * Controller B register all its clocks then register the provider. Each time controller B registers a new clock, the orphan list is walked but it can't match since the provider is registered yet. When the provider is finally registered, the orphan list is not walked unless another clock is registered afterward. This can lead to situation where some clocks remain orphaned even if the parent is available. Walking the orphan list on provider registration solves the problem. Reported-by: Jian Hu Fixes: fc0c209c147f ("clk: Allow parents to be specified without string names") Signed-off-by: Jerome Brunet Link: https://lkml.kernel.org/r/20191203080805.104628-1-jbrunet@baylibre.com Signed-off-by: Stephen Boyd commit ee9b280e17dce51c44e1d04d11eb0a4acd0ee1a9 Author: Saravana Kannan Date: Mon Dec 9 11:31:19 2019 -0800 of/platform: Unconditionally pause/resume sync state during kernel init Commit 5e6669387e22 ("of/platform: Pause/resume sync state during init and of_platform_populate()") paused/resumed sync state during init only if Linux had parsed and populated a devicetree. However, the check for that (of_have_populated_dt()) can change after of_platform_default_populate_init() executes. One example of this is when devicetree unittests are enabled. This causes an unmatched pause/resume of sync state. To avoid this, just unconditionally pause/resume sync state during init. Fixes: 5e6669387e22 ("of/platform: Pause/resume sync state during init and of_platform_populate()") Reported-by: kernel test robot Signed-off-by: Saravana Kannan Reviewed-by: Frank Rowand Signed-off-by: Rob Herring commit 70c812106c87981a087fafacab004aee37193405 Author: Rob Herring Date: Wed Dec 11 08:51:01 2019 -0600 dt-bindings: memory-controllers: tegra: Fix type references Json-schema requires a $ref to be under an 'allOf' if there are additional constraints otherwise the additional constraints are ignored. (Note that this behavior will be changed in draft8.) Fixes: 641262f5e1ed ("dt-bindings: memory: Add binding for NVIDIA Tegra30 External Memory Controller") Fixes: 785685b7a106 ("dt-bindings: memory: Add binding for NVIDIA Tegra30 Memory Controller") Fixes: 8da65c377b21 ("dt-bindings: memory: tegra30: Convert to Tegra124 YAML") Cc: Thierry Reding Cc: Jonathan Hunter Cc: linux-tegra@vger.kernel.org Reviewed-by: Dmitry Osipenko Signed-off-by: Rob Herring commit 5c7404bb30bc5877e578336c58998a999c410622 Author: Maxime Ripard Date: Mon Dec 9 10:32:48 2019 +0100 dt-bindings: Change maintainer address While my email address has changed for a while, all the schemas I contributed still have the old one unfortunately. Update it. Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit dc2316eba73ff03da6dde082a372c6b5209304c5 Author: Yishai Hadas Date: Thu Dec 12 12:02:37 2019 +0200 IB/mlx5: Fix device memory flows Fix device memory flows so that only once there will be no live mmaped VA to a given allocation the matching object will be destroyed. This prevents a potential scenario that existing VA that was mmaped by one process might still be used post its deallocation despite that it's owned now by other process. The above is achieved by integrating with IB core APIs to manage mmap/munmap. Only once the refcount will become 0 the DM object and its underlay area will be freed. Fixes: 3b113a1ec3d4 ("IB/mlx5: Support device memory type attribute") Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20191212100237.330654-3-leon@kernel.org Signed-off-by: Doug Ledford commit 7a763d18ff2a75cfd1014800327f4120840bef09 Author: Yishai Hadas Date: Thu Dec 12 12:02:36 2019 +0200 IB/core: Introduce rdma_user_mmap_entry_insert_range() API Introduce rdma_user_mmap_entry_insert_range() API to be used once the required key for the given entry should be in a given range. Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20191212100237.330654-2-leon@kernel.org Signed-off-by: Doug Ledford commit bea37414453eb08d4ceffeb60a9d490dbc930cea Author: Eric Biggers Date: Wed Oct 9 16:03:49 2019 -0700 KEYS: asymmetric: return ENOMEM if akcipher_request_alloc() fails No error code was being set on this error path. Cc: stable@vger.kernel.org Fixes: ad4b1eb5fb33 ("KEYS: asym_tpm: Implement encryption operation [ver #2]") Fixes: c08fed737126 ("KEYS: Implement encrypt, decrypt and sign for software asymmetric key [ver #2]") Reviewed-by: James Morris Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 601f0093f2647db67be40b62e13cd0660990a7c8 Author: Eric Biggers Date: Wed Oct 9 16:04:43 2019 -0700 KEYS: remove CONFIG_KEYS_COMPAT KEYS_COMPAT now always takes the value of COMPAT && KEYS. But the security/keys/ directory is only compiled if KEYS is enabled, so in practice KEYS_COMPAT is the same as COMPAT. Therefore, remove the unnecessary KEYS_COMPAT and just use COMPAT directly. (Also remove an outdated comment from compat.c.) Reviewed-by: James Morris Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Tested-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit ca01e7987463e8675f223c366e262e82f633481a Author: Enric Balletbo i Serra Date: Wed Dec 11 10:34:50 2019 +0100 PCI: rockchip: Fix IO outbound ATU register number Since 62240a88004b ("PCI: rockchip: Drop storing driver private outbound resource data), the offset calculation is wrong to access the register number to program the IO outbound ATU. Fix this by computing the ATU IO register number based on the number of MEM registers, not the size of the IO region. This causes 'synchronous external aborts' like the following: mwifiex_pcie 0000:01:00.0: enabling device (0000 -> 0002) mwifiex_pcie: PCI memory map Virt0: 00000000a573ad00 PCI memory map Virt2: 00000000783126c4 Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP Modules linked in: mwifiex_pcie(+) mwifiex uvcvideo cfg80211 atmel_mxt_ts videobuf2_vmalloc ... CPU: 2 PID: 269 Comm: systemd-udevd Not tainted 5.4.0+ #327 Hardware name: Google Kevin (DT) pstate: 60000005 (nZCv daif -PAN -UAO) pc : mwifiex_register_dev+0x264/0x3f8 [mwifiex_pcie] lr : mwifiex_register_dev+0x150/0x3f8 [mwifiex_pcie] sp : ffff800012073860 x29: ffff800012073860 x28: ffff8000100a2e28 x27: ffff8000118b6210 x26: ffff800008f57458 x25: ffff0000ecfda000 x24: 0000000000000001 x23: ffff0000e9905080 x22: ffff800008f5d000 x21: ffff0000eecea078 x20: ffff0000e9905080 x19: ffff0000eecea000 x18: 0000000000000001 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff x14: ffff8000118998c8 x13: ffff000000000000 x12: 0000000000000008 x11: 0101010101010101 x10: ffff7f7fffff7fff x9 : 0000000000000000 x8 : ffff0000e3c24240 x7 : 0000000000000000 x6 : ffff0000e3c24148 x5 : ffff0000e3c24148 x4 : ffff0000e7975ec8 x3 : 0000000000000001 x2 : 0000000000002b42 x1 : ffff800012c00008 x0 : ffff0000e9905080 Call trace: mwifiex_register_dev+0x264/0x3f8 [mwifiex_pcie] mwifiex_add_card+0x2f8/0x430 [mwifiex] mwifiex_pcie_probe+0x98/0x148 [mwifiex_pcie] pci_device_probe+0x110/0x1a8 ... Code: a8c67bfd d65f03c0 f942ac01 91002021 (b9400021) Suggested-by: Lorenzo Pieralisi Fixes: 62240a88004b ("PCI: rockchip: Drop storing driver private outbound resource data) Link: https://lore.kernel.org/r/20191211093450.7481-1-enric.balletbo@collabora.com Reported-by: Enric Balletbo i Serra Reported-by: Vicente Bergas Tested-by: Vicente Bergas Signed-off-by: Enric Balletbo i Serra Signed-off-by: Bjorn Helgaas Acked-by: Andrew Murray commit f271fe1856138d402e0438f994ccae95f9044b2c Author: changzhu Date: Tue Dec 10 22:50:16 2019 +0800 drm/amdgpu: add invalidate semaphore limit for SRIOV in gmc10 It may fail to load guest driver in round 2 when using invalidate semaphore for SRIOV. So it needs to avoid using invalidate semaphore for SRIOV. Signed-off-by: changzhu Reviewed-by: Christian König Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit 90f6452ca58d436de4f69b423ecd75a109aa9766 Author: changzhu Date: Tue Dec 10 22:00:59 2019 +0800 drm/amdgpu: add invalidate semaphore limit for SRIOV and picasso in gmc9 It may fail to load guest driver in round 2 or cause Xstart problem when using invalidate semaphore for SRIOV or picasso. So it needs avoid using invalidate semaphore for SRIOV and picasso. Signed-off-by: changzhu Reviewed-by: Christian König Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit ed9085fed9d95d5921582e3c8474f3736c5d2782 Author: Maor Gottlieb Date: Thu Dec 12 11:12:14 2019 +0200 IB/mlx5: Fix steering rule of drop and count There are two flow rule destinations: QP and packet. While users are setting DROP packet rule, the QP should not be set as a destination. Fixes: 3b3233fbf02e ("IB/mlx5: Add flow counters binding support") Signed-off-by: Maor Gottlieb Reviewed-by: Raed Salem Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20191212091214.315005-4-leon@kernel.org Signed-off-by: Doug Ledford commit 89f988d93c62384758b19323c886db917a80c371 Author: Parav Pandit Date: Thu Dec 12 11:12:13 2019 +0200 IB/mlx4: Follow mirror sequence of device add during device removal Current code device add sequence is: ib_register_device() ib_mad_init() init_sriov_init() register_netdev_notifier() Therefore, the remove sequence should be, unregister_netdev_notifier() close_sriov() mad_cleanup() ib_unregister_device() However it is not above. Hence, make do above remove sequence. Fixes: fa417f7b520ee ("IB/mlx4: Add support for IBoE") Signed-off-by: Parav Pandit Reviewed-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20191212091214.315005-3-leon@kernel.org Signed-off-by: Doug Ledford commit 33df2f1929df4a1cb13303e344fbf8a75f0dc41f Author: Mark Zhang Date: Thu Dec 12 11:12:12 2019 +0200 RDMA/counter: Prevent auto-binding a QP which are not tracked with res Some QPs (e.g. XRC QP) are not tracked in kernel, in this case they have an invalid res and should not be bound to any dynamically-allocated counter in auto mode. This fixes below call trace: BUG: kernel NULL pointer dereference, address: 0000000000000390 PGD 80000001a7233067 P4D 80000001a7233067 PUD 1a7215067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 2 PID: 24822 Comm: ibv_xsrq_pingpo Not tainted 5.4.0-rc5+ #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 RIP: 0010:rdma_counter_bind_qp_auto+0x142/0x270 [ib_core] Code: e1 48 85 c0 48 89 c2 0f 84 bc 00 00 00 49 8b 06 48 39 42 48 75 d6 40 3a aa 90 00 00 00 75 cd 49 8b 86 00 01 00 00 48 8b 4a 28 <8b> 80 90 03 00 00 39 81 90 03 00 00 75 b4 85 c0 74 b0 48 8b 04 24 RSP: 0018:ffffc900003f39c0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff88820020ec00 RSI: 0000000000000004 RDI: ffffffffffffffc0 RBP: 0000000000000001 R08: ffff888224149ff0 R09: ffffc900003f3968 R10: ffffffffffffffff R11: ffff8882249c5848 R12: ffffffffffffffff R13: ffff88821d5aca50 R14: ffff8881f7690800 R15: ffff8881ff890000 FS: 00007fe53a3e1740(0000) GS:ffff888237b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000390 CR3: 00000001a7292006 CR4: 00000000003606a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: _ib_modify_qp+0x3a4/0x3f0 [ib_core] ? lookup_get_idr_uobject.part.8+0x23/0x40 [ib_uverbs] modify_qp+0x322/0x3e0 [ib_uverbs] ib_uverbs_modify_qp+0x43/0x70 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xb1/0xf0 [ib_uverbs] ib_uverbs_run_method+0x6be/0x760 [ib_uverbs] ? uverbs_disassociate_api+0xd0/0xd0 [ib_uverbs] ib_uverbs_cmd_verbs+0x18d/0x3a0 [ib_uverbs] ? get_acl+0x1a/0x120 ? __alloc_pages_nodemask+0x15d/0x2c0 ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs] do_vfs_ioctl+0xa5/0x610 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x48/0x110 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 99fa331dc862 ("RDMA/counter: Add "auto" configuration mode support") Signed-off-by: Mark Zhang Reviewed-by: Maor Gottlieb Reviewed-by: Ido Kalir Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20191212091214.315005-2-leon@kernel.org Signed-off-by: Doug Ledford commit 0af67e49b018e7280a4227bfe7b6005bc9d3e442 Author: Manish Chopra Date: Thu Dec 12 06:49:28 2019 -0800 qede: Fix multicast mac configuration Driver doesn't accommodate the configuration for max number of multicast mac addresses, in such particular case it leaves the device with improper/invalid multicast configuration state, causing connectivity issues (in lacp bonding like scenarios). Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 20032b63586ac6c28c936dff696981159913a13f Author: Cristian Birsan Date: Thu Dec 12 13:52:47 2019 +0200 net: usb: lan78xx: Fix suspend/resume PHY register access error Lan78xx driver accesses the PHY registers through MDIO bus over USB connection. When performing a suspend/resume, the PHY registers can be accessed before the USB connection is resumed. This will generate an error and will prevent the device to resume correctly. This patch adds the dependency between the MDIO bus and USB device to allow correct handling of suspend/resume. Fixes: ce85e13ad6ef ("lan78xx: Update to use phylib instead of mii_if_info.") Signed-off-by: Cristian Birsan Signed-off-by: David S. Miller commit 37d4e84f765bb3038ddfeebdc5d1cfd7e1ef688f Merge: ae4b064e2a61 da08e1e1d7c3 Author: Linus Torvalds Date: Thu Dec 12 10:56:37 2019 -0800 Merge tag 'ceph-for-5.5-rc2' of git://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A fix to avoid a corner case when scheduling cap reclaim in batches from Xiubo, a patch to add some observability into cap waiters from Jeff and a couple of cleanups" * tag 'ceph-for-5.5-rc2' of git://github.com/ceph/ceph-client: ceph: add more debug info when decoding mdsmap ceph: switch to global cap helper ceph: trigger the reclaim work once there has enough pending caps ceph: show tasks waiting on caps in debugfs caps file ceph: convert int fields in ceph_mount_options to unsigned int commit 8243186f0cc7c57cf9d6a110cd7315c44e3e0be8 Author: Dominik Brodowski Date: Tue Oct 23 16:24:09 2018 +0200 fs: remove ksys_dup() ksys_dup() is used only at one place in the kernel, namely to duplicate fd 0 of /dev/console to stdout and stderr. The same functionality can be achieved by using functions already available within the kernel namespace. Signed-off-by: Dominik Brodowski commit b49a733d684e0096340b93e9dfd471f0e3ddc06d Author: Dominik Brodowski Date: Tue Oct 23 16:00:10 2018 +0200 init: unify opening /dev/console as stdin/stdout/stderr Merge the two instances where /dev/console is opened as stdin/stdout/stderr. Signed-off-by: Dominik Brodowski commit 89f33b984a51364465b32f8239eeb1daf62a6c03 Merge: 9103bb419aef 7947e3238b64 Author: Olof Johansson Date: Thu Dec 12 09:38:22 2019 -0800 Merge tag 'imx-fixes-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.5: - Add missing jedec,spi-nor compatible for imx6ul-14x14-evk board, so that SPI NOR device can be probed. - Fix power button of E60K02 board by removing LDORTC2 regulator. - A couple of fixes on serial number support of i.MX6ULL/ULZ SoCs to remove the boot regression caused by 8267ff89b713 ("ARM: imx: Add serial number support for i.MX6/7 SoCs"). - A couple of fixes on LS1028A SoC TMU regarding to calibration data and reboot register configuration. - Fix a regression seen on imx6ul-evk board by marking always-on for the regulator that is shared by many peripherals. - Explicitly restore CONFIG_DEBUG_FS in imx_v6_v7_defconfig. * tag 'imx-fixes-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: imx: Fix boot crash if ocotp is not found ARM: imx_v6_v7_defconfig: Explicitly restore CONFIG_DEBUG_FS ARM: dts: imx6ul-evk: Fix peripheral regulator arm64: dts: ls1028a: fix reboot node arm64: dts: ls1028a: fix typo in TMU calibration data ARM: imx: Correct ocotp id for serial number support of i.MX6ULL/ULZ SoCs ARM: dts: e60k02: fix power button ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing Link: https://lore.kernel.org/r/20191212122427.GK15858@dragon Signed-off-by: Olof Johansson commit 85572c2c4a45a541e880e087b5b17a48198b2416 Author: Rafael J. Wysocki Date: Wed Dec 11 11:28:41 2019 +0100 cpufreq: Avoid leaving stale IRQ work items during CPU offline The scheduler code calling cpufreq_update_util() may run during CPU offline on the target CPU after the IRQ work lists have been flushed for it, so the target CPU should be prevented from running code that may queue up an IRQ work item on it at that point. Unfortunately, that may not be the case if dvfs_possible_from_any_cpu is set for at least one cpufreq policy in the system, because that allows the CPU going offline to run the utilization update callback of the cpufreq governor on behalf of another (online) CPU in some cases. If that happens, the cpufreq governor callback may queue up an IRQ work on the CPU running it, which is going offline, and the IRQ work may not be flushed after that point. Moreover, that IRQ work cannot be flushed until the "offlining" CPU goes back online, so if any other CPU calls irq_work_sync() to wait for the completion of that IRQ work, it will have to wait until the "offlining" CPU is back online and that may not happen forever. In particular, a system-wide deadlock may occur during CPU online as a result of that. The failing scenario is as follows. CPU0 is the boot CPU, so it creates a cpufreq policy and becomes the "leader" of it (policy->cpu). It cannot go offline, because it is the boot CPU. Next, other CPUs join the cpufreq policy as they go online and they leave it when they go offline. The last CPU to go offline, say CPU3, may queue up an IRQ work while running the governor callback on behalf of CPU0 after leaving the cpufreq policy because of the dvfs_possible_from_any_cpu effect described above. Then, CPU0 is the only online CPU in the system and the stale IRQ work is still queued on CPU3. When, say, CPU1 goes back online, it will run irq_work_sync() to wait for that IRQ work to complete and so it will wait for CPU3 to go back online (which may never happen even in principle), but (worse yet) CPU0 is waiting for CPU1 at that point too and a system-wide deadlock occurs. To address this problem notice that CPUs which cannot run cpufreq utilization update code for themselves (for example, because they have left the cpufreq policies that they belonged to), should also be prevented from running that code on behalf of the other CPUs that belong to a cpufreq policy with dvfs_possible_from_any_cpu set and so in that case the cpufreq_update_util_data pointer of the CPU running the code must not be NULL as well as for the CPU which is the target of the cpufreq utilization update in progress. Accordingly, change cpufreq_this_cpu_can_update() into a regular function in kernel/sched/cpufreq.c (instead of a static inline in a header file) and make it check the cpufreq_update_util_data pointer of the local CPU if dvfs_possible_from_any_cpu is set for the target cpufreq policy. Also update the schedutil governor to do the cpufreq_this_cpu_can_update() check in the non-fast-switch case too to avoid the stale IRQ work issues. Fixes: 99d14d0e16fa ("cpufreq: Process remote callbacks from any CPU if the platform permits") Link: https://lore.kernel.org/linux-pm/20191121093557.bycvdo4xyinbc5cb@vireshk-i7/ Reported-by: Anson Huang Tested-by: Anson Huang Cc: 4.14+ # 4.14+ Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar Tested-by: Peng Fan (i.MX8QXP-MEK) Signed-off-by: Rafael J. Wysocki commit d4d8140176972fdb3f00bffc88e63af781de8d67 Author: Rafael J. Wysocki Date: Wed Dec 11 11:30:50 2019 +0100 cpuidle: Drop unnecessary type cast in cpuidle_poll_time() The data type of the target_residency_ns field in struct cpuidle_state is u64, so it does not need to be cast into u64. Get rid of the unnecessary type cast. Signed-off-by: Rafael J. Wysocki Acked-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 5addeae1bedc4c126b179f61e43e039bb373581f Author: Guoqing Jiang Date: Thu Dec 12 16:52:00 2019 +0100 blk-cgroup: remove blkcg_drain_queue Since blk_drain_queue had already been removed, so this function is not needed anymore. Signed-off-by: Guoqing Jiang Signed-off-by: Jens Axboe commit 6d674e28f642e3ff676fbae2d8d1b872814d32b6 Author: Marc Zyngier Date: Wed Dec 11 16:56:48 2019 +0000 KVM: arm/arm64: Properly handle faulting of device mappings A device mapping is normally always mapped at Stage-2, since there is very little gain in having it faulted in. Nonetheless, it is possible to end-up in a situation where the device mapping has been removed from Stage-2 (userspace munmaped the VFIO region, and the MMU notifier did its job), but present in a userspace mapping (userpace has mapped it back at the same address). In such a situation, the device mapping will be demand-paged as the guest performs memory accesses. This requires to be careful when dealing with mapping size, cache management, and to handle potential execution of a device mapping. Reported-by: Alexandru Elisei Signed-off-by: Marc Zyngier Tested-by: Alexandru Elisei Reviewed-by: James Morse Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191211165651.7889-2-maz@kernel.org commit e709ed70d122e94cb426b1e1f905829eae19a009 Author: Tony Lindgren Date: Thu Dec 12 08:20:10 2019 -0800 bus: ti-sysc: Fix missing reset delay handling We have dts property for "ti,sysc-delay-us", and we're using it, but the wait after OCP softreset only happens if devices are probed in legacy mode. Let's add a delay after writing the OCP softreset when specified. Fixes: e0db94fe87da ("bus: ti-sysc: Make OCP reset work for sysstatus and sysconfig reset bits") Cc: Keerthy Signed-off-by: Tony Lindgren commit eb45f2110b036e4e35d3f3aaee1c2ccf49d92425 Author: Andrew Jeffery Date: Mon Dec 2 15:31:10 2019 +1030 pinctrl: aspeed-g6: Fix LPC/eSPI mux configuration Early revisions of the AST2600 datasheet are conflicted about the state of the LPC/eSPI strapping bit (SCU510[6]). Conversations with ASPEED determined that the reference pinmux configuration tables were in error and the SCU documentation contained the correct configuration. Update the driver to reflect the state described in the SCU documentation. Fixes: 2eda1cdec49f ("pinctrl: aspeed: Add AST2600 pinmux support") Signed-off-by: Andrew Jeffery Link: https://lore.kernel.org/r/20191202050110.15340-1-andrew@aj.id.au Signed-off-by: Linus Walleij commit ecb6186cf78803663cbd7c70241bfe1af439ca03 Author: Logan Gunthorpe Date: Tue Dec 10 11:47:04 2019 -0700 block: fix NULL pointer dereference in account statistics with IDE The IDE driver creates some passthru requests which never get submitted to the block layer in such a way that blk_account_io_start() gets called. However, the driver still calls __blk_mq_end_request() in ide_end_rq() which will call blk_account_io_completion() which tries to dereferences req->part which is never set. See ide_prep_sense() for an example of where these requests come from. To fix this, blk_account_io_completion() and blk_account_io_done() should do nothing if req->part is not set. The back trace of this bug is: BUG: kernel NULL pointer dereference, address: 000002ac #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page *pde = 00000000 Oops: 0002 [#1] CPU: 0 PID: 237 Comm: kworker/0:1H Not tainted 5.4.0-rc2-00011-g48d9b0d43105e #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Workqueue: kblockd drive_rq_insert_work EIP: blk_account_io_completion+0x7a/0xf0 Code: 89 54 24 08 31 d2 89 4c 24 04 31 c9 c7 04 24 02 00 00 00 c1 ee 09 e8 f5 21 a6 ff e8 70 5c a7 ff 8b 53 60 8d 04 bd 00 00 00 00 <01> b4 02 ac 02 00 00 8b 9a 88 02 00 00 85 db 74 11 85 d2 74 51 8b EAX: 00000000 EBX: f5b80000 ECX: 00000000 EDX: 00000000 ESI: 00000000 EDI: 00000000 EBP: f3031e70 ESP: f3031e54 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010046 CR0: 80050033 CR2: 000002ac CR3: 03c25000 CR4: 000406d0 Call Trace: blk_update_request+0x85/0x420 ide_end_rq+0x38/0xa0 ide_complete_rq+0x3d/0x70 cdrom_newpc_intr+0x258/0xba0 ide_intr+0x135/0x250 __handle_irq_event_percpu+0x3e/0x250 handle_irq_event_percpu+0x1f/0x50 handle_irq_event+0x32/0x60 handle_level_irq+0x6c/0x110 handle_irq+0x72/0xa0 do_IRQ+0x45/0xad common_interrupt+0x115/0x11c Fixes: 48d9b0d43105 ("block: account statistics for passthrough requests") Reported-by: kernel test robot Signed-off-by: Logan Gunthorpe Signed-off-by: Jens Axboe commit 413fc385a594ea6eb08843be33939057ddfdae76 Author: changzhu Date: Tue Dec 10 10:23:09 2019 +0800 drm/amdgpu: avoid using invalidate semaphore for picasso It may cause timeout waiting for sem acquire in VM flush when using invalidate semaphore for picasso. So it needs to avoid using invalidate semaphore for piasso. Signed-off-by: changzhu Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit a680aea00d170695d6542150a6f8841b5c2b8f1e Author: Alex Deucher Date: Wed Dec 11 11:39:35 2019 -0500 Revert "drm/amdgpu: dont schedule jobs while in reset" This reverts commit f2efc6e60089c99c342a6b7da47f1037e06c4296. This was fixed properly for 5.5, but came back via 5.4 merge into drm-next, so revert it again. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit cccaa5e33525fc07f4a2ce0518e50b9ddf435e47 Author: Dominik Brodowski Date: Tue Oct 23 22:41:09 2018 +0200 init: use do_mount() instead of ksys_mount() In prepare_namespace(), do_mount() can be used instead of ksys_mount() as the first and third argument are const strings in the kernel, the second and fourth argument are passed through anyway, and the fifth argument is NULL. In do_mount_root(), ksys_mount() is called with the first and third argument being already kernelspace strings, which do not need to be copied over from userspace to kernelspace (again). The second and fourth arguments are passed through to do_mount() anyway. The fifth argument, while already residing in kernelspace, needs to be put into a page of its own. Then, do_mount() can be used instead of ksys_mount(). Once this is done, there are no in-kernel users to ksys_mount() left, which can therefore be removed. Signed-off-by: Dominik Brodowski commit d4440aac83d12f87df9bcc51e992b9c28c7f4fa5 Author: Dominik Brodowski Date: Wed Nov 27 20:24:14 2019 +0100 initrd: use do_mount() instead of ksys_mount() All three calls to ksys_mount() in initrd-related kernel code can be switched over to do_mount(): - the first and third arguments are const strings in the kernel, and do not need to be copied over from userspace; - the fifth argument is NULL, and therefore no page needs to be, copied over from userspace; - the second and fourth argument are passed through anyway. Signed-off-by: Dominik Brodowski commit 5e787dbf659fe77d56215be74044f85e01b3920f Author: Dominik Brodowski Date: Tue Oct 23 22:10:35 2018 +0200 devtmpfs: use do_mount() instead of ksys_mount() In devtmpfs, do_mount() can be called directly instead of complex wrapping by ksys_mount(): - the first and third arguments are const strings in the kernel, and do not need to be copied over from userspace; - the fifth argument is NULL, and therefore no page needs to be copied over from userspace; - the second and fourth argument are passed through anyway. Signed-off-by: Dominik Brodowski commit abeb2e9414d7e3a0d8417bc3b13d7172513ea8a0 Author: Yonghan Ye Date: Wed Dec 4 20:00:07 2019 +0800 serial: sprd: Add clearing break interrupt operation A break interrupt will be generated if the RX line was pulled low, which means some abnomal behaviors occurred of the UART. In this case, we still need to clear this break interrupt status, otherwise it will cause irq storm to crash the whole system. Fixes: b7396a38fb28 ("tty/serial: Add Spreadtrum sc9836-uart driver support") Signed-off-by: Yonghan Ye Cc: stable Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/925e51b73099c90158e080b8f5bed9b3b38c4548.1575460601.git.baolin.wang7@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0e4f7f920a5c6bfe5e851e989f27b35a0cc7fb7e Author: Leo Yan Date: Wed Nov 27 22:15:43 2019 +0800 tty: serial: msm_serial: Fix lockup for sysrq and oops As the commit 677fe555cbfb ("serial: imx: Fix recursive locking bug") has mentioned the uart driver might cause recursive locking between normal printing and the kernel debugging facilities (e.g. sysrq and oops). In the commit it gave out suggestion for fixing recursive locking issue: "The solution is to avoid locking in the sysrq case and trylock in the oops_in_progress case." This patch follows the suggestion (also used the exactly same code with other serial drivers, e.g. amba-pl011.c) to fix the recursive locking issue, this can avoid stuck caused by deadlock and print out log for sysrq and oops. Fixes: 04896a77a97b ("msm_serial: serial driver for MSM7K onboard serial peripheral.") Signed-off-by: Leo Yan Reviewed-by: Jeffrey Hugo Link: https://lore.kernel.org/r/20191127141544.4277-2-leo.yan@linaro.org Signed-off-by: Greg Kroah-Hartman commit 3c3caae4cd6e122472efcf64759ff6392fb6bce2 Author: Heikki Krogerus Date: Thu Dec 12 12:37:13 2019 +0300 usb: dwc3: pci: add ID for the Intel Comet Lake -H variant The original ID that was added for Comet Lake PCH was actually for the -LP (low power) variant even though the constant for it said CMLH. Changing that while at it. Signed-off-by: Heikki Krogerus Acked-by: Felipe Balbi Cc: stable Link: https://lore.kernel.org/r/20191212093713.60614-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1ce74e96c2407df2b5867e5d45a70aacb8923c14 Author: Will Deacon Date: Thu Dec 12 09:40:49 2019 +0000 KVM: arm64: Ensure 'params' is initialised when looking up sys register Commit 4b927b94d5df ("KVM: arm/arm64: vgic: Introduce find_reg_by_id()") introduced 'find_reg_by_id()', which looks up a system register only if the 'id' index parameter identifies a valid system register. As part of the patch, existing callers of 'find_reg()' were ported over to the new interface, but this breaks 'index_to_sys_reg_desc()' in the case that the initial lookup in the vCPU target table fails because we will then call into 'find_reg()' for the system register table with an uninitialised 'param' as the key to the lookup. GCC 10 is bright enough to spot this (amongst a tonne of false positives, but hey!): | arch/arm64/kvm/sys_regs.c: In function ‘index_to_sys_reg_desc.part.0.isra’: | arch/arm64/kvm/sys_regs.c:983:33: warning: ‘params.Op2’ may be used uninitialized in this function [-Wmaybe-uninitialized] | 983 | (u32)(x)->CRn, (u32)(x)->CRm, (u32)(x)->Op2); | [...] Revert the hunk of 4b927b94d5df which breaks 'index_to_sys_reg_desc()' so that the old behaviour of checking the index upfront is restored. Fixes: 4b927b94d5df ("KVM: arm/arm64: vgic: Introduce find_reg_by_id()") Signed-off-by: Will Deacon Signed-off-by: Marc Zyngier Cc: Link: https://lore.kernel.org/r/20191212094049.12437-1-will@kernel.org commit 3e42fe5c73108a6e68c98bc0df937888e35af97f Author: Georgi Djakov Date: Thu Dec 12 09:53:32 2019 +0200 interconnect: qcom: msm8974: Walk the list safely on node removal As we will remove items off the list using list_del(), we need to use the safe version of list_for_each_entry(). Fixes: 4e60a9568dc6 ("interconnect: qcom: add msm8974 driver") Reported-by: Dmitry Osipenko Reviewed-by: Bjorn Andersson Signed-off-by: Georgi Djakov Link: https://lore.kernel.org/r/20191212075332.16202-5-georgi.djakov@linaro.org Signed-off-by: Greg Kroah-Hartman commit f39488ea2a75c49634c8611090f58734f61eee7c Author: Georgi Djakov Date: Thu Dec 12 09:53:31 2019 +0200 interconnect: qcom: qcs404: Walk the list safely on node removal As we will remove items off the list using list_del(), we need to use the safe version of list_for_each_entry(). Fixes: 5e4e6c4d3ae0 ("interconnect: qcom: Add QCS404 interconnect provider driver") Reported-by: Dmitry Osipenko Reviewed-by: Bjorn Andersson Signed-off-by: Georgi Djakov Cc: # v5.4 Link: https://lore.kernel.org/r/20191212075332.16202-4-georgi.djakov@linaro.org Signed-off-by: Greg Kroah-Hartman commit b29b8113bb41285eb7ed55ce0c65017b5c0240f7 Author: Georgi Djakov Date: Thu Dec 12 09:53:30 2019 +0200 interconnect: qcom: sdm845: Walk the list safely on node removal As we will remove items off the list using list_del(), we need to use the safe version of list_for_each_entry(). Fixes: b5d2f741077a ("interconnect: qcom: Add sdm845 interconnect provider driver") Reported-by: Dmitry Osipenko Reviewed-by: Bjorn Andersson Signed-off-by: Georgi Djakov Cc: # v5.3+ Link: https://lore.kernel.org/r/20191212075332.16202-3-georgi.djakov@linaro.org Signed-off-by: Greg Kroah-Hartman commit e27da6a6a4da9e5dd711e64cfd9d13ec3cc39d27 Author: Krzysztof Kozlowski Date: Thu Dec 12 09:53:29 2019 +0200 interconnect: qcom: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Georgi Djakov Link: https://lore.kernel.org/r/20191212075332.16202-2-georgi.djakov@linaro.org Signed-off-by: Greg Kroah-Hartman commit e32ea127d81c12882f39c2783d78634597ff21a2 Author: Guenter Roeck Date: Thu Dec 12 16:34:03 2019 +0800 nios2: Fix ioremap Commit 5ace77e0b41a ("nios2: remove __ioremap") removed the following code, with the argument that cacheflag is always 0 and the expression would therefore always be false. if (IS_MAPPABLE_UNCACHEABLE(phys_addr) && IS_MAPPABLE_UNCACHEABLE(last_addr) && !(cacheflag & _PAGE_CACHED)) return (void __iomem *)(CONFIG_NIOS2_IO_REGION_BASE + phys_addr); This did not take the "!" in the expression into account. Result is that nios2 images no longer boot. Restoring the removed code fixes the problem. Fixes: 5ace77e0b41a ("nios2: remove __ioremap") Cc: Christoph Hellwig Signed-off-by: Guenter Roeck Reviewed-by: Christoph Hellwig Signed-off-by: Ley Foon Tan commit 84faa307249b341f6ad8de3e1869d77a65e26669 Author: Jason A. Donenfeld Date: Wed Dec 11 10:26:39 2019 +0100 crypto: arm/curve25519 - add arch-specific key generation function Somehow this was forgotten when Zinc was being split into oddly shaped pieces, resulting in linker errors. The x86_64 glue has a specific key generation implementation, but the Arm one does not. However, it can still receive the NEON speedups by calling the ordinary DH function using the base point. Signed-off-by: Jason A. Donenfeld Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit cdf1d28ced9d7c63502afc409bad3b80198f101a Merge: 5ba047488209 3d1890ef8023 Author: Dave Airlie Date: Thu Dec 12 15:25:38 2019 +1000 Merge branch 'linux-5.5' of git://github.com/skeggsb/linux into drm-fixes Bunch of random nouveau fixes. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/ Date: Wed Dec 11 20:13:45 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2019-12-11 The following pull-request contains BPF updates for your *net* tree. We've added 8 non-merge commits during the last 1 day(s) which contain a total of 10 files changed, 126 insertions(+), 18 deletions(-). The main changes are: 1) Make BPF trampoline co-exist with ftrace-based tracers, from Alexei. 2) Fix build in minimal configurations, from Arnd. 3) Fix mips, riscv bpf_tail_call limit, from Paul. 4) Fix bpftool segfault, from Toke. 5) Fix samples/bpf, from Daniel. ==================== Signed-off-by: David S. Miller commit 296aec45a676fbaaabdadfaf2bf5812abf762600 Merge: cc90bc684223 3b7436cc9449 Author: Jens Axboe Date: Wed Dec 11 20:49:58 2019 -0700 Merge branch 'md-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/song/md into for-linus Pull MD fixes from Song. * 'md-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: make sure desc_nr less than MD_SB_DISKS md: raid1: check rdev before reference in raid1_sync_request func raid5: need to set STRIPE_HANDLE for batch head commit 5ba0474882095dd737e717507cae16ccd5dc5ee6 Merge: 781d5eb4b4a6 78baee8d3b97 Author: Dave Airlie Date: Thu Dec 12 13:11:58 2019 +1000 Merge tag 'drm-misc-fixes-2019-12-11' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes - Expand dma-buf MAINTAINER scope - Fix mode matching for drivers not using picture_aspect_ratio Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20191211212107.GA257983@art_vandelay commit 7947e3238b64c00c396e6f5738f94c4d653bc6a2 Author: Leonard Crestez Date: Tue Dec 10 23:49:28 2019 +0200 ARM: imx: Fix boot crash if ocotp is not found The imx_soc_device_init functions tries to fetch the ocotp regmap in order to soc serial number. If regmap fetch fails then a message is printed but regmap_read is called anyway and the system crashes. Failing to lookup ocotp regmap shouldn't be a fatal boot error so check that the pointer is valid. Only side-effect of ocotp lookup failure now is that serial number will be reported as all-zeros which is acceptable. Cc: stable@vger.kernel.org Fixes: 8267ff89b713 ("ARM: imx: Add serial number support for i.MX6/7 SoCs") Signed-off-by: Leonard Crestez Tested-by: Christoph Niedermaier Signed-off-by: Shawn Guo commit ae4b064e2a616b545acf02b8f50cc513b32c7522 Merge: 687dec9b9459 50559800b76a Author: Linus Torvalds Date: Wed Dec 11 18:10:40 2019 -0800 Merge tag 'afs-fixes-20191211' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS fixes from David Howells: "Fixes for AFS plus one patch to make debugging easier: - Fix how addresses are matched to server records. This is currently incorrect which means cache invalidation callbacks from the server don't necessarily get delivered correctly. This causes stale data and metadata to be seen under some circumstances. - Make the dynamic root superblock R/W so that rpm/dnf can reapply the SELinux label to it when upgrading the Fedora filesystem-afs package. If the filesystem is R/O, this fails and the upgrade fails. It might be better in future to allow setxattr from an LSM to bypass the R/O protections, if only for pseudo-filesystems. - Fix the parsing of mountpoint strings. The mountpoint object has to have a terminal dot, whereas the source/device string passed to mount should not. This confuses type-forcing suffix detection leading to the wrong volume variant being mounted. - Make lookups in the dynamic root superblock for creation events (such as mkdir) fail with EOPNOTSUPP rather than something like EEXIST. The dynamic root only allows implicit creation by the ->lookup() method - and only if the target cell exists. - Fix the looking up of an AFS superblock to include the cell in the matching key - otherwise all volumes with the same ID number are treated as the same thing, irrespective of which cell they're in. - Show the volume name of each volume in the volume records displayed in /proc/net/afs//volumes. This proved useful in debugging as it provides a way to map the volume IDs to names, where the names are what appear in /proc/mounts" * tag 'afs-fixes-20191211' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Show volume name in /proc/net/afs//volumes afs: Fix missing cell comparison in afs_test_super() afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP afs: Fix mountpoint parsing afs: Fix SELinux setting security label on /afs afs: Fix afs_find_server lookups for ipv4 peers commit 46db63abb79524209c15c683feccfba116746757 Author: Leonard Crestez Date: Tue Dec 10 19:34:20 2019 +0200 ARM: imx_v6_v7_defconfig: Explicitly restore CONFIG_DEBUG_FS This is currently off and that's not desirable: default imx config is meant to be generally useful for development and debugging. Running git bisect between v5.4 and v5.5-rc1 finds this started from commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") Explicit CONFIG_DEBUG_FS=y was earlier removed by commit c29d541f590c ("ARM: imx_v6_v7_defconfig: Remove unneeded options") A very similar fix was required before: commit 7e9eb6268809 ("ARM: imx_v6_v7_defconfig: Explicitly restore CONFIG_DEBUG_FS") Signed-off-by: Leonard Crestez Signed-off-by: Shawn Guo commit 62cfe242db8c60551f36214ebb8858ce0a543841 Author: Leonard Crestez Date: Wed Dec 11 17:02:47 2019 +0200 ARM: dts: imx6ul-evk: Fix peripheral regulator Many peripherals are affected by gpio5/2, not just sensors. One of those is ethernet phy so network boot is current broken. Fix by renaming reg_sensors and marking it as "always on". Also add a comment asking for careful testing if this is to be made dynamic in the future. The "peri_3v3" naming is similar to imx6sx-sdb and regulator-name is same string as in schematics (VPERI_3V3). Fixes: 09e2b1048954 ("ARM: dts: imx6ul-14x14-evk: Add sensors' GPIO regulator") Signed-off-by: Leonard Crestez Reviewed-by: Marco Felsch Signed-off-by: Shawn Guo commit 3f0fb37b22b460e3dec62bee284932881574acb9 Author: Michael Walle Date: Wed Dec 11 18:11:45 2019 +0100 arm64: dts: ls1028a: fix reboot node The reboot register isn't located inside the DCFG controller, but in its own RST controller. Fix it. Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC") Signed-off-by: Michael Walle Acked-by: Li Yang Signed-off-by: Shawn Guo commit c1468554776229d0db69e74a9aaf6f7e7095fd51 Author: Dan Williams Date: Wed Nov 13 16:22:06 2019 -0800 tools/testing/nvdimm: Fix mock support for ioremap After commit d092a8707326 "arch: rely on asm-generic/io.h for default ioremap_* definitions" the ioremap_nocache() symbol has been replaced with ioremap(). Update the mocked symbol list for nvdimm testing. Link: https://lore.kernel.org/r/157369090817.2974548.10148423996292973088.stgit@dwillia2-desk3.amr.corp.intel.com Fixes: d092a8707326 ("arch: rely on asm-generic/io.h for default ioremap_* definitions") Signed-off-by: Dan Williams commit fe3300897cbfd76c6cb825776e5ac0ca50a91ca4 Author: Daniel T. Lee Date: Thu Dec 5 17:01:14 2019 +0900 samples: bpf: fix syscall_tp due to unused syscall Currently, open() is called from the user program and it calls the syscall 'sys_openat', not the 'sys_open'. This leads to an error of the program of user side, due to the fact that the counter maps are zero since no function such 'sys_open' is called. This commit adds the kernel bpf program which are attached to the tracepoint 'sys_enter_openat' and 'sys_enter_openat'. Fixes: 1da236b6be963 ("bpf: add a test case for syscalls/sys_{enter|exit}_* tracepoints") Signed-off-by: Daniel T. Lee Signed-off-by: Alexei Starovoitov commit bba1b2a890253528c45aa66cf856f289a215bfbc Author: Daniel T. Lee Date: Thu Dec 5 17:01:13 2019 +0900 samples: bpf: Replace symbol compare of trace_event Previously, when this sample is added, commit 1c47910ef8013 ("samples/bpf: add perf_event+bpf example"), a symbol 'sys_read' and 'sys_write' has been used without no prefixes. But currently there are no exact symbols with these under kallsyms and this leads to failure. This commit changes exact compare to substring compare to keep compatible with exact symbol or prefixed symbol. Fixes: 1c47910ef8013 ("samples/bpf: add perf_event+bpf example") Signed-off-by: Daniel T. Lee Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191205080114.19766-2-danieltimlee@gmail.com commit 7f193c2519a3dcfd61cd5e676b2959370f4b15be Author: Alexei Starovoitov Date: Sun Dec 8 16:01:14 2019 -0800 selftests/bpf: Test function_graph tracer and bpf trampoline together Add simple test script to execute funciton graph tracer while BPF trampoline attaches and detaches from the functions being graph traced. Signed-off-by: Alexei Starovoitov Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191209000114.1876138-4-ast@kernel.org commit b91e014f078e2e4f24778680e28dbbdecc7f0eb9 Author: Alexei Starovoitov Date: Sun Dec 8 16:01:13 2019 -0800 bpf: Make BPF trampoline use register_ftrace_direct() API Make BPF trampoline attach its generated assembly code to kernel functions via register_ftrace_direct() API. It helps ftrace-based tracers co-exist with BPF trampoline on the same kernel function. It also switches attaching logic from arch specific text_poke to generic ftrace that is available on many architectures. text_poke is still necessary for bpf-to-bpf attach and for bpf_tail_call optimization. Signed-off-by: Alexei Starovoitov Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191209000114.1876138-3-ast@kernel.org commit 9e3aa61ae3e01ce1ce6361a41ef725e1f4d1d2bf Author: Jens Axboe Date: Wed Dec 11 15:55:43 2019 -0700 io_uring: ensure we return -EINVAL on unknown opcode If we submit an unknown opcode and have fd == -1, io_op_needs_file() will return true as we default to needing a file. Then when we go and assign the file, we find the 'fd' invalid and return -EBADF. We really should be returning -EINVAL for that case, as we normally do for unsupported opcodes. Change io_op_needs_file() to have the following return values: 0 - does not need a file 1 - does need a file < 0 - error value and use this to pass back the right value for this invalid case. Signed-off-by: Jens Axboe commit d0c2204135a0cdbc607c94c481cf1ccb2f659aa7 Author: Brian Foster Date: Wed Dec 11 13:18:38 2019 -0800 xfs: stabilize insert range start boundary to avoid COW writeback race generic/522 (fsx) occasionally fails with a file corruption due to an insert range operation. The primary characteristic of the corruption is a misplaced insert range operation that differs from the requested target offset. The reason for this behavior is a race between the extent shift sequence of an insert range and a COW writeback completion that causes a front merge with the first extent in the shift. The shift preparation function flushes and unmaps from the target offset of the operation to the end of the file to ensure no modifications can be made and page cache is invalidated before file data is shifted. An insert range operation then splits the extent at the target offset, if necessary, and begins to shift the start offset of each extent starting from the end of the file to the start offset. The shift sequence operates at extent level and so depends on the preparation sequence to guarantee no changes can be made to the target range during the shift. If the block immediately prior to the target offset was dirty and shared, however, it can undergo writeback and move from the COW fork to the data fork at any point during the shift. If the block is contiguous with the block at the start offset of the insert range, it can front merge and alter the start offset of the extent. Once the shift sequence reaches the target offset, it shifts based on the latest start offset and silently changes the target offset of the operation and corrupts the file. To address this problem, update the shift preparation code to stabilize the start boundary along with the full range of the insert. Also update the existing corruption check to fail if any extent is shifted with a start offset behind the target offset of the insert range. This prevents insert from racing with COW writeback completion and fails loudly in the event of an unexpected extent shift. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 99528efd1926f2acfd9660d0f48f528ee9048425 Author: Randy Dunlap Date: Wed Dec 11 13:18:37 2019 -0800 xfs: fix Sphinx documentation warning Fix Sphinx documentation format warning by not indenting so much. Documentation/admin-guide/xfs.rst:257: WARNING: Block quote ends without a blank line; unexpected unindent. Signed-off-by: Randy Dunlap Cc: Darrick J. Wong Cc: linux-xfs@vger.kernel.org Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 687dec9b94599b19e218f89fd034d6449c3ff57c Merge: 6674fdb25a9e ffafde478309 Author: Linus Torvalds Date: Wed Dec 11 12:25:32 2019 -0800 Merge tag 'erofs-for-5.5-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "Mainly address a regression reported by David recently observed together with overlayfs due to the improper return value of listxattr() without xattr. Update outdated expressions in document as well. Summary: - Fix improper return value of listxattr() with no xattr - Keep up documentation with latest code" * tag 'erofs-for-5.5-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: update documentation erofs: zero out when listxattr is called with no xattr commit 6674fdb25a9effc620c95d4c231a6ccc97b2f9b1 Merge: d1c6a2aa02af ff205766dbbe Author: Linus Torvalds Date: Wed Dec 11 12:22:38 2019 -0800 Merge tag 'trace-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: - Remove code I accidentally applied when doing a minor fix up to a patch, and then using "git commit -a --amend", which pulled in some other changes I was playing with. - Remove an used variable in trace_events_inject code - Fix function graph tracer when it traces a ftrace direct function. It will now ignore tracing a function that has a ftrace direct tramploine attached. This is needed for eBPF to use the ftrace direct code. * tag 'trace-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: ftrace: Fix function_graph tracer interaction with BPF trampoline tracing: remove set but not used variable 'buffer' module: Remove accidental change of module_enable_x() commit d1c6a2aa02af09238ad09493eb3c8685ccc3fe12 Author: Linus Torvalds Date: Wed Dec 11 11:46:19 2019 -0800 pipe: simplify signal handling in pipe_read() and add comments There's no need to separately check for signals while inside the locked region, since we're going to do "wait_event_interruptible()" right afterwards anyway, and the error handling is much simpler there. The check for whether we had already read anything was also redundant, since we no longer do the odd merging of reads when there are pending writers. But perhaps more importantly, this adds commentary about why we still need to wake up possible writers even though we didn't read any data, and why we can skip all the finishing touches now if we get a signal (or had a signal pending) while waiting for more data. [ This is a split-out cleanup from my "make pipe IO use exclusive wait queues" thing, which I can't apply because it triggers a nasty bug in the GNU make jobserver - Linus ] Signed-off-by: Linus Torvalds commit bd95c1445274c5e126ffd8998fbba9f3732a579e Author: Alex Deucher Date: Wed Dec 11 10:09:03 2019 -0500 drm/amdgpu: fix license on Kconfig and Makefiles amdgpu is MIT licensed. Fixes: ec8f24b7faaf3d ("treewide: Add SPDX license identifier - Makefile/Kconfig") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 69897d3425674b06d1e822f7491d5c40a5ed1a2f Author: Tianci.Yin Date: Wed Dec 11 19:57:43 2019 +0800 drm/amdgpu/gfx10: update gfx golden settings for navi14 add registers: mmPA_SC_BINNER_TIMEOUT_COUNTER and mmPA_SC_ENHANCE_2 Reviewed-by: Feifei Xu Signed-off-by: Tianci.Yin Signed-off-by: Alex Deucher commit 847b0d87950867306967d619d7e5a4db03fdb218 Author: Tianci.Yin Date: Wed Dec 11 19:55:49 2019 +0800 drm/amdgpu/gfx10: update gfx golden settings add registers: mmPA_SC_BINNER_TIMEOUT_COUNTER and mmPA_SC_ENHANCE_2 Reviewed-by: Feifei Xu Signed-off-by: Tianci.Yin Signed-off-by: Alex Deucher commit 5714a2026f0c6eeea1a51d20a4561088f2ebe9ac Author: Tianci.Yin Date: Wed Dec 11 10:52:14 2019 +0800 drm/amdgpu/gfx10: update gfx golden settings for navi14 add registers: mmSPI_CONFIG_CNTL Reviewed-by: Feifei Xu Signed-off-by: Tianci.Yin Signed-off-by: Alex Deucher commit 02cca5769f5e07748c839168dc0b5f21bbacff08 Author: Tianci.Yin Date: Wed Dec 11 10:43:07 2019 +0800 drm/amdgpu/gfx10: update gfx golden settings add registers: mmSPI_CONFIG_CNTL Reviewed-by: Feifei Xu Signed-off-by: Tianci.Yin Signed-off-by: Alex Deucher commit 3e39ce266a273e5751e5792aee248cb8d9630c8b Author: Vasily Gorbik Date: Fri Aug 2 12:42:59 2019 +0200 s390/kasan: add KASAN_VMALLOC support Add KASAN_VMALLOC support which now enables vmalloc memory area access checks as well as enables usage of VMAP_STACK under kasan. KASAN_VMALLOC changes the way vmalloc and modules areas shadow memory is handled. With this new approach only top level page tables are pre-populated and lower levels are filled dynamically upon memory allocation. Acked-by: Ilya Leoshkevich Signed-off-by: Vasily Gorbik commit 1b68ac8678a8e9993deebd55014cbe803e78ca02 Author: Heiko Carstens Date: Fri Nov 29 12:59:59 2019 +0100 s390: remove last diag 0x44 caller diag 0x44 is a voluntary undirected yield of a virtual CPU. This has caused a lot of performance issues in the past. There is only one caller left, and that one is only executed if diag 0x9c (directed yield) is not present. Given that all hypervisors implement diag 0x9c anyway, remove the last diag 0x44 to avoid that more callers will be added. Worst case that could happen now, if diag 0x9c is not present, is that a virtual CPU would loop a bit instead of giving its time slice up. diag 0x44 statistics in debugfs are kept and will always be zero, so that user space can tell that there are no calls. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 157309a97015d8b32d65847d8a6d493d1a958e93 Author: Christian Borntraeger Date: Fri Dec 6 08:27:51 2019 +0100 s390/uv: use EOPNOTSUPP instead of ENOTSUPP ENOTSUP is just an internal kernel error and should never reach userspace. The return value of the share function is not exported to userspace, but to avoid giving bad examples let us use EOPNOTSUPP: Suggested-by: Heiko Carstens Acked-by: Janosch Frank Signed-off-by: Christian Borntraeger Signed-off-by: Vasily Gorbik commit 0539ad0b22877225095d8adef0c376f52cc23834 Author: Thomas Richter Date: Fri Nov 29 15:24:25 2019 +0100 s390/cpum_sf: Avoid SBD overflow condition in irq handler The s390 CPU Measurement sampling facility has an overflow condition which fires when all entries in a SBD are used. The measurement alert interrupt is triggered and reads out all samples in this SDB. It then tests the successor SDB, if this SBD is not full, the interrupt handler does not read any samples at all from this SDB The design waits for the hardware to fill this SBD and then trigger another meassurement alert interrupt. This scheme works nicely until an perf_event_overflow() function call discards the sample due to a too high sampling rate. The interrupt handler has logic to read out a partially filled SDB when the perf event overflow condition in linux common code is met. This causes the CPUM sampling measurement hardware and the PMU device driver to operate on the same SBD's trailer entry. This should not happen. This can be seen here using this trace: cpumsf_pmu_add: tear:0xb5286000 hw_perf_event_update: sdbt 0xb5286000 full 1 over 0 flush_all:0 hw_perf_event_update: sdbt 0xb5286008 full 0 over 0 flush_all:0 above shows 1. interrupt hw_perf_event_update: sdbt 0xb5286008 full 1 over 0 flush_all:0 hw_perf_event_update: sdbt 0xb5286008 full 0 over 0 flush_all:0 above shows 2. interrupt ... this goes on fine until... hw_perf_event_update: sdbt 0xb5286068 full 1 over 0 flush_all:0 perf_push_sample1: overflow one or more samples read from the IRQ handler are rejected by perf_event_overflow() and the IRQ handler advances to the next SDB and modifies the trailer entry of a partially filled SDB. hw_perf_event_update: sdbt 0xb5286070 full 0 over 0 flush_all:1 timestamp: 14:32:52.519953 Next time the IRQ handler is called for this SDB the trailer entry shows an overflow count of 19 missed entries. hw_perf_event_update: sdbt 0xb5286070 full 1 over 19 flush_all:1 timestamp: 14:32:52.970058 Remove access to a follow on SDB when event overflow happened. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit 39d4a501a9ef55c57b51e3ef07fc2aeed7f30b3b Author: Thomas Richter Date: Thu Nov 28 10:26:41 2019 +0100 s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits Function perf_event_ever_overflow() and perf_event_account_interrupt() are called every time samples are processed by the interrupt handler. However function perf_event_account_interrupt() has checks to avoid being flooded with interrupts (more then 1000 samples are received per task_tick). Samples are then dropped and a PERF_RECORD_THROTTLED is added to the perf data. The perf subsystem limit calculation is: maximum sample frequency := 100000 --> 1 samples per 10 us task_tick = 10ms = 10000us --> 1000 samples per task_tick The work flow is measurement_alert() uses SDBT head and each SBDT points to 511 SDB pages, each with 126 sample entries. After processing 8 SBDs and for each valid sample calling: perf_event_overflow() perf_event_account_interrupts() there is a considerable amount of samples being dropped, especially when the sample frequency is very high and near the 100000 limit. To avoid the high amount of samples being dropped near the end of a task_tick time frame, increment the sampling interval in case of dropped events. The CPU Measurement sampling facility on the s390 supports only intervals, specifiing how many CPU cycles have to be executed before a sample is generated. Increase the interval when the samples being generated hit the task_tick limit. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit 7e914fd17e9a750d8896e5645c84e75e52d77a4b Author: Colin Ian King Date: Mon Dec 2 09:02:15 2019 +0000 s390/test_unwind: fix spelling mistake "reqister" -> "register" There is a spelling mistake in a pr_info message. Fix it. Link: https://lkml.kernel.org/r/20191202090215.28766-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Vasily Gorbik commit b62b6cf170237677ae96001940c54d5c09d0015a Author: Vasily Gorbik Date: Tue Dec 3 17:52:03 2019 +0100 s390/spinlock: remove confusing comment in arch_spin_lock_wait arch_spin_lock_wait does not take steal time into consideration. Signed-off-by: Vasily Gorbik commit 3b7436cc9449d5ff7fa1c1fd5bc3edb6402ff5b8 Author: Yufen Yu Date: Tue Dec 10 15:01:29 2019 +0800 md: make sure desc_nr less than MD_SB_DISKS For super_90_load, we need to make sure 'desc_nr' less than MD_SB_DISKS, avoiding invalid memory access of 'sb->disks'. Fixes: 228fc7d76db6 ("md: avoid invalid memory access for array sb->dev_roles") Signed-off-by: Yufen Yu Signed-off-by: Song Liu commit 028288df635f5a9addd48ac4677b720192747944 Author: Zhiqiang Liu Date: Tue Dec 10 10:42:25 2019 +0800 md: raid1: check rdev before reference in raid1_sync_request func In raid1_sync_request func, rdev should be checked before reference. Signed-off-by: Zhiqiang Liu Signed-off-by: Song Liu commit a7ede3d16808b8f3915c8572d783530a82b2f027 Author: Guoqing Jiang Date: Wed Nov 27 17:57:50 2019 +0100 raid5: need to set STRIPE_HANDLE for batch head With commit 6ce220dd2f8ea71d6afc29b9a7524c12e39f374a ("raid5: don't set STRIPE_HANDLE to stripe which is in batch list"), we don't want to set STRIPE_HANDLE flag for sh which is already in batch list. However, the stripe which is the head of batch list should set this flag, otherwise panic could happen inside init_stripe at BUG_ON(sh->batch_head), it is reproducible with raid5 on top of nvdimm devices per Xiao oberserved. Thanks for Xiao's effort to verify the change. Fixes: 6ce220dd2f8ea ("raid5: don't set STRIPE_HANDLE to stripe which is in batch list") Reported-by: Xiao Ni Tested-by: Xiao Ni Signed-off-by: Guoqing Jiang Signed-off-by: Song Liu commit 50559800b76a7a2a46da303100da639536261808 Author: David Howells Date: Wed Dec 11 08:58:59 2019 +0000 afs: Show volume name in /proc/net/afs//volumes Show the name of each volume in /proc/net/afs//volumes to make it easier to work out the name corresponding to a volume ID. This makes it easier to work out which mounts in /proc/mounts correspond to which volume ID. Signed-off-by: David Howells Reviewed-by: Marc Dionne commit 106bc79843c3c6f4f00753d1f46e54e815f99377 Author: David Howells Date: Wed Dec 11 08:06:08 2019 +0000 afs: Fix missing cell comparison in afs_test_super() Fix missing cell comparison in afs_test_super(). Without this, any pair volumes that have the same volume ID will share a superblock, no matter the cell, unless they're in different network namespaces. Normally, most users will only deal with a single cell and so they won't see this. Even if they do look into a second cell, they won't see a problem unless they happen to hit a volume with the same ID as one they've already got mounted. Before the patch: # ls /afs/grand.central.org/archive linuxdev/ mailman/ moin/ mysql/ pipermail/ stage/ twiki/ # ls /afs/kth.se/ linuxdev/ mailman/ moin/ mysql/ pipermail/ stage/ twiki/ # cat /proc/mounts | grep afs none /afs afs rw,relatime,dyn,autocell 0 0 #grand.central.org:root.cell /afs/grand.central.org afs ro,relatime 0 0 #grand.central.org:root.archive /afs/grand.central.org/archive afs ro,relatime 0 0 #grand.central.org:root.archive /afs/kth.se afs ro,relatime 0 0 After the patch: # ls /afs/grand.central.org/archive linuxdev/ mailman/ moin/ mysql/ pipermail/ stage/ twiki/ # ls /afs/kth.se/ admin/ common/ install/ OldFiles/ service/ system/ bakrestores/ home/ misc/ pkg/ src/ wsadmin/ # cat /proc/mounts | grep afs none /afs afs rw,relatime,dyn,autocell 0 0 #grand.central.org:root.cell /afs/grand.central.org afs ro,relatime 0 0 #grand.central.org:root.archive /afs/grand.central.org/archive afs ro,relatime 0 0 #kth.se:root.cell /afs/kth.se afs ro,relatime 0 0 Fixes: ^1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Carsten Jacobi Signed-off-by: David Howells Reviewed-by: Marc Dionne Tested-by: Jonathan Billings cc: Todd DeSantis commit 1da4bd9f9d187f53618890d7b66b9628bbec3c70 Author: David Howells Date: Wed Dec 11 08:56:04 2019 +0000 afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP Fix the lookup method on the dynamic root directory such that creation calls, such as mkdir, open(O_CREAT), symlink, etc. fail with EOPNOTSUPP rather than failing with some odd error (such as EEXIST). lookup() itself tries to create automount directories when it is invoked. These are cached locally in RAM and not committed to storage. Signed-off-by: David Howells Reviewed-by: Marc Dionne Tested-by: Jonathan Billings commit 4eac734486fd431e0756cc5e929f140911a36a53 Author: SeongJae Park Date: Mon Dec 2 12:42:21 2019 +0100 kselftest: Support old perl versions On an old perl such as v5.10.1, `kselftest/prefix.pl` gives below error message: Can't locate object method "autoflush" via package "IO::Handle" at kselftest/prefix.pl line 10. This commit fixes the error by explicitly specifying the use of the `IO::Handle` package. Signed-off-by: SeongJae Park Acked-by: Kees Cook Signed-off-by: Shuah Khan commit d187801d1a46519d2a322f879f7c8f85c685372e Author: SeongJae Park Date: Mon Dec 2 12:42:20 2019 +0100 kselftest/runner: Print new line in print of timeout log If a timeout failure occurs, kselftest kills the test process and prints the timeout log. If the test process has killed while printing a log that ends with new line, the timeout log can be printed in middle of the test process output so that it can be seems like a comment, as below: # test_process_log not ok 3 selftests: timers: nsleep-lat # TIMEOUT This commit avoids such problem by printing one more line before the TIMEOUT failure log. Signed-off-by: SeongJae Park Acked-by: Kees Cook Signed-off-by: Shuah Khan commit 3a019636e6b00997594f91339411fa6bbd2c6d33 Author: Michael Ellerman Date: Fri Dec 6 14:17:38 2019 +1100 selftests: Fix dangling documentation references to kselftest_module.sh Commit c78fd76f2b67 ("selftests: Move kselftest_module.sh into kselftest/") moved kselftest_module.sh but missed updating a few references to the path in documentation. Fixes: c78fd76f2b67 ("selftests: Move kselftest_module.sh into kselftest/") Signed-off-by: Michael Ellerman Acked-by: Kees Cook Signed-off-by: Shuah Khan commit 158d58335393af3956a9c06f0816ee75ed1f1447 Author: David Howells Date: Mon Dec 9 15:04:45 2019 +0000 afs: Fix mountpoint parsing Each AFS mountpoint has strings that define the target to be mounted. This is required to end in a dot that is supposed to be stripped off. The string can include suffixes of ".readonly" or ".backup" - which are supposed to come before the terminal dot. To add to the confusion, the "fs lsmount" afs utility does not show the terminal dot when displaying the string. The kernel mount source string parser, however, assumes that the terminal dot marks the suffix and that the suffix is always "" and is thus ignored. In most cases, there is no suffix and this is not a problem - but if there is a suffix, it is lost and this affects the ability to mount the correct volume. The command line mount command, on the other hand, is expected not to include a terminal dot - so the problem doesn't arise there. Fix this by making sure that the dot exists and then stripping it when passing the string to the mount configuration. Fixes: bec5eb614130 ("AFS: Implement an autocell mount capability [ver #2]") Reported-by: Jonathan Billings Signed-off-by: David Howells Reviewed-by: Marc Dionne Tested-by: Jonathan Billings commit 9103bb419aef8b908a169ebed0e1c16ae060576a Merge: 96dd4bcbac8a db23808615e2 Author: Olof Johansson Date: Wed Dec 11 08:52:49 2019 -0800 Merge tag 'reset-fixes-for-v5.5-2' of git://git.pengutronix.de/git/pza/linux into arm/fixes Reset controller fixes for v5.5, part 2 Fix the example in the brcmstb-reset device tree bindings, remove a bogus resource alignment check from the reset-brcmstb driver, fix the documented return value type for the reset_control_array_get functions, and fix a devres memory leak when requesting optional, not present reset controls. * tag 'reset-fixes-for-v5.5-2' of git://git.pengutronix.de/git/pza/linux: reset: Do not register resource data for missing resets reset: Fix {of,devm}_reset_control_array_get kerneldoc return types reset: brcmstb: Remove resource checks dt-bindings: reset: Fix brcmstb-reset example Link: https://lore.kernel.org/r/bb59b9f83892aa3c876f5da87890b0496f2dc755.camel@pengutronix.de Signed-off-by: Olof Johansson commit 96dd4bcbac8ab5164ec3f07f9ae1f1611e767417 Merge: 8ecad8c0d1f8 30e647a764d4 Author: Olof Johansson Date: Wed Dec 11 08:52:16 2019 -0800 Merge tag 'arm-soc/for-5.5/devicetree-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for v5.5-rc1, please pull the following: - Nicolas fixes the SoC's dma-range property to cover the full 1GB aperture - Stefan fixes the critical temperature trip point to be set before the firmware performs thermal throttling - Florian fixes the BCM5301X and Cygnus MDIO nodes to have corrected #address-cells and #size-cells properties * tag 'arm-soc/for-5.5/devicetree-fixes' of https://github.com/Broadcom/stblinux: ARM: dts: bcm283x: Fix critical trip point ARM: dts: Cygnus: Fix MDIO node address/size cells ARM: dts: bcm2711: fix soc's node dma-ranges ARM: dts: BCM5301X: Fix MDIO node address/size cells Link: https://lore.kernel.org/r/20191210205850.12442-1-f.fainelli@gmail.com Signed-off-by: Olof Johansson commit 8ecad8c0d1f87d3912c5ce9b65c56c32a38ac527 Author: Arnd Bergmann Date: Tue Dec 10 21:34:00 2019 +0100 ARM: mmp: include the correct cputype.h The file was moved, causing a build error: In file included from /git/arm-soc/arch/arm/mach-mmp/pxa168.c:28: arch/arm/mach-mmp/pxa168.h:22:10: fatal error: cputype.h: No such file or directory Include it from the new location. Link: https://lore.kernel.org/r/20191210203409.2875880-1-arnd@arndb.de Fixes: 32adcaa010fa ("ARM: mmp: move cputype.h to include/linux/soc/") Signed-off-by: Arnd Bergmann Signed-off-by: Olof Johansson commit c6b16761c6908d3dc167a0a566578b4b0b972905 Author: Tomi Valkeinen Date: Thu Nov 14 11:39:48 2019 +0200 ARM: dts: am437x-gp/epos-evm: fix panel compatible The LCD panel on AM4 GP EVMs and ePOS boards seems to be osd070t1718-19ts. The current dts files say osd057T0559-34ts. Possibly the panel has changed since the early EVMs, or there has been a mistake with the panel type. Update the DT files accordingly. Acked-by: Laurent Pinchart Signed-off-by: Tomi Valkeinen Signed-off-by: Tony Lindgren commit c52c91bb9aa6bd8c38dbf9776158e33038aedd43 Author: Vignesh Raghavendra Date: Wed Dec 11 21:22:16 2019 +0530 spi: spi-ti-qspi: Fix a bug when accessing non default CS When switching ChipSelect from default CS0 to any other CS, driver fails to update the bits in system control module register that control which CS is mapped for MMIO access. This causes reads to fail when driver tries to access QSPI flash on CS1/2/3. Fix this by updating appropriate bits whenever active CS changes. Reported-by: Andreas Dannenberg Signed-off-by: Vignesh Raghavendra Link: https://lore.kernel.org/r/20191211155216.30212-1-vigneshr@ti.com Signed-off-by: Mark Brown commit 100a21100bbb2bbc82fc4273e152c96e5c6c5d12 Author: Bartosz Golaszewski Date: Tue Dec 10 11:07:25 2019 +0100 regulator: max77650: add of_match table We need the of_match table if we want to use the compatible string in the pmic's child node and get the regulator driver loaded automatically. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20191210100725.11005-1-brgl@bgdev.pl Signed-off-by: Mark Brown commit 28707826877f84bce0977845ea529cbdd08e4e8d Author: Michael Petlan Date: Sun Dec 8 17:20:56 2019 +0100 perf header: Fix false warning when there are no duplicate cache entries Before this patch, perf expected that there might be NPROC*4 unique cache entries at max, however, it also expected that some of them would be shared and/or of the same size, thus the final number of entries would be reduced to be lower than NPROC*4. In case the number of entries hadn't been reduced (was NPROC*4), the warning was printed. However, some systems might have unusual cache topology, such as the following two-processor KVM guest: cpu level shared_cpu_list size 0 1 0 32K 0 1 0 64K 0 2 0 512K 0 3 0 8192K 1 1 1 32K 1 1 1 64K 1 2 1 512K 1 3 1 8192K This KVM guest has 8 (NPROC*4) unique cache entries, which used to make perf printing the message, although there actually aren't "way too many cpu caches". v2: Removing unused argument. v3: Unifying the way we obtain number of cpus. v4: Removed '& UINT_MAX' construct which is redundant. Signed-off-by: Michael Petlan Acked-by: Jiri Olsa LPU-Reference: 20191208162056.20772-1-mpetlan@redhat.com Signed-off-by: Arnaldo Carvalho de Melo commit eb573e746b9d4f0921dcb2449be3df41dae3caea Author: Kajol Jain Date: Wed Nov 20 14:10:59 2019 +0530 perf metricgroup: Fix printing event names of metric group with multiple events Commit f01642e4912b ("perf metricgroup: Support multiple events for metricgroup") introduced support for multiple events in a metric group. But with the current upstream, metric events names are not printed properly In power9 platform: command:# ./perf stat --metric-only -M translation -C 0 -I 1000 sleep 2 1.000208486 2.000368863 2.001400558 Similarly in skylake platform: command:./perf stat --metric-only -M Power -I 1000 1.000579994 2.002189493 With current upstream version, issue is with event name comparison logic in find_evsel_group(). Current logic is to compare events belonging to a metric group to the events in perf_evlist. Since the break statement is missing in the loop used for comparison between metric group and perf_evlist events, the loop continues to execute even after getting a pattern match, and end up in discarding the matches. Incase of single metric event belongs to metric group, its working fine, because in case of single event once it compare all events it reaches to end of perf_evlist. Example for single metric event in power9 platform: command:# ./perf stat --metric-only -M branches_per_inst -I 1000 sleep 1 1.000094653 0.2 1.001337059 0.0 This patch fixes the issue by making sure once we found all events belongs to that metric event matched in find_evsel_group(), we successfully break from that loop by adding corresponding condition. With this patch: In power9 platform: command:# ./perf stat --metric-only -M translation -C 0 -I 1000 sleep 2 result:# time derat_4k_miss_rate_percent derat_4k_miss_ratio derat_miss_ratio derat_64k_miss_rate_percent derat_64k_miss_ratio dslb_miss_rate_percent islb_miss_rate_percent 1.000135672 0.0 0.3 1.0 0.0 0.2 0.0 0.0 2.000380617 0.0 0.0 0.0 0.0 0.0 0.0 0.0 command:# ./perf stat --metric-only -M Power -I 1000 Similarly in skylake platform: result:# time Turbo_Utilization C3_Core_Residency C6_Core_Residency C7_Core_Residency C2_Pkg_Residency C3_Pkg_Residency C6_Pkg_Residency C7_Pkg_Residency 1.000563580 0.3 0.0 2.6 44.2 21.9 0.0 0.0 0.0 2.002235027 0.4 0.0 2.7 43.0 20.7 0.0 0.0 0.0 Committer testing: Before: [root@seventh ~]# perf stat --metric-only -M Power -I 1000 # time 1.000383223 2.001168182 3.001968545 4.002741200 5.003442022 ^C 5.777687244 [root@seventh ~]# After the patch: [root@seventh ~]# perf stat --metric-only -M Power -I 1000 # time Turbo_Utilization C3_Core_Residency C6_Core_Residency C7_Core_Residency C2_Pkg_Residency C3_Pkg_Residency C6_Pkg_Residency C7_Pkg_Residency 1.000406577 0.4 0.1 1.4 97.0 0.0 0.0 0.0 0.0 2.001481572 0.3 0.0 0.6 97.9 0.0 0.0 0.0 0.0 3.002332585 0.2 0.0 1.0 97.5 0.0 0.0 0.0 0.0 4.003196624 0.2 0.0 0.3 98.6 0.0 0.0 0.0 0.0 5.004063851 0.3 0.0 0.7 97.7 0.0 0.0 0.0 0.0 ^C 5.471260276 0.2 0.0 0.5 49.3 0.0 0.0 0.0 0.0 [root@seventh ~]# [root@seventh ~]# dmesg | grep -i skylake [ 0.187807] Performance Events: PEBS fmt3+, Skylake events, 32-deep LBR, full-width counters, Intel PMU driver. [root@seventh ~]# Fixes: f01642e4912b ("perf metricgroup: Support multiple events for metricgroup") Signed-off-by: Kajol Jain Reviewed-by: Ravi Bangoria Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anju T Sudhakar Cc: Jin Yao Cc: Jiri Olsa Cc: Kan Liang Cc: Madhavan Srinivasan Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20191120084059.24458-1-kjain@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 0dd674efaf63bc6bfd89909814db618abe1e7039 Author: Ravi Bangoria Date: Wed Dec 4 21:51:21 2019 +0530 perf/x86/pmu-events: Fix Kernel_Utilization metric Kernel Utilization should divide ref cycles spent in kernel with total ref cycles. Signed-off-by: Ravi Bangoria Reviewed-by: Andi Kleen Cc: Alexander Shishkin Cc: Haiyan Song Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20191204162121.29998-1-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 61208e6e1003b3fd8d2d1f2a72ec27be43955c0b Author: Arnaldo Carvalho de Melo Date: Wed Dec 11 10:21:59 2019 -0300 perf top: Do not bail out when perf_env__read_cpuid() returns ENOSYS 'perf top' stopped working on hw architectures that do not provide a get_cpuid() implementation and thus fallback to the weak get_cpuid() default function. This is done because at annotation time we may need it in the arch specific annotation init routine, but that is only being used by arches that do provide a get_cpuid() implementation: $ find tools/ -name "*.[ch]" | xargs grep 'evlist->env' tools/perf/builtin-top.c: top.evlist->env = &perf_env; tools/perf/util/evsel.c: return evsel->evlist->env; tools/perf/util/s390-cpumsf.c: sf->machine_type = s390_cpumsf_get_type(session->evlist->env->cpuid); tools/perf/util/header.c: session->evlist->env = &header->env; tools/perf/util/sample-raw.c: const char *arch_pf = perf_env__arch(evlist->env); $ $ find tools/perf/arch -name "*.[ch]" | xargs grep -w get_cpuid tools/perf/arch/x86/util/auxtrace.c: ret = get_cpuid(buffer, sizeof(buffer)); tools/perf/arch/x86/util/header.c:get_cpuid(char *buffer, size_t sz) tools/perf/arch/powerpc/util/header.c:get_cpuid(char *buffer, size_t sz) tools/perf/arch/s390/util/header.c: * Implementation of get_cpuid(). tools/perf/arch/s390/util/header.c:int get_cpuid(char *buffer, size_t sz) tools/perf/arch/s390/util/header.c: if (buf && get_cpuid(buf, 128)) $ For 'report' or 'script', i.e. tools working on perf.data files, that is setup while reading the header, its just top that needs to explicitely read it at tool start. Fixes: 608127f73779 ("perf top: Initialize perf_env->cpuid, needed by the per arch annotation init routine") Reported-by: John Garry Analysed-by: Jiri Olsa Reviewed-by: Mark Rutland Tested-by: Mark Rutland Tested-by: John Garry # arm64 Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Namhyung Kim Cc: Will Deacon Link: https://lkml.kernel.org/n/tip-lxwjr0cd2eggzx04a780ffrv@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 05267c7eac12627fae3f25dfd203bfdb9941f9ca Author: Arnaldo Carvalho de Melo Date: Wed Dec 11 10:09:24 2019 -0300 perf arch: Make the default get_cpuid() return compatible error Some of the functions calling get_cpuid() propagate back the error it returns, and all are using errno (positive) values, make the weak default get_cpuid() function return ENOSYS to be consistent and to allow checking if this is an arch not providing this function or if a provided one is having trouble getting the cpuid, to decide if the warning should be provided to the user or just a debug message should be emitted. Reviewed-by: Mark Rutland Tested-by: Mark Rutland Tested-by: John Garry # arm64 Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Namhyung Kim Cc: Will Deacon Link: https://lkml.kernel.org/n/tip-lxwjr0cd2eggzx04a780ffrv@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a2ce3217d3a448e5cf434026131633cf32ed2234 Author: Grygorii Strashko Date: Wed Nov 27 17:55:26 2019 +0200 dt-bindings: net: ti: cpsw-switch: update to fix comments After original patch was merged there were additional comments/requests provided by Rob Herring [1]. Mostly they are related to json-schema usage, and this patch fixes them. Also SPDX-License-Identifier has been changed to (GPL-2.0-only OR BSD-2-Clause) as requested. [1] https://lkml.org/lkml/2019/11/21/875 Fixes: ef63fe72f698 ("dt-bindings: net: ti: add new cpsw switch driver bindings") Signed-off-by: Grygorii Strashko [robh: Remove 2 more maxItems that aren't necessary] Signed-off-by: Rob Herring commit 71bbcd2eaf042ec3f10122e3f3b1be67dbfb1c16 Author: Arnaud Pouliquen Date: Fri Nov 22 13:54:02 2019 +0100 dt-bindings: remoteproc: stm32: add wakeup-source property If the optional wdg interrupt is defined, then this property may be defined. Signed-off-by: Arnaud Pouliquen Signed-off-by: Rob Herring commit bd82873f23c9a6ad834348f8b83f3b6a5bca2c65 Author: Mathias Nyman Date: Wed Dec 11 16:20:07 2019 +0200 xhci: make sure interrupts are restored to correct state spin_unlock_irqrestore() might be called with stale flags after reading port status, possibly restoring interrupts to a incorrect state. If a usb2 port just finished resuming while the port status is read the spin lock will be temporary released and re-acquired in a separate function. The flags parameter is passed as value instead of a pointer, not updating flags properly before the final spin_unlock_irqrestore() is called. Cc: # v3.12+ Fixes: 8b3d45705e54 ("usb: Fix xHCI host issues on remote wakeup.") Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20191211142007.8847-7-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 7ff11162808cc2ec66353fc012c58bb449c892c3 Author: Mathias Nyman Date: Wed Dec 11 16:20:06 2019 +0200 xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. xhci driver claims it needs XHCI_TRUST_TX_LENGTH quirk for both Broadcom/Cavium and a Renesas xHC controllers. The quirk was inteded for handling false "success" complete event for transfers that had data left untransferred. These transfers should complete with "short packet" events instead. In these two new cases the false "success" completion is reported after a "short packet" if the TD consists of several TRBs. xHCI specs 4.10.1.1.2 say remaining TRBs should report "short packet" as well after the first short packet in a TD, but this issue seems so common it doesn't make sense to add the quirk for all vendors. Turn these events into short packets automatically instead. This gets rid of the "The WARN Successful completion on short TX for slot 1 ep 1: needs XHCI_TRUST_TX_LENGTH quirk" warning in many cases. Cc: Reported-by: Eli Billauer Reported-by: Ard Biesheuvel Tested-by: Eli Billauer Tested-by: Ard Biesheuvel Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20191211142007.8847-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 7c67cf6658cec70d8a43229f2ce74ca1443dc95e Author: Kai-Heng Feng Date: Wed Dec 11 16:20:05 2019 +0200 xhci: Increase STS_HALT timeout in xhci_suspend() I've recently observed failed xHCI suspend attempt on AMD Raven Ridge system: kernel: xhci_hcd 0000:04:00.4: WARN: xHC CMD_RUN timeout kernel: PM: suspend_common(): xhci_pci_suspend+0x0/0xd0 returns -110 kernel: PM: pci_pm_suspend(): hcd_pci_suspend+0x0/0x30 returns -110 kernel: PM: dpm_run_callback(): pci_pm_suspend+0x0/0x150 returns -110 kernel: PM: Device 0000:04:00.4 failed to suspend async: error -110 Similar to commit ac343366846a ("xhci: Increase STS_SAVE timeout in xhci_suspend()") we also need to increase the HALT timeout to make it be able to suspend again. Cc: # 5.2+ Fixes: f7fac17ca925 ("xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()") Signed-off-by: Kai-Heng Feng Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20191211142007.8847-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f2c710f7dca8457e88b4ac9de2060f011254f9dd Author: Henry Lin Date: Wed Dec 11 16:20:04 2019 +0200 usb: xhci: only set D3hot for pci device Xhci driver cannot call pci_set_power_state() on non-pci xhci host controllers. For example, NVIDIA Tegra XHCI host controller which acts as platform device with XHCI_SPURIOUS_WAKEUP quirk set in some platform hits this issue during shutdown. Cc: Fixes: 638298dc66ea ("xhci: Fix spurious wakeups after S5 on Haswell") Signed-off-by: Henry Lin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20191211142007.8847-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 057d476fff778f1d3b9f861fdb5437ea1a3cfc99 Author: Mathias Nyman Date: Wed Dec 11 16:20:03 2019 +0200 xhci: fix USB3 device initiated resume race with roothub autosuspend A race in xhci USB3 remote wake handling may force device back to suspend after it initiated resume siganaling, causing a missed resume event or warm reset of device. When a USB3 link completes resume signaling and goes to enabled (UO) state a interrupt is issued and the interrupt handler will clear the bus_state->port_remote_wakeup resume flag, allowing bus suspend. If the USB3 roothub thread just finished reading port status before the interrupt, finding ports still in suspended (U3) state, but hasn't yet started suspending the hub, then the xhci interrupt handler will clear the flag that prevented roothub suspend and allow bus to suspend, forcing all port links back to suspended (U3) state. Example case: usb_runtime_suspend() # because all ports still show suspended U3 usb_suspend_both() hub_suspend(); # successful as hub->wakeup_bits not set yet ==> INTERRUPT xhci_irq() handle_port_status() clear bus_state->port_remote_wakeup usb_wakeup_notification() sets hub->wakeup_bits; kick_hub_wq() <== END INTERRUPT hcd_bus_suspend() xhci_bus_suspend() # success as port_remote_wakeup bits cleared Fix this by increasing roothub usage count during port resume to prevent roothub autosuspend, and by making sure bus_state->port_remote_wakeup flag is only cleared after resume completion is visible, i.e. after xhci roothub returned U0 or other non-U3 link state link on a get port status request. Issue rootcaused by Chiasheng Lee Cc: Cc: Lee, Hou-hsun Reported-by: Lee, Chiasheng Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20191211142007.8847-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ce91f1a43b37463f517155bdfbd525eb43adbd1a Author: Mika Westerberg Date: Wed Dec 11 16:20:02 2019 +0200 xhci: Fix memory leak in xhci_add_in_port() When xHCI is part of Alpine or Titan Ridge Thunderbolt controller and the xHCI device is hot-removed as a result of unplugging a dock for example, the driver leaks memory it allocates for xhci->usb3_rhub.psi and xhci->usb2_rhub.psi in xhci_add_in_port() as reported by kmemleak: unreferenced object 0xffff922c24ef42f0 (size 16): comm "kworker/u16:2", pid 178, jiffies 4294711640 (age 956.620s) hex dump (first 16 bytes): 21 00 0c 00 12 00 dc 05 23 00 e0 01 00 00 00 00 !.......#....... backtrace: [<000000007ac80914>] xhci_mem_init+0xcf8/0xeb7 [<0000000001b6d775>] xhci_init+0x7c/0x160 [<00000000db443fe3>] xhci_gen_setup+0x214/0x340 [<00000000fdffd320>] xhci_pci_setup+0x48/0x110 [<00000000541e1e03>] usb_add_hcd.cold+0x265/0x747 [<00000000ca47a56b>] usb_hcd_pci_probe+0x219/0x3b4 [<0000000021043861>] xhci_pci_probe+0x24/0x1c0 [<00000000b9231f25>] local_pci_probe+0x3d/0x70 [<000000006385c9d7>] pci_device_probe+0xd0/0x150 [<0000000070241068>] really_probe+0xf5/0x3c0 [<0000000061f35c0a>] driver_probe_device+0x58/0x100 [<000000009da11198>] bus_for_each_drv+0x79/0xc0 [<000000009ce45f69>] __device_attach+0xda/0x160 [<00000000df201aaf>] pci_bus_add_device+0x46/0x70 [<0000000088a1bc48>] pci_bus_add_devices+0x27/0x60 [<00000000ad9ee708>] pci_bus_add_devices+0x52/0x60 unreferenced object 0xffff922c24ef3318 (size 8): comm "kworker/u16:2", pid 178, jiffies 4294711640 (age 956.620s) hex dump (first 8 bytes): 34 01 05 00 35 41 0a 00 4...5A.. backtrace: [<000000007ac80914>] xhci_mem_init+0xcf8/0xeb7 [<0000000001b6d775>] xhci_init+0x7c/0x160 [<00000000db443fe3>] xhci_gen_setup+0x214/0x340 [<00000000fdffd320>] xhci_pci_setup+0x48/0x110 [<00000000541e1e03>] usb_add_hcd.cold+0x265/0x747 [<00000000ca47a56b>] usb_hcd_pci_probe+0x219/0x3b4 [<0000000021043861>] xhci_pci_probe+0x24/0x1c0 [<00000000b9231f25>] local_pci_probe+0x3d/0x70 [<000000006385c9d7>] pci_device_probe+0xd0/0x150 [<0000000070241068>] really_probe+0xf5/0x3c0 [<0000000061f35c0a>] driver_probe_device+0x58/0x100 [<000000009da11198>] bus_for_each_drv+0x79/0xc0 [<000000009ce45f69>] __device_attach+0xda/0x160 [<00000000df201aaf>] pci_bus_add_device+0x46/0x70 [<0000000088a1bc48>] pci_bus_add_devices+0x27/0x60 [<00000000ad9ee708>] pci_bus_add_devices+0x52/0x60 Fix this by calling kfree() for the both psi objects in xhci_mem_cleanup(). Cc: # 4.4+ Fixes: 47189098f8be ("xhci: parse xhci protocol speed ID list for usb 3.1 usage") Signed-off-by: Mika Westerberg Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20191211142007.8847-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 85862213e75eec2cbc2eae8adb47f7e41918edbb Merge: f8c63edfd789 e5b5da96da50 Author: Greg Kroah-Hartman Date: Wed Dec 11 15:28:37 2019 +0100 Merge tag 'fixes-for-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: USB: fixes for v5.5-rc2 Only four patches here this time around. Three of them are on dwc3 fixing some small bugs related to our 'started' flag. None are major fixes but they're important nevertheless. * tag 'fixes-for-v5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: usb: gadget: fix wrong endpoint desc usb: dwc3: ep0: Clear started flag on completion usb: dwc3: gadget: Clear started flag for non-IOC usb: dwc3: gadget: Fix logical condition commit 750bde2fd4ffacc297473c36d6fdb29c395b06aa Author: Chris Wilson Date: Thu Nov 21 07:10:41 2019 +0000 drm/i915: Serialise with remote retirement Since retirement may be running in a worker on another CPU, it may be skipped in the local intel_gt_wait_for_idle(). To ensure the state is consistent for our sanity checks upon load, serialise with the remote retirer by waiting on the timeline->mutex. Outside of this use case, e.g. on suspend or module unload, we expect the slack to be picked up by intel_gt_pm_wait_for_idle() and so prefer to put the special case serialisation with retirement in its single user, for now at least. Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191121071044.97798-2-chris@chris-wilson.co.uk (cherry picked from commit 2d0fb251360ab7eccbffd99f6933a2a4de678d52) Fixes: 093b92287363 ("drm/i915: Split i915_active.mutex into an irq-safe spinlock for the rbtree") Closes: https://gitlab.freedesktop.org/drm/intel/issues/754 Signed-off-by: Joonas Lahtinen commit 8ec321e96e056de84022c032ffea253431a83c3c Author: Alan Stern Date: Tue Dec 10 16:26:11 2019 -0500 HID: Fix slab-out-of-bounds read in hid_field_extract The syzbot fuzzer found a slab-out-of-bounds bug in the HID report handler. The bug was caused by a report descriptor which included a field with size 12 bits and count 4899, for a total size of 7349 bytes. The usbhid driver uses at most a single-page 4-KB buffer for reports. In the test there wasn't any problem about overflowing the buffer, since only one byte was received from the device. Rather, the bug occurred when the HID core tried to extract the data from the report fields, which caused it to try reading data beyond the end of the allocated buffer. This patch fixes the problem by rejecting any report whose total length exceeds the HID_MAX_BUFFER_SIZE limit (minus one byte to allow for a possible report index). In theory a device could have a report longer than that, but if there was such a thing we wouldn't handle it correctly anyway. Reported-and-tested-by: syzbot+09ef48aa58261464b621@syzkaller.appspotmail.com Signed-off-by: Alan Stern CC: Signed-off-by: Jiri Kosina commit 63b9b80e9f5b2c463d98d6e550e0d0e3ace66033 Author: Michael S. Tsirkin Date: Tue Nov 19 05:25:24 2019 -0500 virtio_balloon: divide/multiply instead of shifts We managed to get confused about the shift direction at least once. Let's switch to division/multiplcation instead. Add a number of pages macro for this purpose. We still keep the order macro around too since this is what alloc/free pages want. Signed-off-by: Michael S. Tsirkin Reviewed-by: Wei Wang Reviewed-by: David Hildenbrand commit 2a946fa1c8bc26df03bacebb6811b656d5e0cf1c Author: Michael S. Tsirkin Date: Tue Nov 19 05:21:47 2019 -0500 virtio_balloon: name cleanups free_page_order is a confusing name. It's not a page order actually, it's the order of the block of memory we are hinting. Rename to hint_block_order. Also, rename SIZE to BYTES to make it clear it's the block size in bytes. Signed-off-by: Michael S. Tsirkin Reviewed-by: Wei Wang Reviewed-by: David Hildenbrand commit 63341ab03706e11a31e3dd8ccc0fbc9beaf723f0 Author: David Hildenbrand Date: Wed Dec 11 12:11:52 2019 +0100 virtio-balloon: fix managed page counts when migrating pages between zones In case we have to migrate a ballon page to a newpage of another zone, the managed page count of both zones is wrong. Paired with memory offlining (which will adjust the managed page count), we can trigger kernel crashes and all kinds of different symptoms. One way to reproduce: 1. Start a QEMU guest with 4GB, no NUMA 2. Hotplug a 1GB DIMM and online the memory to ZONE_NORMAL 3. Inflate the balloon to 1GB 4. Unplug the DIMM (be quick, otherwise unmovable data ends up on it) 5. Observe /proc/zoneinfo Node 0, zone Normal pages free 16810 min 24848885473806 low 18471592959183339 high 36918337032892872 spanned 262144 present 262144 managed 18446744073709533486 6. Do anything that requires some memory (e.g., inflate the balloon some more). The OOM goes crazy and the system crashes [ 238.324946] Out of memory: Killed process 537 (login) total-vm:27584kB, anon-rss:860kB, file-rss:0kB, shmem-rss:00 [ 238.338585] systemd invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 238.339420] CPU: 0 PID: 1 Comm: systemd Tainted: G D W 5.4.0-next-20191204+ #75 [ 238.340139] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu4 [ 238.341121] Call Trace: [ 238.341337] dump_stack+0x8f/0xd0 [ 238.341630] dump_header+0x61/0x5ea [ 238.341942] oom_kill_process.cold+0xb/0x10 [ 238.342299] out_of_memory+0x24d/0x5a0 [ 238.342625] __alloc_pages_slowpath+0xd12/0x1020 [ 238.343024] __alloc_pages_nodemask+0x391/0x410 [ 238.343407] pagecache_get_page+0xc3/0x3a0 [ 238.343757] filemap_fault+0x804/0xc30 [ 238.344083] ? ext4_filemap_fault+0x28/0x42 [ 238.344444] ext4_filemap_fault+0x30/0x42 [ 238.344789] __do_fault+0x37/0x1a0 [ 238.345087] __handle_mm_fault+0x104d/0x1ab0 [ 238.345450] handle_mm_fault+0x169/0x360 [ 238.345790] do_user_addr_fault+0x20d/0x490 [ 238.346154] do_page_fault+0x31/0x210 [ 238.346468] async_page_fault+0x43/0x50 [ 238.346797] RIP: 0033:0x7f47eba4197e [ 238.347110] Code: Bad RIP value. [ 238.347387] RSP: 002b:00007ffd7c0c1890 EFLAGS: 00010293 [ 238.347834] RAX: 0000000000000002 RBX: 000055d196a20a20 RCX: 00007f47eba4197e [ 238.348437] RDX: 0000000000000033 RSI: 00007ffd7c0c18c0 RDI: 0000000000000004 [ 238.349047] RBP: 00007ffd7c0c1c20 R08: 0000000000000000 R09: 0000000000000033 [ 238.349660] R10: 00000000ffffffff R11: 0000000000000293 R12: 0000000000000001 [ 238.350261] R13: ffffffffffffffff R14: 0000000000000000 R15: 00007ffd7c0c18c0 [ 238.350878] Mem-Info: [ 238.351085] active_anon:3121 inactive_anon:51 isolated_anon:0 [ 238.351085] active_file:12 inactive_file:7 isolated_file:0 [ 238.351085] unevictable:0 dirty:0 writeback:0 unstable:0 [ 238.351085] slab_reclaimable:5565 slab_unreclaimable:10170 [ 238.351085] mapped:3 shmem:111 pagetables:155 bounce:0 [ 238.351085] free:720717 free_pcp:2 free_cma:0 [ 238.353757] Node 0 active_anon:12484kB inactive_anon:204kB active_file:48kB inactive_file:28kB unevictable:0kB iss [ 238.355979] Node 0 DMA free:11556kB min:36kB low:48kB high:60kB reserved_highatomic:0KB active_anon:152kB inactivB [ 238.358345] lowmem_reserve[]: 0 2955 2884 2884 2884 [ 238.358761] Node 0 DMA32 free:2677864kB min:7004kB low:10028kB high:13052kB reserved_highatomic:0KB active_anon:0B [ 238.361202] lowmem_reserve[]: 0 0 72057594037927865 72057594037927865 72057594037927865 [ 238.361888] Node 0 Normal free:193448kB min:99395541895224kB low:73886371836733356kB high:147673348131571488kB reB [ 238.364765] lowmem_reserve[]: 0 0 0 0 0 [ 238.365101] Node 0 DMA: 7*4kB (U) 5*8kB (UE) 6*16kB (UME) 2*32kB (UM) 1*64kB (U) 2*128kB (UE) 3*256kB (UME) 2*512B [ 238.366379] Node 0 DMA32: 0*4kB 1*8kB (U) 2*16kB (UM) 2*32kB (UM) 2*64kB (UM) 1*128kB (U) 1*256kB (U) 1*512kB (U)B [ 238.367654] Node 0 Normal: 1985*4kB (UME) 1321*8kB (UME) 844*16kB (UME) 524*32kB (UME) 300*64kB (UME) 138*128kB (B [ 238.369184] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 238.369915] 130 total pagecache pages [ 238.370241] 0 pages in swap cache [ 238.370533] Swap cache stats: add 0, delete 0, find 0/0 [ 238.370981] Free swap = 0kB [ 238.371239] Total swap = 0kB [ 238.371488] 1048445 pages RAM [ 238.371756] 0 pages HighMem/MovableOnly [ 238.372090] 306992 pages reserved [ 238.372376] 0 pages cma reserved [ 238.372661] 0 pages hwpoisoned In another instance (older kernel), I was able to observe this (negative page count :/): [ 180.896971] Offlined Pages 32768 [ 182.667462] Offlined Pages 32768 [ 184.408117] Offlined Pages 32768 [ 186.026321] Offlined Pages 32768 [ 187.684861] Offlined Pages 32768 [ 189.227013] Offlined Pages 32768 [ 190.830303] Offlined Pages 32768 [ 190.833071] Built 1 zonelists, mobility grouping on. Total pages: -36920272750453009 In another instance (older kernel), I was no longer able to start any process: [root@vm ~]# [ 214.348068] Offlined Pages 32768 [ 215.973009] Offlined Pages 32768 cat /proc/meminfo -bash: fork: Cannot allocate memory [root@vm ~]# cat /proc/meminfo -bash: fork: Cannot allocate memory Fix it by properly adjusting the managed page count when migrating if the zone changed. The managed page count of the zones now looks after unplug of the DIMM (and after deflating the balloon) just like before inflating the balloon (and plugging+onlining the DIMM). We'll temporarily modify the totalram page count. If this ever becomes a problem, we can fine tune by providing helpers that don't touch the totalram pages (e.g., adjust_zone_managed_page_count()). Please note that fixing up the managed page count is only necessary when we adjusted the managed page count when inflating - only if we don't have VIRTIO_BALLOON_F_DEFLATE_ON_OOM. With that feature, the managed page count is not touched when inflating/deflating. Reported-by: Yumei Huang Fixes: 3dcc0571cd64 ("mm: correctly update zone->managed_pages") Cc: # v3.11+ Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Jiang Liu Cc: Andrew Morton Cc: Igor Mammedov Cc: virtualization@lists.linux-foundation.org Signed-off-by: David Hildenbrand Signed-off-by: Michael S. Tsirkin commit b444268801a29b10c9edea037efcf4c7c4db9283 Author: Arnaldo Carvalho de Melo Date: Wed Dec 11 10:06:45 2019 -0300 tools headers kvm: Sync linux/kvm.h with the kernel sources To pick up the changes from: 22945688acd4 ("KVM: PPC: Book3S HV: Support reset of secure guest") No tools changes are caused by this, as the only defines so far used from these files are for syscall arg pretty printing are: $ grep KVM tools/perf/trace/beauty/*.sh tools/perf/trace/beauty/kvm_ioctl.sh:regex='^#[[:space:]]*define[[:space:]]+KVM_(\w+)[[:space:]]+_IO[RW]*\([[:space:]]*KVMIO[[:space:]]*,[[:space:]]*(0x[[:xdigit:]]+).*' $ This addresses these tools/perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Adrian Hunter Cc: Bharata B Rao Cc: Jiri Olsa Cc: Namhyung Kim Cc: Paul Mackerras Link: https://lkml.kernel.org/n/tip-bdbe4x02johhul05a03o27zj@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 761bfc33dd7504de951aa7b9db27a3cc5df1fde6 Merge: 0f60a0bcc1b9 6794862a16ef Author: Arnaldo Carvalho de Melo Date: Wed Dec 11 09:58:16 2019 -0300 Merge remote-tracking branch 'torvalds/master' into perf/urgent To pick up BPF fixes to allow a clean 'make -C tools/perf build-test': 7c3977d1e804 libbpf: Fix sym->st_value print on 32-bit arches 1fd450f99272 libbpf: Fix up generation of bpf_helper_defs.h Signed-off-by: Arnaldo Carvalho de Melo commit 5b79bcdf03628a3a9ee04d9cd5fabcf61a8e20be Author: Toke Høiland-Jørgensen Date: Tue Dec 10 19:14:12 2019 +0100 bpftool: Don't crash on missing jited insns or ksyms When the kptr_restrict sysctl is set, the kernel can fail to return jited_ksyms or jited_prog_insns, but still have positive values in nr_jited_ksyms and jited_prog_len. This causes bpftool to crash when trying to dump the program because it only checks the len fields not the actual pointers to the instructions and ksyms. Fix this by adding the missing checks. Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool") Fixes: f84192ee00b7 ("tools: bpftool: resolve calls without using imm field") Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20191210181412.151226-1-toke@redhat.com commit 4c80c7bc583a87ded5f61906f81256b57c795806 Author: Arnd Bergmann Date: Tue Dec 10 21:35:46 2019 +0100 bpf: Fix build in minimal configurations, again Building with -Werror showed another failure: kernel/bpf/btf.c: In function 'btf_get_prog_ctx_type.isra.31': kernel/bpf/btf.c:3508:63: error: array subscript 0 is above array bounds of 'u8[0]' {aka 'unsigned char[0]'} [-Werror=array-bounds] ctx_type = btf_type_member(conv_struct) + bpf_ctx_convert_map[prog_type] * 2; I don't actually understand why the array is empty, but a similar fix has addressed a related problem, so I suppose we can do the same thing here. Fixes: ce27709b8162 ("bpf: Fix build in minimal configurations") Signed-off-by: Arnd Bergmann Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20191210203553.2941035-1-arnd@arndb.de commit e49e6f6db04e915dccb494ae10fa14888fea6f89 Author: Paul Chaignon Date: Mon Dec 9 19:52:52 2019 +0100 bpf, mips: Limit to 33 tail calls All BPF JIT compilers except RISC-V's and MIPS' enforce a 33-tail calls limit at runtime. In addition, a test was recently added, in tailcalls2, to check this limit. This patch updates the tail call limit in MIPS' JIT compiler to allow 33 tail calls. Fixes: b6bd53f9c4e8 ("MIPS: Add missing file for eBPF JIT.") Reported-by: Mahshid Khezri Signed-off-by: Paul Chaignon Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/b8eb2caac1c25453c539248e56ca22f74b5316af.1575916815.git.paul.chaignon@gmail.com commit 96bc4432f5ade1045521f3b247f516b1478166bd Author: Paul Chaignon Date: Mon Dec 9 19:52:07 2019 +0100 bpf, riscv: Limit to 33 tail calls All BPF JIT compilers except RISC-V's and MIPS' enforce a 33-tail calls limit at runtime. In addition, a test was recently added, in tailcalls2, to check this limit. This patch updates the tail call limit in RISC-V's JIT compiler to allow 33 tail calls. I tested it using the above selftest on an emulated RISCV64. Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G") Reported-by: Mahshid Khezri Signed-off-by: Paul Chaignon Signed-off-by: Daniel Borkmann Acked-by: Björn Töpel Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/966fe384383bf23a0ee1efe8d7291c78a3fb832b.1575916815.git.paul.chaignon@gmail.com commit 653997eeecef95c3ead4fba1b2d27e6a5854d6cd Author: Ran Bi Date: Wed Dec 11 17:43:54 2019 +0800 rtc: mt6397: fix alarm register overwrite Alarm registers high byte was reserved for other functions. This add mask in alarm registers operation functions. This also fix error condition in interrupt handler. Fixes: fc2979118f3f ("rtc: mediatek: Add MT6397 RTC driver") Signed-off-by: Ran Bi Signed-off-by: Hsin-Hsiung Wang Link: https://lore.kernel.org/r/1576057435-3561-6-git-send-email-hsin-hsiung.wang@mediatek.com Signed-off-by: Alexandre Belloni commit a40c94be2336f3002563c9ae16572143ae3422e2 Author: Paul Cercueil Date: Tue Dec 10 17:55:45 2019 +0100 dmaengine: dma-jz4780: Also break descriptor chains on JZ4725B It turns out that the JZ4725B displays the same buggy behaviour as the JZ4740 that was described in commit f4c255f1a747 ("dmaengine: dma-jz4780: Break descriptor chains on JZ4740"). Work around it by using the same workaround previously used for the JZ4740. Fixes commit f4c255f1a747 ("dmaengine: dma-jz4780: Break descriptor chains on JZ4740") Cc: Signed-off-by: Paul Cercueil Link: https://lore.kernel.org/r/20191210165545.59690-1-paul@crapouillou.net Signed-off-by: Vinod Koul commit 6f7c41374b62fd80bbd8aae3536c43688c54d95e Author: Tetsuo Handa Date: Mon Nov 25 10:46:51 2019 +0900 tomoyo: Don't use nifty names on sockets. syzbot is reporting that use of SOCKET_I()->sk from open() can result in use after free problem [1], for socket's inode is still reachable via /proc/pid/fd/n despite destruction of SOCKET_I()->sk already completed. At first I thought that this race condition applies to only open/getattr permission checks. But James Morris has pointed out that there are more permission checks where this race condition applies to. Thus, get rid of tomoyo_get_socket_name() instead of conditionally bypassing permission checks on sockets. As a side effect of this patch, "socket:[family=\$:type=\$:protocol=\$]" in the policy files has to be rewritten to "socket:[\$]". [1] https://syzkaller.appspot.com/bug?id=73d590010454403d55164cca23bd0565b1eb3b74 Signed-off-by: Tetsuo Handa Reported-by: syzbot Reported-by: James Morris commit 53a256a9b925b47c7e67fc1f16ca41561a7b877c Author: Lukas Wunner Date: Thu Dec 5 12:54:49 2019 +0100 dmaengine: Fix access to uninitialized dma_slave_caps dmaengine_desc_set_reuse() allocates a struct dma_slave_caps on the stack, populates it using dma_get_slave_caps() and then accesses one of its members. However dma_get_slave_caps() may fail and this isn't accounted for, leading to a legitimate warning of gcc-4.9 (but not newer versions): In file included from drivers/spi/spi-bcm2835.c:19:0: drivers/spi/spi-bcm2835.c: In function 'dmaengine_desc_set_reuse': >> include/linux/dmaengine.h:1370:10: warning: 'caps.descriptor_reuse' is used uninitialized in this function [-Wuninitialized] if (caps.descriptor_reuse) { Fix it, thereby also silencing the gcc-4.9 warning. The issue has been present for 4 years but surfaces only now that the first caller of dmaengine_desc_set_reuse() has been added in spi-bcm2835.c. Another user of reusable DMA descriptors has existed for a while in pxa_camera.c, but it sets the DMA_CTRL_REUSE flag directly instead of calling dmaengine_desc_set_reuse(). Nevertheless, tag this commit for stable in case there are out-of-tree users. Fixes: 272420214d26 ("dmaengine: Add DMA_CTRL_REUSE") Reported-by: kbuild test robot Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v4.3+ Link: https://lore.kernel.org/r/ca92998ccc054b4f2bfd60ef3adbab2913171eac.1575546234.git.lukas@wunner.de Signed-off-by: Vinod Koul commit 2688302bf1924ebccab2a3b298dd50b4f744d48d Author: Andy Shevchenko Date: Mon Dec 9 14:35:44 2019 +0200 gpio: pca953x: Switch to bitops in IRQ callbacks Since we have driver converted to use bitmap API we must use traditional bit operations (set_bit(), clear_bit(), etc.) against it. Currently IRQ callbacks are missed in the conversion and thus broken. Let's fix it right here right now. Fixes: 35d13d94893f ("gpio: pca953x: convert to use bitmap API") Signed-off-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 256efaea1fdc4e38970489197409a26125ee0aaa Author: Russell King Date: Sat Dec 7 16:20:18 2019 +0000 gpiolib: fix up emulated open drain outputs gpiolib has a corner case with open drain outputs that are emulated. When such outputs are outputting a logic 1, emulation will set the hardware to input mode, which will cause gpiod_get_direction() to report that it is in input mode. This is different from the behaviour with a true open-drain output. Unify the semantics here. Cc: Suggested-by: Linus Walleij Signed-off-by: Russell King Signed-off-by: Bartosz Golaszewski commit 44fe5cb32c7599a4059931a98794e0418619aa96 Author: Andy Shevchenko Date: Wed Dec 4 14:31:35 2019 +0200 MAINTAINERS: Append missed file to the database When gpiolib.h internal header had been split to few, the commit 77cb907abe6c ("gpiolib: acpi: Split ACPI stuff to gpiolib-acpi.h") in particular missed the MAINTAINERS database update. Do it here. Fixes: 77cb907abe6c ("gpiolib: acpi: Split ACPI stuff to gpiolib-acpi.h") Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Bartosz Golaszewski commit 961f8209c8d5ef5d33da42e6656d7c8179899da0 Author: Michael Walle Date: Tue Dec 10 00:43:46 2019 +0100 arm64: dts: ls1028a: fix typo in TMU calibration data The temperature sensor may jump backwards because there is a wrong calibration value. Both values have to be monotonically increasing. Fix it. This was tested on a custom board. Fixes: 571cebfe8e2b ("arm64: dts: ls1028a: Add Thermal Monitor Unit node") Signed-off-by: Michael Walle Acked-by: Tang Yuantian Signed-off-by: Shawn Guo commit 9cc7a18bcbd47e82960a059127497ab09c4abd05 Author: Arnd Bergmann Date: Tue Dec 10 20:54:01 2019 +0100 gpio: xgs-iproc: remove __exit annotation for iproc_gpio_remove When built into the kernel, the driver causes a link problem: `iproc_gpio_remove' referenced in section `.data' of drivers/gpio/gpio-xgs-iproc.o: defined in discarded section `.exit.text' of drivers/gpio/gpio-xgs-iproc.o Remove the incorrect annotation. Fixes: 6a41b6c5fc20 ("gpio: Add xgs-iproc driver") Signed-off-by: Arnd Bergmann Reviewed-by: Chris Packham Signed-off-by: Bartosz Golaszewski commit 11e299de3aced4ea23a9fb1fef6c983c8d516302 Author: Arnd Bergmann Date: Tue Dec 10 21:28:31 2019 +0100 gpio: aspeed: avoid return type warning gcc has a hard time tracking whether BUG_ON(1) ends execution or not: drivers/gpio/gpio-aspeed-sgpio.c: In function 'bank_reg': drivers/gpio/gpio-aspeed-sgpio.c:112:1: error: control reaches end of non-void function [-Werror=return-type] Use the simpler BUG() that gcc knows cannot continue. Fixes: f8b410e3695a ("gpio: aspeed-sgpio: Rename and add Kconfig/Makefile") Signed-off-by: Arnd Bergmann Acked-by: Andrew Jeffery Signed-off-by: Bartosz Golaszewski commit bc7bc688366a4f2544699e40cce45393b7f24408 Author: Kent Gibson Date: Wed Dec 11 08:46:31 2019 +0800 gpio: mockup: Fix usage of new GPIO_LINE_DIRECTION Restore the external behavior of gpio-mockup to what it was prior to the change to using GPIO_LINE_DIRECTION. Fixes: e42615ec233b ("gpio: Use new GPIO_LINE_DIRECTION") Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski commit 6d44694dc7c72e82e0f45d114a9c9e3f3e2aeab7 Author: Zhenyu Wang Date: Mon Dec 2 15:01:08 2019 +0800 drm/i915/gvt: use vgpu lock for active state setting Need to align with deactivate, should only use vgpu's lock for active state setting instead of gvt lock. Fixes: f25a49ab8ab9 ("drm/i915/gvt: Use vgpu_lock to protect per vgpu access") Cc: Colin Xu Reviewed-by: Colin Xu Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20191202070109.73924-2-zhenyuw@linux.intel.com commit f8c63edfd78905320e86b6b2be2b7a5ac768fa4e Author: Fredrik Noring Date: Tue Dec 10 18:29:05 2019 +0100 USB: Fix incorrect DMA allocations for local memory pool drivers Fix commit 7b81cb6bddd2 ("usb: add a HCD_DMA flag instead of guestimating DMA capabilities") where local memory USB drivers erroneously allocate DMA memory instead of pool memory, causing OHCI Unrecoverable Error, disabled HC died; cleaning up The order between hcd_uses_dma() and hcd->localmem_pool is now arranged as in hcd_buffer_alloc() and hcd_buffer_free(), with the test for hcd->localmem_pool placed first. As an alternative, one might consider adjusting hcd_uses_dma() with static inline bool hcd_uses_dma(struct usb_hcd *hcd) { - return IS_ENABLED(CONFIG_HAS_DMA) && (hcd->driver->flags & HCD_DMA); + return IS_ENABLED(CONFIG_HAS_DMA) && + (hcd->driver->flags & HCD_DMA) && + (hcd->localmem_pool == NULL); } One can also consider unsetting HCD_DMA for local memory pool drivers. Fixes: 7b81cb6bddd2 ("usb: add a HCD_DMA flag instead of guestimating DMA capabilities") Cc: stable Signed-off-by: Fredrik Noring Link: https://lore.kernel.org/r/20191210172905.GA52526@sx9 Signed-off-by: Greg Kroah-Hartman commit 8c9312a925ad859daefd0f443ef3b6dc7157d881 Author: Wolfram Sang Date: Wed Nov 6 22:21:01 2019 +0100 i2c: add helper to check if a client has a driver attached As a preparation for an API conversion, factor out something frequently used in the media subsystem. As an improvement, it bails out on both, NULL and ERRPTR to handle the old and new API. Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit c3a5fd15ed0c1494435e4e35fbee734ae46b5073 Author: Peng Fan Date: Mon Dec 9 08:19:55 2019 +0000 clk: imx: pll14xx: fix clk_pll14xx_wait_lock The usage of readl_poll_timeout is wrong, the 3rd parameter(cond) should be "val & LOCK_STATUS" not "val & LOCK_TIMEOUT_US", It is not check whether the pll locked, LOCK_STATUS reflects the mask, not LOCK_TIMEOUT_US. Fixes: 8646d4dcc7fb ("clk: imx: Add PLLs driver for imx8mm soc") Cc: Reviewed-by: Abel Vesa Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 125ad46f3861520fdebd15c38e4bc412a7add01c Author: Christoph Niedermaier Date: Thu Dec 5 09:38:51 2019 +0000 ARM: imx: Correct ocotp id for serial number support of i.MX6ULL/ULZ SoCs After the commit 8267ff89b713 ("ARM: imx: Add serial number support for i.MX6/7 SoCs") the kernel doesn't start on i.MX6ULL/ULZ SoC. Tested on next-20191205. For i.MX6ULL/ULZ the variable "ocotp_compat" is set to "fsl,imx6ul-ocotp", but with commit ffbc34bf0e9c ("nvmem: imx-ocotp: Implement i.MX6ULL/ULZ support") and commit f243bc821ee3 ("ARM: dts: imx6ull: Fix i.MX6ULL/ULZ ocotp compatible") the value "fsl,imx6ull-ocotp" is already defined and set in device tree... By setting "ocotp_compat" to "fsl,imx6ull-ocotp" the kernel does boot. Fixes: 8267ff89b713 ("ARM: imx: Add serial number support for i.MX6/7 SoCs") Signed-off-by: Christoph Niedermaier Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 346da4d2c7ea39de65487b249aaa4733317a40ec Author: Flavio Leitner Date: Thu Dec 5 03:03:44 2019 +0100 sched/cputime, proc/stat: Fix incorrect guest nice cpustat value The value being used for guest_nice should be CPUTIME_GUEST_NICE and not CPUTIME_USER. Fixes: 26dae145a76c ("procfs: Use all-in-one vtime aware kcpustat accessor") Signed-off-by: Flavio Leitner Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Link: https://lkml.kernel.org/r/20191205020344.14940-1-frederic@kernel.org Signed-off-by: Ingo Molnar commit 5815bdfd7f54739be9abed1301d55f5e74d7ad1f Author: Hui Wang Date: Wed Dec 11 13:13:21 2019 +0800 ALSA: hda/realtek - Line-out jack doesn't work on a Dell AIO After applying the fixup ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, the Line-out jack works well. And instead of adding a new set of pin definition in the pin_fixup_tbl, we put a more generic matching entry in the fallback_pin_fixup_tbl. Cc: Signed-off-by: Hui Wang Link: https://lore.kernel.org/r/20191211051321.5883-1-hui.wang@canonical.com Signed-off-by: Takashi Iwai commit 24dee0c7478d1a1e00abdf5625b7f921467325dc Author: Netanel Belgazal Date: Tue Dec 10 11:27:44 2019 +0000 net: ena: fix napi handler misbehavior when the napi budget is zero In netpoll the napi handler could be called with budget equal to zero. Current ENA napi handler doesn't take that into consideration. The napi handler handles Rx packets in a do-while loop. Currently, the budget check happens only after decrementing the budget, therefore the napi handler, in rare cases, could run over MAX_INT packets. In addition to that, this moves all budget related variables to int calculation and stop mixing u32 to avoid ambiguity Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller commit f1ce0a155723cc41d814b350b0e01998f82f7ec1 Merge: ac397934b39f 31e4ccc99eda Author: David S. Miller Date: Tue Dec 10 17:45:04 2019 -0800 Merge branch 'tipc-fix-some-issues' Tuong Lien says: ==================== tipc: fix some issues This series consists of some bug-fixes for TIPC. ==================== Signed-off-by: David S. Miller commit 31e4ccc99eda8a5a7e6902c98bee6e78ffd3edb9 Author: Tuong Lien Date: Tue Dec 10 15:21:05 2019 +0700 tipc: fix use-after-free in tipc_disc_rcv() In the function 'tipc_disc_rcv()', the 'msg_peer_net_hash()' is called to read the header data field but after the message skb has been freed, that might result in a garbage value... This commit fixes it by defining a new local variable to store the data first, just like the other header fields' handling. Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns") Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller commit abc9b4e0549b93fdaff56e9532bc49a2d7b04955 Author: Tuong Lien Date: Tue Dec 10 15:21:04 2019 +0700 tipc: fix retrans failure due to wrong destination When a user message is sent, TIPC will check if the socket has faced a congestion at link layer. If that happens, it will make a sleep to wait for the congestion to disappear. This leaves a gap for other users to take over the socket (e.g. multi threads) since the socket is released as well. Also, in case of connectionless (e.g. SOCK_RDM), user is free to send messages to various destinations (e.g. via 'sendto()'), then the socket's preformatted header has to be updated correspondingly prior to the actual payload message building. Unfortunately, the latter action is done before the first action which causes a condition issue that the destination of a certain message can be modified incorrectly in the middle, leading to wrong destination when that message is built. Consequently, when the message is sent to the link layer, it gets stuck there forever because the peer node will simply reject it. After a number of retransmission attempts, the link is eventually taken down and the retransmission failure is reported. This commit fixes the problem by rearranging the order of actions to prevent the race condition from occurring, so the message building is 'atomic' and its header will not be modified by anyone. Fixes: 365ad353c256 ("tipc: reduce risk of user starvation during link congestion") Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller commit dca4a17d24ee9d878836ce5eb8dc25be1ffa5729 Author: Tuong Lien Date: Tue Dec 10 15:21:03 2019 +0700 tipc: fix potential hanging after b/rcast changing In commit c55c8edafa91 ("tipc: smooth change between replicast and broadcast"), we allow instant switching between replicast and broadcast by sending a dummy 'SYN' packet on the last used link to synchronize packets on the links. The 'SYN' message is an object of link congestion also, so if that happens, a 'SOCK_WAKEUP' will be scheduled to be sent back to the socket... However, in that commit, we simply use the same socket 'cong_link_cnt' counter for both the 'SYN' & normal payload message sending. Therefore, if both the replicast & broadcast links are congested, the counter will be not updated correctly but overwritten by the latter congestion. Later on, when the 'SOCK_WAKEUP' messages are processed, the counter is reduced one by one and eventually overflowed. Consequently, further activities on the socket will only wait for the false congestion signal to disappear but never been met. Because sending the 'SYN' message is vital for the mechanism, it should be done anyway. This commit fixes the issue by marking the message with an error code e.g. 'TIPC_ERR_NO_PORT', so its sending should not face a link congestion, there is no need to touch the socket 'cong_link_cnt' either. In addition, in the event of any error (e.g. -ENOBUFS), we will purge the entire payload message queue and make a return immediately. Fixes: c55c8edafa91 ("tipc: smooth change between replicast and broadcast") Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller commit d5162f341e9625d00a275d5cbe55432e6627c3bf Author: Tuong Lien Date: Tue Dec 10 15:21:02 2019 +0700 tipc: fix name table rbtree issues The current rbtree for service ranges in the name table is built based on the 'lower' & 'upper' range values resulting in a flaw in the rbtree searching. Some issues have been observed in case of range overlapping: Case #1: unable to withdraw a name entry: After some name services are bound, all of them are withdrawn by user but one remains in the name table forever. This corrupts the table and that service becomes dummy i.e. no real port. E.g. / {22, 22} / / ---> {10, 50} / \ / \ {10, 30} {20, 60} The node {10, 30} cannot be removed since the rbtree searching stops at the node's ancestor i.e. {10, 50}, so starting from it will never reach the finding node. Case #2: failed to send data in some cases: E.g. Two service ranges: {20, 60}, {10, 50} are bound. The rbtree for this service will be one of the two cases below depending on the order of the bindings: {20, 60} {10, 50} <-- / \ / \ / \ / \ {10, 50} NIL <-- NIL {20, 60} (a) (b) Now, try to send some data to service {30}, there will be two results: (a): Failed, no route to host. (b): Ok. The reason is that the rbtree searching will stop at the pointing node as shown above. Case #3: Same as case #2b above but if the data sending's scope is local and the {10, 50} is published by a peer node, then it will result in 'no route to host' even though the other {20, 60} is for example on the local node which should be able to get the data. The issues are actually due to the way we built the rbtree. This commit fixes it by introducing an additional field to each node - named 'max', which is the largest 'upper' of that node subtree. The 'max' value for each subtrees will be propagated correctly whenever a node is inserted/ removed or the tree is rebalanced by the augmented rbtree callbacks. By this way, we can change the rbtree searching appoarch to solve the issues above. Another benefit from this is that we can now improve the searching for a next range matching e.g. in case of multicast, so get rid of the unneeded looping over all nodes in the tree. Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller commit ac397934b39f93cf6340b5a10aa3426b8242efab Merge: 868afbaca1e2 7e334fc8003c Author: David S. Miller Date: Tue Dec 10 17:37:14 2019 -0800 Merge branch 'bnxt_en-Error-recovery-fixes' Michael Chan says: ==================== bnxt_en: Error recovery fixes. This patch series contains fixes mostly for the error recovery feature and related areas. Please queue the series for -stable also. Thanks. ==================== Signed-off-by: David S. Miller commit 7e334fc8003c7a38372cc98e7be6082670a47d29 Author: Vasundhara Volam Date: Tue Dec 10 02:49:13 2019 -0500 bnxt_en: Add missing devlink health reporters for VFs. The VF driver also needs to create the health reporters since VFs are also involved in firmware reset and recovery. Modify bnxt_dl_register() and bnxt_dl_unregister() so that they can be called by the VFs to register/unregister devlink. Only the PF will register the devlink parameters. With devlink registered, we can now create the health reporters on the VFs. Fixes: 6763c779c2d8 ("bnxt_en: Add new FW devlink_health_reporter") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 937f188c1f4f89b3fa93ba31fc8587dc1fb14a22 Author: Vasundhara Volam Date: Tue Dec 10 02:49:12 2019 -0500 bnxt_en: Fix the logic that creates the health reporters. Fix the logic to properly check the fw capabilities and create the devlink health reporters only when needed. The current code creates the reporters unconditionally as long as bp->fw_health is valid, and that's not correct. Call bnxt_dl_fw_reporters_create() directly from the init and reset code path instead of from bnxt_dl_register(). This allows the reporters to be adjusted when capabilities change. The same applies to bnxt_dl_fw_reporters_destroy(). Fixes: 6763c779c2d8 ("bnxt_en: Add new FW devlink_health_reporter") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 0797c10d2d1fa0d6f14612404781b348fc757c3e Author: Vasundhara Volam Date: Tue Dec 10 02:49:11 2019 -0500 bnxt_en: Remove unnecessary NULL checks for fw_health After fixing the allocation of bp->fw_health in the previous patch, the driver will not go through the fw reset and recovery code paths if bp->fw_health allocation fails. So we can now remove the unnecessary NULL checks. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 8280b38e01f71e0f89389ccad3fa43b79e57c604 Author: Vasundhara Volam Date: Tue Dec 10 02:49:10 2019 -0500 bnxt_en: Fix bp->fw_health allocation and free logic. bp->fw_health needs to be allocated for either the firmware initiated reset feature or the driver initiated error recovery feature. The current code is not allocating bp->fw_health for all the necessary cases. This patch corrects the logic to allocate bp->fw_health correctly when needed. If allocation fails, we clear the feature flags. We also add the the missing kfree(bp->fw_health) when the driver is unloaded. If we get an async reset message from the firmware, we also need to make sure that we have a valid bp->fw_health before proceeding. Fixes: 07f83d72d238 ("bnxt_en: Discover firmware error recovery capabilities.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit c74751f4c39232c31214ec6a3bc1c7e62f5c728b Author: Vasundhara Volam Date: Tue Dec 10 02:49:09 2019 -0500 bnxt_en: Return error if FW returns more data than dump length If any change happened in the configuration of VF in VM while collecting live dump, there could be a race and firmware can return more data than allocated dump length. Fix it by keeping track of the accumulated core dump length copied so far and abort the copy with error code if the next chunk of core dump will exceed the original dump length. Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 325f85f37e5b35807d86185bdf2c64d2980c44ba Author: Michael Chan Date: Tue Dec 10 02:49:08 2019 -0500 bnxt_en: Free context memory in the open path if firmware has been reset. This will trigger new context memory to be rediscovered and allocated during the re-probe process after a firmware reset. Without this, the newly reset firmware does not have valid context memory and the driver will eventually fail to allocate some resources. Fixes: ec5d31e3c15d ("bnxt_en: Handle firmware reset status during IF_UP.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 0c722ec0a289c7f6b53f89bad1cfb7c4db3f7a62 Author: Michael Chan Date: Tue Dec 10 02:49:07 2019 -0500 bnxt_en: Fix MSIX request logic for RDMA driver. The logic needs to check both bp->total_irqs and the reserved IRQs in hw_resc->resv_irqs if applicable and see if both are enough to cover the L2 and RDMA requested vectors. The current code is only checking bp->total_irqs and can fail in some code paths, such as the TX timeout code path with the RDMA driver requesting vectors after recovery. In this code path, we have not reserved enough MSIX resources for the RDMA driver yet. Fixes: 75720e6323a1 ("bnxt_en: Keep track of reserved IRQs.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 10d59345578a116042c1a5d737a18234aaf3e0e6 Author: Jens Axboe Date: Mon Dec 9 20:16:22 2019 -0700 io_uring: add sockets to list of files that support non-blocking issue In chasing a performance issue between using IORING_OP_RECVMSG and IORING_OP_READV on sockets, tracing showed that we always punt the socket reads to async offload. This is due to io_file_supports_async() not checking for S_ISSOCK on the inode. Since sockets supports the O_NONBLOCK (or MSG_DONTWAIT) flag just fine, add sockets to the list of file types that we can do a non-blocking issue to. Signed-off-by: Jens Axboe commit ebfcd8955c0b52eb793bcbc9e71140e3d0cdb228 Author: Jens Axboe Date: Mon Dec 9 20:58:56 2019 -0700 net: make socket read/write_iter() honor IOCB_NOWAIT The socket read/write helpers only look at the file O_NONBLOCK. not the iocb IOCB_NOWAIT flag. This breaks users like preadv2/pwritev2 and io_uring that rely on not having the file itself marked nonblocking, but rather the iocb itself. Cc: netdev@vger.kernel.org Acked-by: David Miller Signed-off-by: Jens Axboe commit 53108d476a105ab2597d7a4e6040b127829391b5 Author: Jens Axboe Date: Mon Dec 9 20:12:38 2019 -0700 io_uring: only hash regular files for async work execution We hash regular files to avoid having multiple threads hammer on the inode mutex, but it should not be needed on other types of files (like sockets). Signed-off-by: Jens Axboe commit 4a0a7a187453e65bdd24b9ede045b4c36b958868 Author: Jens Axboe Date: Mon Dec 9 20:01:01 2019 -0700 io_uring: run next sqe inline if possible One major use case of linked commands is the ability to run the next link inline, if at all possible. This is done correctly for async offload, but somewhere along the line we lost the ability to do so when we were able to complete a request without having to punt it. Ensure that we do so correctly. Signed-off-by: Jens Axboe commit 392edb45b24337eaa0bc1ecd4e3cf897e662ec61 Author: Jens Axboe Date: Mon Dec 9 17:52:20 2019 -0700 io_uring: don't dynamically allocate poll data This essentially reverts commit e944475e6984. For high poll ops workloads, like TAO, the dynamic allocation of the wait_queue entry for IORING_OP_POLL_ADD adds considerable extra overhead. Go back to embedding the wait_queue_entry, but keep the usage of wait->private for the pointer stashing. Signed-off-by: Jens Axboe commit d96885658d9971fc2c752b8699f17a42ef745db6 Author: Jens Axboe Date: Mon Dec 9 19:35:20 2019 -0700 io_uring: deferred send/recvmsg should assign iov Don't just assign it from the main call path, that can miss the case when we're called from issue deferral. Signed-off-by: Jens Axboe commit 8a4955ff1cca7d4da480774034a16e7c28bafec8 Author: Jens Axboe Date: Mon Dec 9 14:52:35 2019 -0700 io_uring: sqthread should grab ctx->uring_lock for submissions We use the mutex to guard against registered file updates, for instance. Ensure we're safe in accessing that state against concurrent updates. Signed-off-by: Jens Axboe commit e995d5123ed433e37a8d63ac528737c912592e3d Author: Jens Axboe Date: Sat Dec 7 21:06:46 2019 -0700 io-wq: briefly spin for new work after finishing work To avoid going to sleep only to get woken shortly thereafter, spin briefly for new work upon completion of work. Signed-off-by: Jens Axboe commit 506d95ff5d6aa0a099a116c49d3884e29801d843 Author: Jens Axboe Date: Sat Dec 7 21:03:59 2019 -0700 io-wq: remove worker->wait waitqueue We only have one cases of using the waitqueue to wake the worker, the rest are using wake_up_process(). Since we can save some cycles not fiddling with the waitqueue io_wqe_worker(), switch the work activation to task wakeup and get rid of the now unused wait_queue_head_t in struct io_worker. Signed-off-by: Jens Axboe commit 4e88d6e7793f2f445f43bd608828541d7f43b608 Author: Jens Axboe Date: Sat Dec 7 20:59:47 2019 -0700 io_uring: allow unbreakable links Some commands will invariably end in a failure in the sense that the completion result will be less than zero. One such example is timeouts that don't have a completion count set, they will always complete with -ETIME unless cancelled. For linked commands, we sever links and fail the rest of the chain if the result is less than zero. Since we have commands where we know that will happen, add IOSQE_IO_HARDLINK as a stronger link that doesn't sever regardless of the completion result. Note that the link will still sever if we fail submitting the parent request, hard links are only resilient in the presence of completion results for requests that did submit correctly. Cc: stable@vger.kernel.org # v5.4 Reviewed-by: Pavel Begunkov Reported-by: 李通洲 Signed-off-by: Jens Axboe commit c571b72e2b845ca0519670cb7c4b5fe5f56498a5 Author: Davidlohr Bueso Date: Tue Dec 10 14:05:23 2019 -0800 Revert "locking/mutex: Complain upon mutex API misuse in IRQ contexts" This ended up causing some noise in places such as rxrpc running in softirq. The warning is misleading in this case as the mutex trylock and unlock operations are done within the same context; and therefore we need not worry about the PI-boosting issues that comes along with no single-owner lock guarantees. While we don't want to support this in mutexes, there is no way out of this yet; so lets get rid of the WARNs for now, as it is only fair to code that has historically relied on non-preemptible softirq guarantees. In addition, changing the lock type is also unviable: exclusive rwsems have the same issue (just not the WARN_ON) and counting semaphores would introduce a performance hit as mutexes are a lot more optimized. This reverts: a0855d24fc22: ("locking/mutex: Complain upon mutex API misuse in IRQ contexts") Fixes: a0855d24fc22: ("locking/mutex: Complain upon mutex API misuse in IRQ contexts") Signed-off-by: Davidlohr Bueso Tested-by: David Howells Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-afs@lists.infradead.org Cc: linux-fsdevel@vger.kernel.org Cc: will@kernel.org Link: https://lkml.kernel.org/r/20191210220523.28540-1-dave@stgolabs.net Signed-off-by: Ingo Molnar commit b0142d66f4edb8578b7772d6d7ad731836b82ddb Author: Rafael J. Wysocki Date: Tue Dec 10 12:48:35 2019 +0100 cpuidle: Fix cpuidle_driver_state_disabled() It turns out that cpuidle_driver_state_disabled() can be called before registering the cpufreq driver on some platforms, which was not expected when it was introduced and which leads to a NULL pointer dereference when trying to walk the CPUs associated with the given cpuidle driver. Fix the problem by making cpuidle_driver_state_disabled() check if the driver's mask of CPUs associated with it is present and to set CPUIDLE_FLAG_UNUSABLE for the given idle state in the driver's states list if that is not the case to cause __cpuidle_register_device() to set CPUIDLE_STATE_DISABLED_BY_DRIVER for that state for all cpuidle devices registered by it later. Fixes: cbda56d5fefc ("cpuidle: Introduce cpuidle_driver_state_disabled() for driver quirks") Reported-by: Daniel Lezcano Tested-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 07b67280037303845f480590986549b266cb3ad6 Author: Arnd Bergmann Date: Tue Dec 10 20:59:24 2019 +0100 drm/amd/display: include linux/slab.h where needed Calling kzalloc() and related functions requires the linux/slab.h header to be included: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn21/dcn21_resource.c: In function 'dcn21_ipp_create': drivers/gpu/drm/amd/amdgpu/../display/dc/dcn21/dcn21_resource.c:679:3: error: implicit declaration of function 'kzalloc'; did you mean 'd_alloc'? [-Werror=implicit-function-declaration] kzalloc(sizeof(struct dcn10_ipp), GFP_KERNEL); A lot of other headers also miss a direct include in this file, but this is the only one that causes a problem for now. Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit 3ac61258599b5abe45d97b926d44a79262385bae Author: Randy Dunlap Date: Sun Dec 8 20:35:38 2019 -0800 i2c: fix header file kernel-doc warning Fix kernel-doc warning in . ../include/linux/i2c.h:337: warning: Function parameter or member 'init_irq' not described in 'i2c_client' Signed-off-by: Randy Dunlap Signed-off-by: Wolfram Sang commit 2c2f00ab1641895183488ff2bce53c415344fb87 Author: Wolfram Sang Date: Fri Dec 6 01:23:22 2019 +0100 i2c: remove i2c_new_dummy() API All in-kernel users have been converted to {devm_}i2c_new_dummy_device(). Remove the old API. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Tested-by: Luca Ceresoli Reviewed-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 1f00534a764aed160652770e0c0a63657c231fde Author: Arnd Bergmann Date: Tue Dec 10 21:30:46 2019 +0100 drm/amd/display: fix undefined struct member reference An initialization was added for two optional struct members. One of these is always present in the dcn20_resource file, but the other one depends on CONFIG_DRM_AMD_DC_DSC_SUPPORT and causes a build failure if that is missing: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_resource.c:926:14: error: excess elements in struct initializer [-Werror] .num_dsc = 5, Add another #ifdef around the assignment. Fixes: c3d03c5a196f ("drm/amd/display: Include num_vmid and num_dsc within NV14's resource caps") Reviewed-by: Zhan Liu Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit 3d519d6d388ba4f9a75d0e0b6f60d890987bc096 Author: Kuninori Morimoto Date: Mon Nov 25 16:16:21 2019 +0900 sh: kgdb: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following error: LINUX/arch/sh/kernel/kgdb.c: In function 'kgdb_arch_handle_exception': LINUX/arch/sh/kernel/kgdb.c:267:6: error: this statement may fall through [-Werror=implicit-fallthrough=] if (kgdb_hex2long(&ptr, &addr)) ^ LINUX/arch/sh/kernel/kgdb.c:269:2: note: here case 'D': ^~~~ Signed-off-by: Kuninori Morimoto Acked-by: Daniel Thompson Signed-off-by: Gustavo A. R. Silva commit 30e647a764d446723a7e0fb08d209e0104f16173 Author: Stefan Wahren Date: Sat Nov 30 13:31:13 2019 +0100 ARM: dts: bcm283x: Fix critical trip point During definition of the CPU thermal zone of BCM283x SoC family there was a misunderstanding of the meaning "criticial trip point" and the thermal throttling range of the VideoCore firmware. The latter one takes effect when the core temperature is at least 85 degree celsius or higher So the current critical trip point doesn't make sense, because the thermal shutdown appears before the firmware has a chance to throttle the ARM core(s). Fix these unwanted shutdowns by increasing the critical trip point to a value which shouldn't be reached with working thermal throttling. Fixes: 0fe4d2181cc4 ("ARM: dts: bcm283x: Add CPU thermal zone with 1 trip point") Signed-off-by: Stefan Wahren Signed-off-by: Florian Fainelli commit ff205766dbbee024a4a716638868d98ffb17748a Author: Alexei Starovoitov Date: Sun Dec 8 16:01:12 2019 -0800 ftrace: Fix function_graph tracer interaction with BPF trampoline Depending on type of BPF programs served by BPF trampoline it can call original function. In such case the trampoline will skip one stack frame while returning. That will confuse function_graph tracer and will cause crashes with bad RIP. Teach graph tracer to skip functions that have BPF trampoline attached. Signed-off-by: Alexei Starovoitov Signed-off-by: Steven Rostedt (VMware) commit a61f810567be0ef101d8bbb65b89ffeac7d62103 Author: YueHaibing Date: Sat Dec 7 11:44:09 2019 +0800 tracing: remove set but not used variable 'buffer' kernel/trace/trace_events_inject.c: In function trace_inject_entry: kernel/trace/trace_events_inject.c:20:22: warning: variable buffer set but not used [-Wunused-but-set-variable] It is never used, so remove it. Link: http://lkml.kernel.org/r/20191207034409.25668-1-yuehaibing@huawei.com Reported-by: Hulk Robot Acked-by: Cong Wang Signed-off-by: YueHaibing Signed-off-by: Steven Rostedt (VMware) commit af74262337faa65d5ac2944553437d3f5fb29123 Author: Steven Rostedt (VMware) Date: Mon Dec 9 10:33:30 2019 -0500 module: Remove accidental change of module_enable_x() When pulling in Divya Indi's patch, I made a minor fix to remove unneeded braces. I commited my fix up via "git commit -a --amend". Unfortunately, I didn't realize I had some changes I was testing in the module code, and those changes were applied to Divya's patch as well. This reverts the accidental updates to the module code. Cc: Jessica Yu Cc: Divya Indi Reported-by: Peter Zijlstra Fixes: e585e6469d6f ("tracing: Verify if trace array exists before destroying it.") Signed-off-by: Steven Rostedt (VMware) commit 6e8aeda224c83c7c7841e143d410b6d0e7bda05e Author: Lukas Wunner Date: Tue Dec 10 14:39:50 2019 +0100 ALSA: hda/hdmi - Fix duplicate unref of pci_dev Nicholas Johnson reports a null pointer deref as well as a refcount underflow upon hot-removal of a Thunderbolt-attached AMD eGPU. He's bisected the issue down to commit 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD"). The commit iterates over PCI devices using pci_get_class() and unreferences each device found, even though pci_get_class() subsequently unreferences the device as well. Fix it. Fixes: 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD") Link: https://lore.kernel.org/r/PSXP216MB0438BFEAA0617283A834E11580580@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM/ Reported-and-tested-by: Nicholas Johnson Signed-off-by: Lukas Wunner Reviewed-by: Alex Deucher Cc: Mika Westerberg Cc: Alexander Deucher Cc: Bjorn Helgaas Link: https://lore.kernel.org/r/77aa6c01aefe1ebc4004e87b0bc714f2759f15c4.1575985006.git.lukas@wunner.de Signed-off-by: Takashi Iwai commit e00b59d30506dc9ef91caf2f3c584209cc9f61e4 Author: Tony Lindgren Date: Mon Dec 9 13:41:17 2019 -0800 ARM: omap2plus_defconfig: Add back DEBUG_FS Commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") removed select for DEBUG_FS but we still need it at least for enabling deeper idle states for the SoCs. Signed-off-by: Tony Lindgren commit 90d79edc57a5625b9adaf397719e3a760b051167 Author: Grygorii Strashko Date: Wed Dec 4 19:45:33 2019 +0200 ARM: omap2plus_defconfig: enable NET_SWITCHDEV The TI_CPSW_SWITCHDEV definition in Kconfig was changed from "select NET_SWITCHDEV" to "depends on NET_SWITCHDEV", and therefore it is required to explicitelly enable NET_SWITCHDEV config option in omap2plus_defconfig. Fixes: 3727d259ddaf ("arm: omap2plus_defconfig: enable new cpsw switchdev driver") Signed-off-by: Grygorii Strashko Signed-off-by: Tony Lindgren commit c842b8c4ff9859f750447f3ca08f64b2ed23cebc Author: Mans Rullgard Date: Sun Dec 1 17:07:06 2019 +0000 ARM: dts: am335x-sancloud-bbe: fix phy mode The phy mode should be rgmii-id. For some reason, it used to work with rgmii-txid but doesn't any more. Signed-off-by: Mans Rullgard Signed-off-by: Tony Lindgren commit 93c60483b5feefced92b869d5f97769495bc6313 Author: Tony Lindgren Date: Mon Dec 9 13:55:15 2019 -0800 bus: ti-sysc: Fix missing force mstandby quirk handling Commit 03856e928b0e ("bus: ti-sysc: Handle mstandby quirk and use it for musb") added quirk handling for mstandby quirk but did not consider that we also need a quirk variant for SYSC_QUIRK_FORCE_MSTANDBY. We need to use forced idle mode for both SYSC_QUIRK_SWSUP_MSTANDBY and SYSC_QUIRK_FORCE_MSTANDBY, but SYSC_QUIRK_SWSUP_MSTANDBY also need to additionally also configure no-idle mode when enabled. Fixes: 03856e928b0e ("bus: ti-sysc: Handle mstandby quirk and use it for musb") Signed-off-by: Tony Lindgren commit 7fc979f8204fb763e203d3e716c17d352eb96b35 Author: Eric Biggers Date: Fri Dec 6 19:59:21 2019 -0800 docs: dm-integrity: remove reference to ARC4 ARC4 is no longer considered secure, so it shouldn't be used, even as just an example. Signed-off-by: Eric Biggers Signed-off-by: Mike Snitzer commit 35c6cb41686c4de03d738fd95617a0cf7441bbe1 Author: Amir Goldstein Date: Mon Nov 25 11:51:25 2019 +0200 docs: filesystems: overlayfs: Fix restview warnings Fix only the obvious problems [SzM: add SPDX license line] Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 5356ab06448556a456c7991cbd0fc8234ef84ad0 Author: Amir Goldstein Date: Mon Nov 25 11:51:25 2019 +0200 docs: filesystems: overlayfs: Rename overlayfs.txt to .rst It is already formatted as RST. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 6889ee5a53b8d969aa542047f5ac8acdc0e79a91 Author: Amir Goldstein Date: Fri Dec 6 08:33:36 2019 +0200 ovl: relax WARN_ON() on rename to self In ovl_rename(), if new upper is hardlinked to old upper underneath overlayfs before upper dirs are locked, user will get an ESTALE error and a WARN_ON will be printed. Changes to underlying layers while overlayfs is mounted may result in unexpected behavior, but it shouldn't crash the kernel and it shouldn't trigger WARN_ON() either, so relax this WARN_ON(). Reported-by: syzbot+bb1836a212e69f8e201a@syzkaller.appspotmail.com Fixes: 804032fabb3b ("ovl: don't check rename to self") Cc: # v4.9+ Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 9c6d8f13e9da10a26ad7f0a020ef86e8ef142835 Author: Amir Goldstein Date: Sun Nov 17 17:43:44 2019 +0200 ovl: fix corner case of non-unique st_dev;st_ino On non-samefs overlay without xino, non pure upper inodes should use a pseudo_dev assigned to each unique lower fs and pure upper inodes use the real upper st_dev. It is fine for an overlay pure upper inode to use the same st_dev;st_ino values as the real upper inode, because the content of those two different filesystem objects is always the same. In this case, however: - two filesystems, A and B - upper layer is on A - lower layer 1 is also on A - lower layer 2 is on B Non pure upper overlay inode, whose origin is in layer 1 will have the same st_dev;st_ino values as the real lower inode. This may result with a false positive results of 'diff' between the real lower and copied up overlay inode. Fix this by using the upper st_dev;st_ino values in this case. This breaks the property of constant st_dev;st_ino across copy up of this case. This breakage will be fixed by a later patch. Fixes: 5148626b806a ("ovl: allocate anon bdev per unique lower fs") Cc: stable@vger.kernel.org # v4.17+ Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit ec7bbb53d339250df7d4b042ff93c468535c0a90 Author: Amir Goldstein Date: Fri Nov 15 13:33:04 2019 +0200 ovl: don't use a temp buf for encoding real fh We can allocate maximum fh size and encode into it directly. Suggested-by: Al Viro Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit cbe7fba8edfc8cb8e621599e376f8ac5c224fa72 Author: Amir Goldstein Date: Fri Nov 15 13:33:03 2019 +0200 ovl: make sure that real fid is 32bit aligned in memory Seprate on-disk encoding from in-memory and on-wire resresentation of overlay file handle. In-memory and on-wire we only ever pass around pointers to struct ovl_fh, which encapsulates at offset 3 the on-disk format struct ovl_fb. struct ovl_fb encapsulates at offset 21 the real file handle. That makes sure that the real file handle is always 32bit aligned in-memory when passed down to the underlying filesystem. On-disk format remains the same and store/load are done into correctly aligned buffer. New nfs exported file handles are exported with aligned real fid. Old nfs file handles are copied to an aligned buffer before being decoded. Reported-by: Al Viro Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 7e63c87fc2dcf3be9d3aab82d4a0ea085880bdca Author: Amir Goldstein Date: Thu Nov 14 22:28:41 2019 +0200 ovl: fix lookup failure on multi lower squashfs In the past, overlayfs required that lower fs have non null uuid in order to support nfs export and decode copy up origin file handles. Commit 9df085f3c9a2 ("ovl: relax requirement for non null uuid of lower fs") relaxed this requirement for nfs export support, as long as uuid (even if null) is unique among all lower fs. However, said commit unintentionally also relaxed the non null uuid requirement for decoding copy up origin file handles, regardless of the unique uuid requirement. Amend this mistake by disabling decoding of copy up origin file handle from lower fs with a conflicting uuid. We still encode copy up origin file handles from those fs, because file handles like those already exist in the wild and because they might provide useful information in the future. There is an unhandled corner case described by Miklos this way: - two filesystems, A and B, both have null uuid - upper layer is on A - lower layer 1 is also on A - lower layer 2 is on B In this case bad_uuid won't be set for B, because the check only involves the list of lower fs. Hence we'll try to decode a layer 2 origin on layer 1 and fail. We will deal with this corner case later. Reported-by: Colin Ian King Tested-by: Colin Ian King Link: https://lore.kernel.org/lkml/20191106234301.283006-1-colin.king@canonical.com/ Fixes: 9df085f3c9a2 ("ovl: relax requirement for non null uuid ...") Cc: stable@vger.kernel.org # v4.20+ Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 4bcd9eae731083bb724faf68cce6021213308333 Author: Andy Shevchenko Date: Thu Nov 21 16:02:07 2019 +0200 fbtft: Fix the initialization from property algorithm When converting to device property API the commit 8b2d3aeeb7ec ("fbtft: Make use of device property API") mistakenly placed the reading of the first value inside the loop, that jumps over value after initialization sequence or sleep commands. Move the above mentioned reading outside of the loop to restore correct behaviour. Besides that, we are using pre-increment operation which may lead to out of the boundary access at the end of sequence. Thus, allocate buffer with an additional element at the end to prevent out of the boundary access. Fixes: 8b2d3aeeb7ec ("fbtft: Make use of device property API") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191121140207.65089-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit eecd37e105f0137af0d1b726bf61ff35d1d7d2eb Author: Guenter Roeck Date: Tue Dec 3 12:58:52 2019 -0800 drivers: Fix boot problem on SuperH SuperH images crash too eearly to display any console output. Bisect points to commit 507fd01d5333 ("drivers: move the early platform device support to arch/sh"). An analysis of that patch suggests that early_platform_cleanup() is now called at the wrong time. Restoring its call point fixes the problem. Cc: Bartosz Golaszewski Fixes: 507fd01d5333 ("drivers: move the early platform device support to arch/sh") Tested-by: Geert Uytterhoeven Signed-off-by: Guenter Roeck Acked-by: Rob Landley Link: https://lore.kernel.org/r/20191203205852.15659-1-linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman commit 111bf02b8f544f98de53ea1f912ae01f598b161b Author: Chen-Yu Tsai Date: Thu Dec 5 16:50:54 2019 +0800 rtc: sun6i: Add support for RTC clocks on R40 When support for the R40 in the rtc-sun6i driver was split out for a separate compatible string, only the RTC half was covered, and not the clock half. Unfortunately this results in the whole driver not working, as the RTC half expects the clock half to have been initialized. Add support for the clock part as well. The clock part is like the H3, but does not need to export the internal oscillator, nor does it have a gateable LOSC external output. This fixes issues with WiFi and Bluetooth not working on the BPI M2U. Fixes: d6624cc75021 ("rtc: sun6i: Add R40 compatible") Cc: # 5.3.x Signed-off-by: Chen-Yu Tsai Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20191205085054.6049-1-wens@kernel.org Signed-off-by: Alexandre Belloni commit 4e64ba3fd181b207c00d392b27ed484b89108dce Author: Amery Song Date: Mon Dec 9 18:48:54 2019 -0600 ASoC: Intel: common: work-around incorrect ACPI HID for CML boards On CML boards with the RT5682 headset codec and RT1011 speaker amplifier, the platform firmware exposes three ACPI HIDs (10EC5682, 10EC1011 and MX98357A). The last HID is a mistake in DSDT tables, which causes the wrong machine driver to be loaded. This patch changes the key used to identify boards and changes the order of entries in the table to load the correct machine driver. The order does matter and should not be modified to work-around this firmware issue. Signed-off-by: Amery Song Signed-off-by: Keyon Jie Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191210004854.16845-9-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit f84337c3fb8ff4d533ccbed0d2db4e8587d0ff58 Author: Curtis Malainey Date: Mon Dec 9 18:48:52 2019 -0600 ASoC: SOF: Intel: split cht and byt debug window sizes Turns out SSP 3-5 are only available on cht, to avoid dumping on undefined registers let's split the definition. Signed-off-by: Curtis Malainey Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191210004854.16845-7-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 6bb03c21e4bfee29e48e480ee4ca7cb1e12f587c Author: Karol Trzcinski Date: Mon Dec 9 18:48:49 2019 -0600 ASoC: SOF: loader: fix snd_sof_fw_parse_ext_data An error occurs during parsing more than one ext_data from the mailbox, because of invalid data offset handling. Fix by removing the incorrect duplicate increment of the offset. The return value is also reset in the switch case. This does not change the behavior but improves readability - there is no longer a need to check what the return value of get_ext_windows is. Signed-off-by: Karol Trzcinski Signed-off-by: Bartosz Kokoszko Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191210004854.16845-4-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 8edc95667646a75f0fc97e08ecb180581fdff300 Author: Karol Trzcinski Date: Mon Dec 9 18:48:48 2019 -0600 ASoC: SOF: loader: snd_sof_fw_parse_ext_data log warning on unknown header Added warning log when found some unknown FW boot ext header, to improve debuggability. Signed-off-by: Karol Trzcinski Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191210004854.16845-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 5525cf07d15f7c7eab619707627c31aa8e39dff1 Author: Daniel Baluta Date: Mon Dec 9 15:53:53 2019 +0200 ASoC: simple-card: Don't create separate link when platform is present In normal sound case all DAIs are detected as CPU-Codec. simple_dai_link_of supports the presence of a platform but it counts it as a CPU DAI resulting in the creation of an extra link. Adding a platform property to a link description like: simple-audio-card,dai-link { cpu { sound-dai = <&sai1>; }; plat { sound-dai = <&dsp>; }; codec { sound-dai = <&wm8960>; } will result in the creation of two links: * sai1 <-> wm8960 * dsp <-> wm8960 which is obviously not what we want. We just want one single link with: * sai1 <-> wm8960 (and platform set to dsp). Signed-off-by: Daniel Baluta Acked-by: Kuninori Morimoto Link: https://lore.kernel.org/r/20191209135353.17427-1-daniel.baluta@nxp.com Signed-off-by: Mark Brown commit a3039aef52d9ffeb67e9211899cd3e8a2953a01f Author: Dragos Tarcatu Date: Mon Dec 9 18:39:39 2019 -0600 ASoC: topology: Check return value for soc_tplg_pcm_create() The return value of soc_tplg_pcm_create() is currently not checked in soc_tplg_pcm_elems_load(). If an error is to occur there, the topology ignores it and continues loading. Fix that by checking the status and rejecting the topology on error. Reviewed-by: Ranjani Sridharan Signed-off-by: Dragos Tarcatu Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191210003939.15752-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 76d2703649321c296df7ec0dafd50add96215de4 Author: Dragos Tarcatu Date: Mon Dec 9 18:39:38 2019 -0600 ASoC: topology: Check return value for snd_soc_add_dai_link() snd_soc_add_dai_link() might fail. This situation occurs for instance in a very specific use case where a PCM device and a Back End DAI link are given identical names in the topology. When this happens, soc_new_pcm_runtime() fails and then snd_soc_add_dai_link() returns -ENOMEM when called from soc_tplg_fe_link_create(). Because of that, the link will not get added into the card list, so any attempt to remove it later ends up in a panic. Fix that by checking the return status and free the memory in case of an error. Reviewed-by: Ranjani Sridharan Signed-off-by: Dragos Tarcatu Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191210003939.15752-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit e5b5da96da50ef30abb39cb9f694e99366404d24 Author: EJ Hsu Date: Tue Dec 3 23:34:56 2019 -0800 usb: gadget: fix wrong endpoint desc Gadget driver should always use config_ep_by_speed() to initialize usb_ep struct according to usb device's operating speed. Otherwise, usb_ep struct may be wrong if usb devcie's operating speed is changed. The key point in this patch is that we want to make sure the desc pointer in usb_ep struct will be set to NULL when gadget is disconnected. This will force it to call config_ep_by_speed() to correctly initialize usb_ep struct based on the new operating speed when gadget is re-connected later. Reviewed-by: Peter Chen Signed-off-by: EJ Hsu Signed-off-by: Felipe Balbi commit 51ba8b3a0e1ab5240e6ed5b73995d0cf16b05b52 Author: Saravana Kannan Date: Mon Dec 9 11:31:19 2019 -0800 of/platform: Unconditionally pause/resume sync state during kernel init Commit 5e6669387e22 ("of/platform: Pause/resume sync state during init and of_platform_populate()") paused/resumed sync state during init only if Linux had parsed and populated a devicetree. However, the check for that (of_have_populated_dt()) can change after of_platform_default_populate_init() executes. One example of this is when devicetree unittests are enabled. This causes an unmatched pause/resume of sync state. To avoid this, just unconditionally pause/resume sync state during init. Fixes: 5e6669387e22 ("of/platform: Pause/resume sync state during init and of_platform_populate()") Reported-by: kernel test robot Signed-off-by: Saravana Kannan Reviewed-by: Frank Rowand Link: https://lore.kernel.org/r/20191209193119.147056-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 2d7b78f59e020b07fc6338eefe286f54ee2d6773 Author: Thinh Nguyen Date: Wed Nov 27 13:10:54 2019 -0800 usb: dwc3: ep0: Clear started flag on completion Clear ep0's DWC3_EP_TRANSFER_STARTED flag if the END_TRANSFER command is completed. Otherwise, we can't start control transfer again after END_TRANSFER. Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi commit d3abda5a98a18e524e17fd4085c9f4bd53e9ef53 Author: Thinh Nguyen Date: Wed Nov 27 13:10:47 2019 -0800 usb: dwc3: gadget: Clear started flag for non-IOC Normally the END_TRANSFER command completion handler will clear the DWC3_EP_TRANSFER_STARTED flag. However, if the command was sent without interrupt on completion, then the flag will not be cleared. Make sure to clear the flag in this case. Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi commit 8c7d4b7b3d43c54c0b8c1e4adb917a151c754196 Author: Tejas Joglekar Date: Wed Nov 13 11:45:16 2019 +0530 usb: dwc3: gadget: Fix logical condition This patch corrects the condition to kick the transfer without giving back the requests when either request has remaining data or when there are pending SGs. The && check was introduced during spliting up the dwc3_gadget_ep_cleanup_completed_requests() function. Fixes: f38e35dd84e2 ("usb: dwc3: gadget: split dwc3_gadget_ep_cleanup_completed_requests()") Cc: stable@vger.kernel.org Signed-off-by: Tejas Joglekar Signed-off-by: Felipe Balbi commit c724f776f048538ecfdf53a52b7a522309f5c504 Author: Johan Hovold Date: Tue Dec 10 12:47:51 2019 +0100 staging: rtl8712: fix interface sanity check Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel") Cc: stable # 2.6.37 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20191210114751.5119-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 74ca34118a0e05793935d804ccffcedd6eb56596 Author: Johan Hovold Date: Tue Dec 10 12:47:50 2019 +0100 staging: rtl8188eu: fix interface sanity check Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: c2478d39076b ("staging: r8188eu: Add files for new driver - part 20") Cc: stable # 3.12 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20191210114751.5119-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 09068c1ad53fb077bdac288869dec2435420bdc4 Author: Johan Hovold Date: Tue Dec 10 12:25:58 2019 +0100 USB: atm: ueagle-atm: add missing endpoint check Make sure that the interrupt interface has an endpoint before trying to access its endpoint descriptors to avoid dereferencing a NULL pointer. The driver binds to the interrupt interface with interface number 0, but must not assume that this interface or its current alternate setting are the first entries in the corresponding configuration arrays. Fixes: b72458a80c75 ("[PATCH] USB: Eagle and ADI 930 usb adsl modem driver") Cc: stable # 2.6.16 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20191210112601.3561-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3c11c4bed02b202e278c0f5c319ae435d7fb9815 Author: Johan Hovold Date: Tue Dec 10 12:25:59 2019 +0100 USB: adutux: fix interface sanity check Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 03270634e242 ("USB: Add ADU support for Ontrak ADU devices") Cc: stable # 2.6.19 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20191210112601.3561-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 59920635b89d74b9207ea803d5e91498d39e8b69 Author: Johan Hovold Date: Tue Dec 10 12:26:00 2019 +0100 USB: idmouse: fix interface sanity checks Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20191210112601.3561-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7c5a2df3367a2c4984f1300261345817d95b71f8 Author: Johan Hovold Date: Tue Dec 10 12:26:01 2019 +0100 USB: serial: io_edgeport: fix epic endpoint lookup Make sure to use the current alternate setting when looking up the endpoints on epic devices to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver") Cc: stable # 2.6.21 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20191210112601.3561-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3d1890ef8023e61934e070021b06cc9f417260c0 Author: Ben Skeggs Date: Tue Dec 10 12:15:44 2019 +1000 drm/nouveau/kms/nv50-: fix panel scaling Under certain circumstances, encoder atomic_check() can be entered without adjusted_mode having been reset to the same as mode, which confuses the scaling logic and can lead to a misprogrammed display. Fix this by checking against the user-provided mode directly. Link: https://bugs.freedesktop.org/show_bug.cgi?id=108615 Link: https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/issues/464 Signed-off-by: Ben Skeggs commit ae5769d4670982bc483885b120b557a9ffd57527 Author: Lyude Paul Date: Fri Nov 15 16:07:20 2019 -0500 drm/nouveau/kms/nv50-: Limit MST BPC to 8 Noticed this while working on some unrelated CRC stuff. Currently, userspace has very little support for BPCs higher than 8. While this doesn't matter for most things, on MST topologies we need to be careful about ensuring that we do our best to make any given display configuration fit within the bandwidth restraints of the topology, since otherwise less people's monitor configurations will work. Allowing for BPC settings higher than 8 dramatically increases the required bandwidth for displays in most configurations, and consequently makes it a lot less likely that said display configurations will pass the atomic check. In the future we want to fix this correctly by making it so that we adjust the bpp for each display in a topology to be as high as possible, while making sure to lower the bpp of each display in the event that we run out of bandwidth and need to rerun our atomic check. But for now, follow the behavior that both i915 and amdgpu are sticking to. Signed-off-by: Lyude Paul Fixes: 232c9eec417a ("drm/nouveau: Use atomic VCPI helpers for MST") Cc: Ben Skeggs Cc: Daniel Vetter Cc: David Airlie Cc: Jerry Zuo Cc: Harry Wentland Cc: Juston Li Cc: Sam Ravnborg Cc: Sean Paul Cc: # v5.1+ Signed-off-by: Ben Skeggs commit ac2d9275f371346922b31a388bbaa6a54f1154a4 Author: Lyude Paul Date: Fri Nov 15 16:07:19 2019 -0500 drm/nouveau/kms/nv50-: Store the bpc we're using in nv50_head_atom In order to be able to use bpc values that are different from what the connector reports, we want to be able to store the bpc value we decide on using for an atomic state in nv50_head_atom and refer to that instead of simply using the value that the connector reports throughout the whole atomic check phase and commit phase. This will let us (eventually) implement the max bpc connector property, and will also be needed for limiting the bpc we use on MST displays to 8 in the next commit. Signed-off-by: Lyude Paul Fixes: 232c9eec417a ("drm/nouveau: Use atomic VCPI helpers for MST") Cc: Ben Skeggs Cc: Daniel Vetter Cc: David Airlie Cc: Jerry Zuo Cc: Harry Wentland Cc: Juston Li Cc: Sean Paul Cc: Laurent Pinchart Cc: # v5.1+ Signed-off-by: Ben Skeggs commit 310d35771ee9040f5744109fc277206ad96ba253 Author: Lyude Paul Date: Fri Nov 15 16:07:18 2019 -0500 drm/nouveau/kms/nv50-: Call outp_atomic_check_view() before handling PBN Since nv50_outp_atomic_check_view() can set crtc_state->mode_changed, we probably should be calling it before handling any PBN changes. Just a precaution. Signed-off-by: Lyude Paul Fixes: 232c9eec417a ("drm/nouveau: Use atomic VCPI helpers for MST") Cc: Ben Skeggs Cc: Daniel Vetter Cc: David Airlie Cc: Jerry Zuo Cc: Harry Wentland Cc: Juston Li Cc: Sean Paul Cc: Laurent Pinchart Cc: # v5.1+ Signed-off-by: Ben Skeggs commit 64d17f25dcad518461ccf0c260544e1e379c5b35 Author: Hans de Goede Date: Thu Oct 24 10:52:53 2019 +0200 drm/nouveau: Fix drm-core using atomic code-paths on pre-nv50 hardware We do not support atomic modesetting on pre-nv50 hardware, but until now our connector code was setting drm_connector->state on pre-nv50 hardware. This causes the core to enter atomic modesetting paths in at least: 1. drm_connector_get_encoder(), returning connector->state->best_encoder which is always 0, causing us to always report 0 as encoder_id in the drmModeConnector struct returned by drmModeGetConnector(). 2. drm_encoder_get_crtc(), returning NULL because uses_atomic get set, causing us to always report 0 as crtc_id in the drmModeEncoder struct returned by drmModeGetEncoder() Which in turn confuses userspace, at least plymouth thinks that the pipe has changed because of this and tries to reconfigure it unnecessarily. More in general we should not set drm_connector->state in the non-atomic code as this violates the drm-core's expectations. This commit fixes this by using a nouveau_conn_atom struct embedded in the nouveau_connector struct for property handling in the non-atomic case. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1706557 Signed-off-by: Hans de Goede Signed-off-by: Ben Skeggs commit 37a68eab4cd92b507c9e8afd760fdc18e4fecac6 Author: Hans de Goede Date: Thu Oct 24 10:52:52 2019 +0200 drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit Place the declaration of struct nouveau_conn_atom above that of struct nouveau_connector. This commit makes no changes to the moved block what so ever, it just moves it up a bit. This is a preparation patch to fix some issues with connector handling on pre nv50 displays (which do not use atomic modesetting). Signed-off-by: Hans de Goede Reviewed-by: Lyude Paul Signed-off-by: Ben Skeggs commit a470552ee8965da0fe6fd4df0aa39c4cda652c7c Author: Ard Biesheuvel Date: Tue Dec 10 10:09:45 2019 +0100 efi: Don't attempt to map RCI2 config table if it doesn't exist Commit: 1c5fecb61255aa12 ("efi: Export Runtime Configuration Interface table to sysfs") ... added support for a Dell specific UEFI configuration table, but failed to take into account that mapping the table should not be attempted unless the table actually exists. If it doesn't exist, the code usually fails silently unless pr_debug() prints are enabled. However, on 32-bit PAE x86, the splat below is produced due to the attempt to map the placeholder value EFI_INVALID_TABLE_ADDR which we use for non-existing UEFI configuration tables, and which equals ULONG_MAX. memremap attempted on mixed range 0x00000000ffffffff size: 0x1e WARNING: CPU: 1 PID: 1 at kernel/iomem.c:81 memremap+0x1a3/0x1c0 Modules linked in: CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.4.2-smp-mine #1 Hardware name: Hewlett-Packard HP Z400 Workstation/0B4Ch, BIOS 786G3 v03.61 03/05/2018 EIP: memremap+0x1a3/0x1c0 ... Call Trace: ? map_properties+0x473/0x473 ? efi_rci2_sysfs_init+0x2c/0x154 ? map_properties+0x473/0x473 ? do_one_initcall+0x49/0x1d4 ? parse_args+0x1e8/0x2a0 ? do_early_param+0x7a/0x7a ? kernel_init_freeable+0x139/0x1c2 ? rest_init+0x8e/0x8e ? kernel_init+0xd/0xf2 ? ret_from_fork+0x2e/0x38 Fix this by checking whether the table exists before attempting to map it. Reported-by: Richard Narron Tested-by: Richard Narron Signed-off-by: Ard Biesheuvel Cc: linux-efi@vger.kernel.org Fixes: 1c5fecb61255aa12 ("efi: Export Runtime Configuration Interface table to sysfs") Link: https://lkml.kernel.org/r/20191210090945.11501-2-ardb@kernel.org Signed-off-by: Ingo Molnar commit db23808615e29d9a04f96806cac56f78b0fee0ef Author: Geert Uytterhoeven Date: Wed Nov 20 15:59:26 2019 +0100 reset: Do not register resource data for missing resets When an optional reset is not present, __devm_reset_control_get() and devm_reset_control_array_get() still register resource data to release the non-existing reset on cleanup, which is futile. Fix this by skipping NULL reset control pointers. Signed-off-by: Geert Uytterhoeven Signed-off-by: Philipp Zabel commit 723c0011c7f6992f57e2c629fa9c89141acc115f Author: Geert Uytterhoeven Date: Wed Nov 20 15:26:13 2019 +0100 reset: Fix {of,devm}_reset_control_array_get kerneldoc return types of_reset_control_array_get() and devm_reset_control_array_get() return struct reset_control pointers, not internal struct reset_control_array pointers, just like all other reset control API calls. Correct the kerneldoc to match the code. Fixes: 17c82e206d2a3cd8 ("reset: Add APIs to manage array of resets") Signed-off-by: Geert Uytterhoeven Signed-off-by: Philipp Zabel commit ce89d8d3a70fa530e16f0b0f8994385a214cd0c0 Author: Florian Fainelli Date: Mon Nov 4 10:15:02 2019 -0800 reset: brcmstb: Remove resource checks The use of IS_ALIGNED() is incorrect, the typical resource we pass looks like this: start: 0x8404318, size: 0x30. When using IS_ALIGNED() we will get the following 0x8404318 & (0x18 - 1) = 0x10 which is definitively not equal to 0, same goes with the size. These two checks would make the driver fail probing. Remove the resource checks, since there should be no constraint on the base addresse or size. Fixes: 77750bc089e4 ("reset: Add Broadcom STB SW_INIT reset controller driver") Signed-off-by: Florian Fainelli Signed-off-by: Philipp Zabel commit 392a9f63058f2cdcec8363b849a25532ee40da9f Author: Florian Fainelli Date: Mon Nov 4 10:15:01 2019 -0800 dt-bindings: reset: Fix brcmstb-reset example The reset controller has a #reset-cells value of 1, so we should see a phandle plus a register identifier, fix the example. Fixes: 0807caf647dd ("dt-bindings: reset: Add document for Broadcom STB reset controller") Signed-off-by: Florian Fainelli Signed-off-by: Philipp Zabel commit 19e6317d24c25ee737c65d1ffb7483bdda4bb54a Author: Pete Zaitcev Date: Wed Dec 4 20:39:41 2019 -0600 usb: mon: Fix a deadlock in usbmon between mmap and read The problem arises because our read() function grabs a lock of the circular buffer, finds something of interest, then invokes copy_to_user() straight from the buffer, which in turn takes mm->mmap_sem. In the same time, the callback mon_bin_vma_fault() is invoked under mm->mmap_sem. It attempts to take the fetch lock and deadlocks. This patch does away with protecting of our page list with any semaphores, and instead relies on the kernel not close the device while mmap is active in a process. In addition, we prohibit re-sizing of a buffer while mmap is active. This way, when (now unlocked) fault is processed, it works with the page that is intended to be mapped-in, and not some other random page. Note that this may have an ABI impact, but hopefully no legitimate program is this wrong. Signed-off-by: Pete Zaitcev Reported-by: syzbot+56f9673bb4cdcbeb0e92@syzkaller.appspotmail.com Reviewed-by: Alan Stern Fixes: 46eb14a6e158 ("USB: fix usbmon BUG trigger") Cc: Link: https://lore.kernel.org/r/20191204203941.3503452b@suzdal.zaitcev.lan Signed-off-by: Greg Kroah-Hartman commit 59120962e4be4f72be537adb17da6881c4b3797c Author: Bryan O'Donoghue Date: Thu Nov 28 13:43:57 2019 +0000 usb: common: usb-conn-gpio: Don't log an error on probe deferral This patch makes the printout of the error message for failing to get a VBUS regulator handle conditional on the error code being something other than -EPROBE_DEFER. Deferral is a normal thing, we don't need an error message for this. Cc: Chunfeng Yun Cc: Nagarjuna Kristam Cc: Linus Walleij Cc: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org Signed-off-by: Bryan O'Donoghue Cc: stable Link: https://lore.kernel.org/r/20191128134358.3880498-2-bryan.odonoghue@linaro.org Signed-off-by: Greg Kroah-Hartman commit 1cd17f7f0def31e3695501c4f86cd3faf8489840 Author: Emiliano Ingrassia Date: Wed Nov 27 17:03:55 2019 +0100 usb: core: urb: fix URB structure initialization function Explicitly initialize URB structure urb_list field in usb_init_urb(). This field can be potentially accessed uninitialized and its initialization is coherent with the usage of list_del_init() in usb_hcd_unlink_urb_from_ep() and usb_giveback_urb_bh() and its explicit initialization in usb_hcd_submit_urb() error path. Signed-off-by: Emiliano Ingrassia Cc: stable Link: https://lore.kernel.org/r/20191127160355.GA27196@ingrassia.epigenesys.com Signed-off-by: Greg Kroah-Hartman commit 5c388abefda0d92355714010c0199055c57ab6c7 Author: Wen Yang Date: Tue Nov 26 22:04:52 2019 +0800 usb: typec: fix use after free in typec_register_port() We can't use "port->sw" and/or "port->mux" after it has been freed. Fixes: 23481121c81d ("usb: typec: class: Don't use port parent for getting mux handles") Signed-off-by: Wen Yang Cc: stable Cc: linux-usb@vger.kernel.org Cc: linux-kernel@vger.kernel.org Acked-by: Heikki Krogerus  Link: https://lore.kernel.org/r/20191126140452.14048-1-wenyang@linux.alibaba.com Signed-off-by: Greg Kroah-Hartman commit 1848a543191ae32e558bb0a5974ae7c38ebd86fc Author: Wen Yang Date: Sun Nov 24 22:22:36 2019 +0800 usb: roles: fix a potential use after free Free the sw structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 5c54fcac9a9d ("usb: roles: Take care of driver module reference counting") Signed-off-by: Wen Yang Reviewed-by: Heikki Krogerus Reviewed-by: Peter Chen Cc: stable Cc: Hans de Goede Cc: Chunfeng Yun Cc: Suzuki K Poulose Cc: linux-usb@vger.kernel.org Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/20191124142236.25671-1-wenyang@linux.alibaba.com Signed-off-by: Greg Kroah-Hartman commit f26a9e959a7b1588c59f7a919b41b67175b211d8 Author: Chris Wilson Date: Mon Dec 9 02:32:15 2019 +0000 drm/i915/gt: Detect if we miss WaIdleLiteRestore In order to avoid confusing the HW, we must never submit an empty ring during lite-restore, that is we should always advance the RING_TAIL before submitting to stay ahead of the RING_HEAD. Normally this is prevented by keeping a couple of spare NOPs in the request->wa_tail so that on resubmission we can advance the tail. This relies on the request only being resubmitted once, which is the normal condition as it is seen once for ELSP[1] and then later in ELSP[0]. On preemption, the requests are unwound and the tail reset back to the normal end point (as we know the request is incomplete and therefore its RING_HEAD is even earlier). However, if this w/a should fail we would try and resubmit the request with the RING_TAIL already set to the location of this request's wa_tail potentially causing a GPU hang. We can spot when we do try and incorrectly resubmit without advancing the RING_TAIL and spare any embarrassment by forcing the context restore. In the case of preempt-to-busy, we leave the requests running on the HW while we unwind. As the ring is still live, we cannot rewind our rq->tail without forcing a reload so leave it set to rq->wa_tail and only force a reload if we resubmit after a lite-restore. (Normally, the forced reload will be a part of the preemption event.) Fixes: 22b7a426bbe1 ("drm/i915/execlists: Preempt-to-busy") Closes: https://gitlab.freedesktop.org/drm/intel/issues/673 Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Cc: stable@kernel.vger.org Link: https://patchwork.freedesktop.org/patch/msgid/20191209023215.3519970-1-chris@chris-wilson.co.uk (cherry picked from commit 82c69bf58650e644c61aa2bf5100b63a1070fd2f) Signed-off-by: Joonas Lahtinen commit 3ce8209735e120db6f0ef739480e3dc7e2cb6763 Author: Ville Syrjälä Date: Wed Dec 4 20:05:41 2019 +0200 drm/i915/hdcp: Nuke intel_hdcp_transcoder_config() intel_hdcp_transcoder_config() is clobbering some globally visible state in .compute_config(). That is a big no no as .compute_config() is supposed to have no visible side effects when either the commit fails or it's just a TEST_ONLY commit. Inline this stuff into intel_hdcp_enable() so that the state only gets modified when we actually commit the state to the hardware. Cc: Ramalingam C Cc: Jani Nikula Cc: Uma Shankar Fixes: 39e2df090c3c ("drm/i915/hdcp: update current transcoder into intel_hdcp") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20191204180549.1267-2-ville.syrjala@linux.intel.com Reviewed-by: Ramalingam C (cherry picked from commit 67e1d5ed85a83e232a9e0b995f5778a86722b96e) Signed-off-by: Joonas Lahtinen commit 0eb8e74f7202a4a98bbc0c1adeed3986cf50b66a Author: Ville Syrjälä Date: Wed Nov 27 22:12:09 2019 +0200 drm/i915/fbc: Disable fbc by default on all glk+ We're missing a workaround in the fbc code for all glk+ platforms which can cause corruption around the top of the screen. So enabling fbc by default is a bad idea. I'm not keen to backport the w/a so let's start by disabling fbc by default on all glk+. We'll lift the restriction once the w/a is in place. Cc: stable@vger.kernel.org Cc: Daniel Drake Cc: Paulo Zanoni Cc: Jian-Hong Pan Cc: Maarten Lankhorst Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20191127201222.16669-2-ville.syrjala@linux.intel.com Reviewed-by: Maarten Lankhorst (cherry picked from commit cd8c021b36a66833cefe2c90a79a9e312a2a5690) Signed-off-by: Joonas Lahtinen commit 177e876af8d291d0351db3bae84b483e4722c4a7 Author: Umesh Nerlige Ramappa Date: Fri Dec 6 11:43:39 2019 -0800 drm/i915/perf: Configure OAR for specific context Gen12 supports saving/restoring render counters per context. Apply OAR configuration only for the context that is passed in to perf. v2: - Fix OACTXCONTROL value to only stop/resume counters. - Remove gen12_update_reg_state_unlocked as power state is already applied by the caller. v3: (Lionel) - Move register initialization into the array - Assume a valid oa_config in enable_metric_set Signed-off-by: Umesh Nerlige Ramappa Fixes: 00a7f0d7155c ("drm/i915/tgl: Add perf support on TGL") Reviewed-by: Lionel Landwerlin Signed-off-by: Lionel Landwerlin Link: https://patchwork.freedesktop.org/patch/msgid/20191206194339.31356-2-umesh.nerlige.ramappa@intel.com (cherry picked from commit ccdeed497042676e13fc1625e2a341880eff5da5) Signed-off-by: Joonas Lahtinen commit 2a264a0fd4dc9aa7900fd181c3a6464027cb4df1 Author: Umesh Nerlige Ramappa Date: Fri Dec 6 11:43:38 2019 -0800 drm/i915/perf: Allow non-privileged access when OA buffer is not sampled SAMPLE_OA_REPORT enables sampling of OA reports from the OA buffer. Since reports from OA buffer had system wide visibility, collecting samples from the OA buffer was a privileged operation on previous platforms. Prior to TGL, it was also necessary to sample the OA buffer to normalize reports from MI REPORT PERF COUNT. TGL has a dedicated OAR unit to sample perf reports for a specific render context. This removes the necessity to sample OA buffer. - If not sampling the OA buffer, allow non-privileged access. An earlier patch allows the non-privilege access: https://patchwork.freedesktop.org/patch/337716/?series=68582&rev=1 - Clear up the path for non-privileged access in this patch Signed-off-by: Umesh Nerlige Ramappa Fixes: 00a7f0d7155c ("drm/i915/tgl: Add perf support on TGL") Reviewed-by: Lionel Landwerlin Signed-off-by: Lionel Landwerlin Link: https://patchwork.freedesktop.org/patch/msgid/20191206194339.31356-1-umesh.nerlige.ramappa@intel.com (cherry picked from commit 322d56aa3145a28445907ecc638a2c3aa3295c6b) Signed-off-by: Joonas Lahtinen commit 78baee8d3b976a6a6a2c208e3a36d3f1e6297e6c Author: Daniel Vetter Date: Wed Dec 4 22:51:05 2019 +0100 MAINTAINERS: Match on dma_buf|fence|resv anywhere I've spent a bit too much time reviewing all kinds of users all over the kernel for this buffer sharing infrastructure. And some of it is at least questionable. Make sure we at least see when this stuff flies by. Acked-by: Alex Deucher Acked-by: Thierry Reding Acked-by: Sumit Semwal Acked-by: Dave Airlie Signed-off-by: Daniel Vetter Cc: Sumit Semwal Cc: Mauro Carvalho Chehab Cc: Greg Kroah-Hartman Cc: Rob Herring Cc: linux-media@vger.kernel.org Cc: linaro-mm-sig@lists.linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20191204215105.874074-1-daniel.vetter@ffwll.ch commit ed9ed5a89acba51b82bdff61144d4e4a4245ec8a Author: Johan Hovold Date: Mon Dec 2 09:56:10 2019 +0100 staging: gigaset: add endpoint-type sanity check Add missing endpoint-type sanity checks to probe. This specifically prevents a warning in USB core on URB submission when fuzzing USB descriptors. Signed-off-by: Johan Hovold Cc: stable Link: https://lore.kernel.org/r/20191202085610.12719-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 84f60ca7b326ed8c08582417493982fe2573a9ad Author: Johan Hovold Date: Mon Dec 2 09:56:09 2019 +0100 staging: gigaset: fix illegal free on probe errors The driver failed to initialise its receive-buffer pointer, something which could lead to an illegal free on late probe errors. Fix this by making sure to clear all driver data at allocation. Fixes: 2032e2c2309d ("usb_gigaset: code cleanup") Cc: stable # 2.6.33 Cc: Tilman Schmidt Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20191202085610.12719-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 53f35a39c3860baac1e5ca80bf052751cfb24a99 Author: Johan Hovold Date: Mon Dec 2 09:56:08 2019 +0100 staging: gigaset: fix general protection fault on probe Fix a general protection fault when accessing the endpoint descriptors which could be triggered by a malicious device due to missing sanity checks on the number of endpoints. Reported-by: syzbot+35b1c403a14f5c89eba7@syzkaller.appspotmail.com Fixes: 07dc1f9f2f80 ("[PATCH] isdn4linux: Siemens Gigaset drivers - M105 USB DECT adapter") Cc: stable # 2.6.17 Cc: Hansjoerg Lipp Cc: Tilman Schmidt Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20191202085610.12719-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit d2cdb20507fe2079a146459f9718b45d78cbbe61 Author: Marcelo Diop-Gonzalez Date: Tue Dec 3 10:39:21 2019 -0500 staging: vchiq: call unregister_chrdev_region() when driver registration fails This undoes the previous call to alloc_chrdev_region() on failure, and is probably what was meant originally given the label name. Signed-off-by: Marcelo Diop-Gonzalez Cc: stable Fixes: 187ac53e590c ("staging: vchiq_arm: rework probe and init functions") Reviewed-by: Dan Carpenter Reviewed-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/20191203153921.70540-1-marcgonzalez@google.com Signed-off-by: Greg Kroah-Hartman commit 1af73a25e6e7d9f2f1e2a14259cc9ffce6d8f6d4 Author: Brendan Higgins Date: Wed Dec 4 15:45:22 2019 -0800 staging: exfat: fix multiple definition error of `rename_file' `rename_file' was exported but not properly namespaced causing a multiple definition error because `rename_file' is already defined in fs/hostfs/hostfs_user.c: ld: drivers/staging/exfat/exfat_core.o: in function `rename_file': drivers/staging/exfat/exfat_core.c:2327: multiple definition of `rename_file'; fs/hostfs/hostfs_user.o:fs/hostfs/hostfs_user.c:350: first defined here make: *** [Makefile:1077: vmlinux] Error 1 This error can be reproduced on ARCH=um by selecting: CONFIG_EXFAT_FS=y CONFIG_HOSTFS=y Add a namespace prefix exfat_* to fix this error. Reported-by: Brendan Higgins Signed-off-by: Brendan Higgins Cc: stable Cc: Valdis Kletnieks Tested-by: David Gow Reviewed-by: David Gow Link: https://lore.kernel.org/r/20191204234522.42855-1-brendanhiggins@google.com Signed-off-by: Greg Kroah-Hartman commit 2740bd3351cd5a4351f458aabaa1c9b77de3867b Author: Kay Friedrich Date: Wed Nov 27 12:24:57 2019 +0100 staging/wlan-ng: add CRC32 dependency in Kconfig wlan-ng uses the function crc32_le, but CRC32 wasn't a dependency of wlan-ng Co-developed-by: Michael Kupfer Signed-off-by: Michael Kupfer Signed-off-by: Kay Friedrich Link: https://lore.kernel.org/r/20191127112457.2301-1-kay.friedrich@fau.de Signed-off-by: Greg Kroah-Hartman commit 2f4d984b9544e03ef9435a750f4cc7de1df61051 Author: YueHaibing Date: Wed Nov 13 10:13:06 2019 +0800 staging: hp100: Fix build error without ETHERNET It should depends on ETHERNET, otherwise building fails: drivers/staging/hp/hp100.o: In function `hp100_pci_remove': hp100.c:(.text+0x165): undefined reference to `unregister_netdev' hp100.c:(.text+0x214): undefined reference to `free_netdev' Fixes: 52340b82cf1a ("hp100: Move 100BaseVG AnyLAN driver to staging") Signed-off-by: YueHaibing Acked-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/r/20191113021306.35464-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman commit 453a4b6d8e1bdff2b8e1f56f4b8a8ef6d36b0e77 Author: Linus Walleij Date: Thu Dec 5 00:32:30 2019 +0100 staging: fbtft: Do not hardcode SPI CS polarity inversion The current use of the mode flag SPI_CS_HIGH is fragile: it overwrites anything already assigned by the SPI core. Assign ^= SPI_CS_HIGH since we might be active high already, and that is usually the case with GPIOs used for chip select, even if they are in practice active low. Add a comment clarifying why ^= SPI_CS_HIGH is the right choice here. Reported-by: Mark Brown Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20191204233230.22309-1-linus.walleij@linaro.org Signed-off-by: Greg Kroah-Hartman commit 1184fd9966702a5a1cea73bdb6fe646b961c387c Author: Andrea Righi Date: Thu Dec 5 16:29:13 2019 +0100 staging: exfat: properly support discard in clr_alloc_bitmap() Currently the discard code in clr_alloc_bitmap() is just dead code. Move code around so that the discard operation is properly attempted when enabled. Signed-off-by: Andrea Righi Link: https://lore.kernel.org/r/20191205152913.GJ3276@xps-13 Signed-off-by: Greg Kroah-Hartman commit a58d37bce0d21cf7fbd589384c619e465ef2f927 Author: Frederic Barrat Date: Mon Jun 24 16:41:48 2019 +0200 ocxl: Fix concurrent AFU open and device removal If an ocxl device is unbound through sysfs at the same time its AFU is being opened by a user process, the open code may dereference freed stuctures, which can lead to kernel oops messages. You'd have to hit a tiny time window, but it's possible. It's fairly easy to test by making the time window bigger artificially. Fix it with a combination of 2 changes: - when an AFU device is found in the IDR by looking for the device minor number, we should hold a reference on the device until after the context is allocated. A reference on the AFU structure is kept when the context is allocated, so we can release the reference on the device after the context allocation. - with the fix above, there's still another even tinier window, between the time the AFU device is found in the IDR and the reference on the device is taken. We can fix this one by removing the IDR entry earlier, when the device setup is removed, instead of waiting for the 'release' device callback. With proper locking around the IDR. Fixes: 75ca758adbaf ("ocxl: Create a clear delineation between ocxl backend & frontend") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Frederic Barrat Reviewed-by: Greg Kurz Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190624144148.32022-1-fbarrat@linux.ibm.com commit 7d42b7961b9198efc75ee5192eab7d03e691d692 Author: Guenter Roeck Date: Mon Dec 2 06:18:36 2019 -0800 staging/octeon: Mark Ethernet driver as BROKEN The code doesn't compile due to incompatible pointer errors such as drivers/staging/octeon/ethernet-tx.c:649:50: error: passing argument 1 of 'cvmx_wqe_get_grp' from incompatible pointer type This is due to mixing, for example, cvmx_wqe_t with 'struct cvmx_wqe'. Unfortunately, one can not just revert the primary offending commit, as doing so results in secondary errors. This is made worse by the fact that the "removed" typedefs still exist and are used widely outside the staging directory, making the entire set of "remove typedef" changes pointless and wrong. Reflect reality and mark the driver as BROKEN. Fixes: ef1fe6b7369a ("staging: octeon: remove typedef declaration for cvmx_wqe") Fixes: 73aef0c9d2c6 ("staging: octeon: remove typedef declaration for cvmx_helper_link_info") Cc: Wambui Karuga Cc: Julia Lawall Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20191202141836.9363-1-linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman commit 0df36b90c47d93295b7e393da2d961b2f3b6cde4 Author: Luca Coelho Date: Thu Dec 5 09:03:54 2019 +0200 iwlwifi: pcie: move power gating workaround earlier in the flow We need to reset the NIC after setting the bits to enable power gating and that cannot be done too late in the flow otherwise it cleans other registers and things that were already configured, causing initialization to fail. In order to fix this, move the function to the common code in trans.c so it can be called directly from there at an earlier point, just after the reset we already do during initialization. Fixes: 9a47cb988338 ("iwlwifi: pcie: add workaround for power gating in integrated 22000") Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=205719 Cc: stable@ver.kernel.org # 5.4+ Reported-by: Anders Kaseorg Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit db5cce1afc8d2475d2c1c37c2a8267dd0e151526 Author: Anders Kaseorg Date: Mon Dec 2 17:09:20 2019 -0500 Revert "iwlwifi: assign directly to iwl_trans->cfg in QuZ detection" This reverts commit 968dcfb4905245dc64d65312c0d17692fa087b99. Both that commit and commit 809805a820c6445f7a701ded24fdc6bbc841d1e4 attempted to fix the same bug (dead assignments to the local variable cfg), but they did so in incompatible ways. When they were both merged, independently of each other, the combination actually caused the bug to reappear, leading to a firmware crash on boot for some cards. https://bugzilla.kernel.org/show_bug.cgi?id=205719 Signed-off-by: Anders Kaseorg Acked-by: Luca Coelho Signed-off-by: Kalle Valo commit cc90bc68422318eb8e75b15cd74bc8d538a7df29 Author: Andreas Gruenbacher Date: Mon Dec 9 20:11:14 2019 +0100 block: fix "check bi_size overflow before merge" This partially reverts commit e3a5d8e386c3fb973fa75f2403622a8f3640ec06. Commit e3a5d8e386c3 ("check bi_size overflow before merge") adds a bio_full check to __bio_try_merge_page. This will cause __bio_try_merge_page to fail when the last bi_io_vec has been reached. Instead, what we want here is only the bi_size overflow check. Fixes: e3a5d8e386c3 ("block: check bi_size overflow before merge") Cc: stable@vger.kernel.org # v5.4+ Reviewed-by: Ming Lei Signed-off-by: Andreas Gruenbacher Signed-off-by: Jens Axboe commit 868afbaca1e2a7923e48b5e8c07be34660525db5 Author: Stephan Gerhold Date: Mon Dec 9 19:53:43 2019 +0100 NFC: nxp-nci: Fix probing without ACPI devm_acpi_dev_add_driver_gpios() returns -ENXIO if CONFIG_ACPI is disabled (e.g. on device tree platforms). In this case, nxp-nci will silently fail to probe. The other NFC drivers only log a debug message if devm_acpi_dev_add_driver_gpios() fails. Do the same in nxp-nci to fix this problem. Fixes: ad0acfd69add ("NFC: nxp-nci: Get rid of code duplication in ->probe()") Cc: Andy Shevchenko Signed-off-by: Stephan Gerhold Acked-by: Andy Shevchenko Signed-off-by: David S. Miller commit 281393894af9cc3f9483204475014e89d728987c Author: Steve French Date: Mon Dec 9 19:47:10 2019 -0600 smb3: fix refcount underflow warning on unmount when no directory leases Fix refcount underflow warning when unmounting to servers which didn't grant directory leases. [ 301.680095] refcount_t: underflow; use-after-free. [ 301.680192] WARNING: CPU: 1 PID: 3569 at lib/refcount.c:28 refcount_warn_saturate+0xb4/0xf3 ... [ 301.682139] Call Trace: [ 301.682240] close_shroot+0x97/0xda [cifs] [ 301.682351] SMB2_tdis+0x7c/0x176 [cifs] [ 301.682456] ? _get_xid+0x58/0x91 [cifs] [ 301.682563] cifs_put_tcon.part.0+0x99/0x202 [cifs] [ 301.682637] ? ida_free+0x99/0x10a [ 301.682727] ? cifs_umount+0x3d/0x9d [cifs] [ 301.682829] cifs_put_tlink+0x3a/0x50 [cifs] [ 301.682929] cifs_umount+0x44/0x9d [cifs] Fixes: 72e73c78c446 ("cifs: close the shared root handle on tree disconnect") Signed-off-by: Steve French Acked-by: Ronnie Sahlberg Reviewed-by: Aurelien Aptel Reviewed-by: Pavel Shilovsky Reported-and-tested-by: Arthur Marsh commit bba340c79bfe3644829db5c852fdfa9e33837d6d Author: Bo Wu Date: Wed Nov 20 13:26:17 2019 +0000 scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func In iscsi_if_rx func, after receiving one request through iscsi_if_recv_msg func, iscsi_if_send_reply will be called to try to reply to the request in a do-while loop. If the iscsi_if_send_reply function keeps returning -EAGAIN, a deadlock will occur. For example, a client only send msg without calling recvmsg func, then it will result in the watchdog soft lockup. The details are given as follows: sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ISCSI); retval = bind(sock_fd, (struct sock addr*) & src_addr, sizeof(src_addr); while (1) { state_msg = sendmsg(sock_fd, &msg, 0); //Note: recvmsg(sock_fd, &msg, 0) is not processed here. } close(sock_fd); watchdog: BUG: soft lockup - CPU#7 stuck for 22s! [netlink_test:253305] Sample time: 4000897528 ns(HZ: 250) Sample stat: curr: user: 675503481560, nice: 321724050, sys: 448689506750, idle: 4654054240530, iowait: 40885550700, irq: 14161174020, softirq: 8104324140, st: 0 deta: user: 0, nice: 0, sys: 3998210100, idle: 0, iowait: 0, irq: 1547170, softirq: 242870, st: 0 Sample softirq: TIMER: 992 SCHED: 8 Sample irqstat: irq 2: delta 1003, curr: 3103802, arch_timer CPU: 7 PID: 253305 Comm: netlink_test Kdump: loaded Tainted: G OE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO) pc : __alloc_skb+0x104/0x1b0 lr : __alloc_skb+0x9c/0x1b0 sp : ffff000033603a30 x29: ffff000033603a30 x28: 00000000000002dd x27: ffff800b34ced810 x26: ffff800ba7569f00 x25: 00000000ffffffff x24: 0000000000000000 x23: ffff800f7c43f600 x22: 0000000000480020 x21: ffff0000091d9000 x20: ffff800b34eff200 x19: ffff800ba7569f00 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0001000101000100 x13: 0000000101010000 x12: 0101000001010100 x11: 0001010101010001 x10: 00000000000002dd x9 : ffff000033603d58 x8 : ffff800b34eff400 x7 : ffff800ba7569200 x6 : ffff800b34eff400 x5 : 0000000000000000 x4 : 00000000ffffffff x3 : 0000000000000000 x2 : 0000000000000001 x1 : ffff800b34eff2c0 x0 : 0000000000000300 Call trace: __alloc_skb+0x104/0x1b0 iscsi_if_rx+0x144/0x12bc [scsi_transport_iscsi] netlink_unicast+0x1e0/0x258 netlink_sendmsg+0x310/0x378 sock_sendmsg+0x4c/0x70 sock_write_iter+0x90/0xf0 __vfs_write+0x11c/0x190 vfs_write+0xac/0x1c0 ksys_write+0x6c/0xd8 __arm64_sys_write+0x24/0x30 el0_svc_common+0x78/0x130 el0_svc_handler+0x38/0x78 el0_svc+0x8/0xc Link: https://lore.kernel.org/r/EDBAAA0BBBA2AC4E9C8B6B81DEEE1D6915E3D4D2@dggeml505-mbx.china.huawei.com Signed-off-by: Bo Wu Reviewed-by: Zhiqiang Liu Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen commit 5480e299b5ae57956af01d4839c9fc88a465eeab Author: Bart Van Assche Date: Mon Dec 9 09:34:57 2019 -0800 scsi: iscsi: Fix a potential deadlock in the timeout handler Some time ago the block layer was modified such that timeout handlers are called from thread context instead of interrupt context. Make it safe to run the iSCSI timeout handler in thread context. This patch fixes the following lockdep complaint: ================================ WARNING: inconsistent lock state 5.5.1-dbg+ #11 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. kworker/7:1H/206 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff88802d9827e8 (&(&session->frwd_lock)->rlock){+.?.}, at: iscsi_eh_cmd_timed_out+0xa6/0x6d0 [libiscsi] {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x106/0x240 _raw_spin_lock+0x38/0x50 iscsi_check_transport_timeouts+0x3e/0x210 [libiscsi] call_timer_fn+0x132/0x470 __run_timers.part.0+0x39f/0x5b0 run_timer_softirq+0x63/0xc0 __do_softirq+0x12d/0x5fd irq_exit+0xb3/0x110 smp_apic_timer_interrupt+0x131/0x3d0 apic_timer_interrupt+0xf/0x20 default_idle+0x31/0x230 arch_cpu_idle+0x13/0x20 default_idle_call+0x53/0x60 do_idle+0x38a/0x3f0 cpu_startup_entry+0x24/0x30 start_secondary+0x222/0x290 secondary_startup_64+0xa4/0xb0 irq event stamp: 1383705 hardirqs last enabled at (1383705): [] _raw_spin_unlock_irq+0x2c/0x50 hardirqs last disabled at (1383704): [] _raw_spin_lock_irq+0x18/0x50 softirqs last enabled at (1383690): [] iscsi_queuecommand+0x76a/0xa20 [libiscsi] softirqs last disabled at (1383682): [] iscsi_queuecommand+0x118/0xa20 [libiscsi] other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&session->frwd_lock)->rlock); lock(&(&session->frwd_lock)->rlock); *** DEADLOCK *** 2 locks held by kworker/7:1H/206: #0: ffff8880d57bf928 ((wq_completion)kblockd){+.+.}, at: process_one_work+0x472/0xab0 #1: ffff88802b9c7de8 ((work_completion)(&q->timeout_work)){+.+.}, at: process_one_work+0x476/0xab0 stack backtrace: CPU: 7 PID: 206 Comm: kworker/7:1H Not tainted 5.5.1-dbg+ #11 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Workqueue: kblockd blk_mq_timeout_work Call Trace: dump_stack+0xa5/0xe6 print_usage_bug.cold+0x232/0x23b mark_lock+0x8dc/0xa70 __lock_acquire+0xcea/0x2af0 lock_acquire+0x106/0x240 _raw_spin_lock+0x38/0x50 iscsi_eh_cmd_timed_out+0xa6/0x6d0 [libiscsi] scsi_times_out+0xf4/0x440 [scsi_mod] scsi_timeout+0x1d/0x20 [scsi_mod] blk_mq_check_expired+0x365/0x3a0 bt_iter+0xd6/0xf0 blk_mq_queue_tag_busy_iter+0x3de/0x650 blk_mq_timeout_work+0x1af/0x380 process_one_work+0x56d/0xab0 worker_thread+0x7a/0x5d0 kthread+0x1bc/0x210 ret_from_fork+0x24/0x30 Fixes: 287922eb0b18 ("block: defer timeouts to a workqueue") Cc: Christoph Hellwig Cc: Keith Busch Cc: Lee Duncan Cc: Chris Leech Cc: Link: https://lore.kernel.org/r/20191209173457.187370-1-bvanassche@acm.org Signed-off-by: Bart Van Assche Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen commit a2bdd0c904da12b223c8d7218e98138d4e6d9f4f Author: Paul Menzel Date: Mon Dec 9 16:06:53 2019 +0100 scsi: smartpqi: Update attribute name to `driver_version` The file name in the documentation is currently incorrect, so fix it. Link: https://lore.kernel.org/r/fe264d62-0371-ea59-b66a-6d855290ce65@molgen.mpg.de Fixes: 6d90615f1346 ("scsi: smartpqi: add sysfs entries") Signed-off-by: Paul Menzel Signed-off-by: Martin K. Petersen commit f70267f379b5e5e11bdc5d72a56bf17e5feed01f Author: Jason Yan Date: Fri Dec 6 09:11:18 2019 +0800 scsi: libsas: stop discovering if oob mode is disconnected The discovering of sas port is driven by workqueue in libsas. When libsas is processing port events or phy events in workqueue, new events may rise up and change the state of some structures such as asd_sas_phy. This may cause some problems such as follows: ==>thread 1 ==>thread 2 ==>phy up ==>phy_up_v3_hw() ==>oob_mode = SATA_OOB_MODE; ==>phy down quickly ==>hisi_sas_phy_down() ==>sas_ha->notify_phy_event() ==>sas_phy_disconnected() ==>oob_mode = OOB_NOT_CONNECTED ==>workqueue wakeup ==>sas_form_port() ==>sas_discover_domain() ==>sas_get_port_device() ==>oob_mode is OOB_NOT_CONNECTED and device is wrongly taken as expander This at last lead to the panic when libsas trying to issue a command to discover the device. [183047.614035] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 [183047.622896] Mem abort info: [183047.625762] ESR = 0x96000004 [183047.628893] Exception class = DABT (current EL), IL = 32 bits [183047.634888] SET = 0, FnV = 0 [183047.638015] EA = 0, S1PTW = 0 [183047.641232] Data abort info: [183047.644189] ISV = 0, ISS = 0x00000004 [183047.648100] CM = 0, WnR = 0 [183047.651145] user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000b7df67be [183047.657834] [0000000000000058] pgd=0000000000000000 [183047.662789] Internal error: Oops: 96000004 [#1] SMP [183047.667740] Process kworker/u16:2 (pid: 31291, stack limit = 0x00000000417c4974) [183047.675208] CPU: 0 PID: 3291 Comm: kworker/u16:2 Tainted: G W OE 4.19.36-vhulk1907.1.0.h410.eulerosv2r8.aarch64 #1 [183047.687015] Hardware name: N/A N/A/Kunpeng Desktop Board D920S10, BIOS 0.15 10/22/2019 [183047.695007] Workqueue: 0000:74:02.0_disco_q sas_discover_domain [183047.700999] pstate: 20c00009 (nzCv daif +PAN +UAO) [183047.705864] pc : prep_ata_v3_hw+0xf8/0x230 [hisi_sas_v3_hw] [183047.711510] lr : prep_ata_v3_hw+0xb0/0x230 [hisi_sas_v3_hw] [183047.717153] sp : ffff00000f28ba60 [183047.720541] x29: ffff00000f28ba60 x28: ffff8026852d7228 [183047.725925] x27: ffff8027dba3e0a8 x26: ffff8027c05fc200 [183047.731310] x25: 0000000000000000 x24: ffff8026bafa8dc0 [183047.736695] x23: ffff8027c05fc218 x22: ffff8026852d7228 [183047.742079] x21: ffff80007c2f2940 x20: ffff8027c05fc200 [183047.747464] x19: 0000000000f80800 x18: 0000000000000010 [183047.752848] x17: 0000000000000000 x16: 0000000000000000 [183047.758232] x15: ffff000089a5a4ff x14: 0000000000000005 [183047.763617] x13: ffff000009a5a50e x12: ffff8026bafa1e20 [183047.769001] x11: ffff0000087453b8 x10: ffff00000f28b870 [183047.774385] x9 : 0000000000000000 x8 : ffff80007e58f9b0 [183047.779770] x7 : 0000000000000000 x6 : 000000000000003f [183047.785154] x5 : 0000000000000040 x4 : ffffffffffffffe0 [183047.790538] x3 : 00000000000000f8 x2 : 0000000002000007 [183047.795922] x1 : 0000000000000008 x0 : 0000000000000000 [183047.801307] Call trace: [183047.803827] prep_ata_v3_hw+0xf8/0x230 [hisi_sas_v3_hw] [183047.809127] hisi_sas_task_prep+0x750/0x888 [hisi_sas_main] [183047.814773] hisi_sas_task_exec.isra.7+0x88/0x1f0 [hisi_sas_main] [183047.820939] hisi_sas_queue_command+0x28/0x38 [hisi_sas_main] [183047.826757] smp_execute_task_sg+0xec/0x218 [183047.831013] smp_execute_task+0x74/0xa0 [183047.834921] sas_discover_expander.part.7+0x9c/0x5f8 [183047.839959] sas_discover_root_expander+0x90/0x160 [183047.844822] sas_discover_domain+0x1b8/0x1e8 [183047.849164] process_one_work+0x1b4/0x3f8 [183047.853246] worker_thread+0x54/0x470 [183047.856981] kthread+0x134/0x138 [183047.860283] ret_from_fork+0x10/0x18 [183047.863931] Code: f9407a80 528000e2 39409281 72a04002 (b9405800) [183047.870097] kernel fault(0x1) notification starting on CPU 0 [183047.875828] kernel fault(0x1) notification finished on CPU 0 [183047.881559] Modules linked in: unibsp(OE) hns3(OE) hclge(OE) hnae3(OE) mem_drv(OE) hisi_sas_v3_hw(OE) hisi_sas_main(OE) [183047.892418] ---[ end trace 4cc26083fc11b783 ]--- [183047.897107] Kernel panic - not syncing: Fatal exception [183047.902403] kernel fault(0x5) notification starting on CPU 0 [183047.908134] kernel fault(0x5) notification finished on CPU 0 [183047.913865] SMP: stopping secondary CPUs [183047.917861] Kernel Offset: disabled [183047.921422] CPU features: 0x2,a2a00a38 [183047.925243] Memory Limit: none [183047.928372] kernel reboot(0x2) notification starting on CPU 0 [183047.934190] kernel reboot(0x2) notification finished on CPU 0 [183047.940008] ---[ end Kernel panic - not syncing: Fatal exception ]--- Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") Link: https://lore.kernel.org/r/20191206011118.46909-1-yanaijie@huawei.com Reported-by: Gao Chuan Reviewed-by: John Garry Signed-off-by: Jason Yan Signed-off-by: Martin K. Petersen commit d168001d14eccfda229b4a41a2c31a21e3c379da Author: sheebab Date: Tue Dec 3 11:07:15 2019 +0100 scsi: ufs: Disable autohibern8 feature in Cadence UFS This patch disables autohibern8 feature in Cadence UFS. The autohibern8 feature has issues due to which unexpected interrupt trigger is happening. After the interrupt issue is sorted out, autohibern8 feature will be re-enabled Link: https://lore.kernel.org/r/1575367635-22662-1-git-send-email-sheebab@cadence.com Cc: Signed-off-by: sheebab Reviewed-by: Alim Akhtar Tested-by: Vignesh Raghavendra Signed-off-by: Martin K. Petersen commit fee92f25777789d73e1936b91472e9c4644457c8 Author: Dan Carpenter Date: Tue Dec 3 12:45:09 2019 +0300 scsi: iscsi: qla4xxx: fix double free in probe On this error path we call qla4xxx_mem_free() and then the caller also calls qla4xxx_free_adapter() which calls qla4xxx_mem_free(). It leads to a couple double frees: drivers/scsi/qla4xxx/ql4_os.c:8856 qla4xxx_probe_adapter() warn: 'ha->chap_dma_pool' double freed drivers/scsi/qla4xxx/ql4_os.c:8856 qla4xxx_probe_adapter() warn: 'ha->fw_ddb_dma_pool' double freed Fixes: afaf5a2d341d ("[SCSI] Initial Commit of qla4xxx") Link: https://lore.kernel.org/r/20191203094421.hw7ex7qr3j2rbsmx@kili.mountain Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit 8c850a0296004409e7bcb9464712fb2807da656a Author: Can Guo Date: Tue Dec 3 06:58:40 2019 +0000 scsi: ufs: Give an unique ID to each ufs-bsg Considering there can be multiple UFS hosts in SoC, give each ufs-bsg an unique ID by appending the scsi host number to its device name. Link: https://lore.kernel.org/r/0101016eca8dc9d7-d24468d3-04d2-4ef3-a906-abe8b8cbcd3d-000000@us-west-2.amazonses.com Fixes: df032bf27a41 ("scsi: ufs: Add a bsg endpoint that supports UPIUs") Signed-off-by: Can Guo Reviewed-by: Avri Altman Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 9545767db3cde2d4f9ca581d096d97ed00754282 Author: Roman Bolshakov Date: Mon Nov 25 19:57:02 2019 +0300 scsi: qla2xxx: Add debug dump of LOGO payload and ELS IOCB The change adds a way to debug LOGO ELS, likewise PLOGI. Link: https://lore.kernel.org/r/20191125165702.1013-14-r.bolshakov@yadro.com Acked-by: Himanshu Madhani Acked-by: Quinn Tran Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Reviewed-by: Bart Van Assche Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit af22f0c7b052c5c203207f1e5ebd6aa65f87c538 Author: Roman Bolshakov Date: Mon Nov 25 19:57:01 2019 +0300 scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI PORT UPDATE asynchronous event is generated on the host that issues PLOGI ELS (in the case of higher WWPN). In that case, the event shouldn't be handled as it sets unwanted DPC flags (i.e. LOOP_RESYNC_NEEDED) that trigger link flap. Ignore the event if the host has higher WWPN, but handle otherwise. Cc: Quinn Tran Link: https://lore.kernel.org/r/20191125165702.1013-13-r.bolshakov@yadro.com Acked-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit dabc5ec915f3a2c657ecfb529cd3d4ec303a4412 Author: Roman Bolshakov Date: Mon Nov 25 19:57:00 2019 +0300 scsi: qla2xxx: Don't defer relogin unconditonally qla2x00_configure_local_loop sets RELOGIN_NEEDED bit and calls qla24xx_fcport_handle_login to perform the login. This bit triggers a wake up of DPC later after a successful login. The deferred call is not needed if login succeeds, and it's set in qla24xx_fcport_handle_login in case of errors, hence it should be safe to drop. Link: https://lore.kernel.org/r/20191125165702.1013-12-r.bolshakov@yadro.com Acked-by: Himanshu Madhani Acked-by: Quinn Tran Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit 5e6b01d84b9d20bcd77fc7c4733a2a4149bf220a Author: Roman Bolshakov Date: Mon Nov 25 19:56:59 2019 +0300 scsi: qla2xxx: Send Notify ACK after N2N PLOGI qlt_handle_login schedules session for deletion even if a login is in progress. That causes login bouncing, i.e. a few logins are made before it settles down. Complete the first login by sending Notify Acknowledge IOCB via qlt_plogi_ack_unref if the session is pending login completion. Fixes: 9cd883f07a54 ("scsi: qla2xxx: Fix session cleanup for N2N") Cc: Krishna Kant Cc: Alexei Potashnik Link: https://lore.kernel.org/r/20191125165702.1013-11-r.bolshakov@yadro.com Acked-by: Quinn Tran Acked-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit fd1de5830a5abaf444cc4312871e02c41e24fdc1 Author: Roman Bolshakov Date: Mon Nov 25 19:56:58 2019 +0300 scsi: qla2xxx: Configure local loop for N2N target qla2x00_configure_local_loop initializes PLOGI payload for PLOGI ELS using Get Parameters mailbox command. In the case when the driver is running in target mode, the topology is N2N and the target port has higher WWPN, LOCAL_LOOP_UPDATE bit is cleared too early and PLOGI payload is not initialized by the Get Parameters command. That causes a failure of ELS IOCB carrying the PLOGI with 0x15 aka Data Underrun error. LOCAL_LOOP_UPDATE has to be set to initialize PLOGI payload. Fixes: 48acad099074 ("scsi: qla2xxx: Fix N2N link re-connect") Link: https://lore.kernel.org/r/20191125165702.1013-10-r.bolshakov@yadro.com Acked-by: Quinn Tran Acked-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit 0334cdea1fba36fad8bdf9516f267ce01de625f7 Author: Roman Bolshakov Date: Mon Nov 25 19:56:57 2019 +0300 scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length The size of the buffer is hardcoded as 0x70 or 112 bytes, while the size of ELS IOCB is 0x40 and the size of PLOGI payload returned by Get Parameters command is 0x74. Cc: Quinn Tran Link: https://lore.kernel.org/r/20191125165702.1013-9-r.bolshakov@yadro.com Acked-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit 2c2f4bed9b6299e6430a65a29b5d27b8763fdf25 Author: Roman Bolshakov Date: Mon Nov 25 19:56:56 2019 +0300 scsi: qla2xxx: Don't call qlt_async_event twice MBA_PORT_UPDATE generates duplicate log lines in target mode because qlt_async_event is called twice. Drop the calls within the case as the function will be called right after the switch statement. Cc: Quinn Tran Link: https://lore.kernel.org/r/20191125165702.1013-8-r.bolshakov@yadro.com Acked-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Acked-by: Himanshu Madhani Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit a9ed06d4e640a8dc978a4649ab78dac8b16d2db6 Author: Roman Bolshakov Date: Mon Nov 25 19:56:55 2019 +0300 scsi: qla2xxx: Allow PLOGI in target mode According to FC-LS-3 (Fibre Channel Link Services) 6.3.2.4 "N_Port Login - No Fabric present", if both parties in the point-to-point connection know N_Port_Names of each other, Nx_Port with the highest N_Port_name shall transmit PLOGI. The specification sets no restrictions on the port role that should send PLOGI. However, FCP-4 (Fibre Channel Protocol for SCSI, Fourth Version) 6.2 "Overview of Process Login and Process Logout", instructs that in point-to-point topology, initiator shall send explicit PRLI ELS. The change fixes stuck P2P login, when target WWPN is higher than initiator WWPN. Cc: Quinn Tran Cc: Himanshu Madhani Link: https://lore.kernel.org/r/20191125165702.1013-7-r.bolshakov@yadro.com Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit 58e39a2ce4be08162c0368030cdc405f7fd849aa Author: Roman Bolshakov Date: Mon Nov 25 19:56:54 2019 +0300 scsi: qla2xxx: Change discovery state before PLOGI When a port sends PLOGI, discovery state should be changed to login pending, otherwise RELOGIN_NEEDED bit is set in qla24xx_handle_plogi_done_event(). RELOGIN_NEEDED triggers another PLOGI, and it never goes out of the loop until login timer expires. Fixes: 8777e4314d397 ("scsi: qla2xxx: Migrate NVME N2N handling into state machine") Fixes: 8b5292bcfcacf ("scsi: qla2xxx: Fix Relogin to prevent modifying scan_state flag") Cc: Quinn Tran Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191125165702.1013-6-r.bolshakov@yadro.com Acked-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit 600954e6f2df695434887dfc6a99a098859990cf Author: Roman Bolshakov Date: Mon Nov 25 19:56:53 2019 +0300 scsi: qla2xxx: Drop superfluous INIT_WORK of del_work del_work is already initialized inside qla2x00_alloc_fcport, there's no need to overwrite it. Indeed, it might prevent complete traversal of workqueue list. Fixes: a01c77d2cbc45 ("scsi: qla2xxx: Move session delete to driver work queue") Cc: Quinn Tran Link: https://lore.kernel.org/r/20191125165702.1013-5-r.bolshakov@yadro.com Acked-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Reviewed-by: Bart Van Assche Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit 4c86b037a6db3ad2922ef3ba8a8989eb7794e040 Author: Roman Bolshakov Date: Mon Nov 25 19:56:52 2019 +0300 scsi: qla2xxx: Initialize free_work before flushing it Target creation triggers a new BUG_ON introduced in in commit 4d43d395fed1 ("workqueue: Try to catch flush_work() without INIT_WORK()."). The BUG_ON reveals an attempt to flush free_work in qla24xx_do_nack_work before it's initialized in qlt_unreg_sess: WARNING: CPU: 7 PID: 211 at kernel/workqueue.c:3031 __flush_work.isra.38+0x40/0x2e0 CPU: 7 PID: 211 Comm: kworker/7:1 Kdump: loaded Tainted: G E 5.3.0-rc7-vanilla+ #2 Workqueue: qla2xxx_wq qla2x00_iocb_work_fn [qla2xxx] NIP: c000000000159620 LR: c0080000009d91b0 CTR: c0000000001598c0 REGS: c000000005f3f730 TRAP: 0700 Tainted: G E (5.3.0-rc7-vanilla+) MSR: 800000000282b033 CR: 24002222 XER: 00000000 CFAR: c0000000001598d0 IRQMASK: 0 GPR00: c0080000009d91b0 c000000005f3f9c0 c000000001670a00 c0000003f8655ca8 GPR04: c0000003f8655c00 000000000000ffff 0000000000000011 ffffffffffffffff GPR08: c008000000949228 0000000000000000 0000000000000001 c0080000009e7780 GPR12: 0000000000002200 c00000003fff6200 c000000000161bc8 0000000000000004 GPR16: c0000003f9d68280 0000000002000000 0000000000000005 0000000000000003 GPR20: 0000000000000002 000000000000ffff 0000000000000000 fffffffffffffef7 GPR24: c000000004f73848 c000000004f73838 c000000004f73f28 c000000005f3fb60 GPR28: c000000004f73e48 c000000004f73c80 c000000004f73818 c0000003f9d68280 NIP [c000000000159620] __flush_work.isra.38+0x40/0x2e0 LR [c0080000009d91b0] qla24xx_do_nack_work+0x88/0x180 [qla2xxx] Call Trace: [c000000005f3f9c0] [c000000000159644] __flush_work.isra.38+0x64/0x2e0 (unreliable) [c000000005f3fa50] [c0080000009d91a0] qla24xx_do_nack_work+0x78/0x180 [qla2xxx] [c000000005f3fae0] [c0080000009496ec] qla2x00_do_work+0x604/0xb90 [qla2xxx] [c000000005f3fc40] [c008000000949cd8] qla2x00_iocb_work_fn+0x60/0xe0 [qla2xxx] [c000000005f3fc80] [c000000000157bb8] process_one_work+0x2c8/0x5b0 [c000000005f3fd10] [c000000000157f28] worker_thread+0x88/0x660 [c000000005f3fdb0] [c000000000161d64] kthread+0x1a4/0x1b0 [c000000005f3fe20] [c00000000000b960] ret_from_kernel_thread+0x5c/0x7c Instruction dump: 3d22001d 892966b1 7d908026 91810008 f821ff71 69290001 0b090000 2e290000 40920200 e9230018 7d2a0074 794ad182 <0b0a0000> 2fa90000 419e01e8 7c0802a6 ---[ end trace 5ccf335d4f90fcb8 ]--- Fixes: 1021f0bc2f3d6 ("scsi: qla2xxx: allow session delete to finish before create.") Cc: Quinn Tran Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191125165702.1013-4-r.bolshakov@yadro.com Acked-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Reviewed-by: Bart Van Assche Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit 86196a8fa8a84af1395a28ea0548f2ce6ae9bc22 Author: Quinn Tran Date: Mon Nov 25 19:56:51 2019 +0300 scsi: qla2xxx: Use explicit LOGO in target mode Target makes implicit LOGO on session teardown. LOGO ELS is not send on the wire and initiator is not aware that target no longer wants talking to it. Initiator keeps sending I/O requests, target responds with BA_RJT, they time out and then initiator sends ABORT TASK (ABTS-LS). Current behaviour incurs unneeded I/O timeout and can be fixed for some initiators by making explicit LOGO on session deletion. Link: https://lore.kernel.org/r/20191125165702.1013-3-r.bolshakov@yadro.com Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Signed-off-by: Quinn Tran Signed-off-by: Himanshu Madhani Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit f2c9ee54a56995a293efef290657d8a1d80e14ab Author: Roman Bolshakov Date: Mon Nov 25 19:56:50 2019 +0300 scsi: qla2xxx: Ignore NULL pointer in tcm_qla2xxx_free_mcmd If ABTS cannot be completed in target mode, the driver attempts to free related management command and crashes: NIP [d000000019181ee8] tcm_qla2xxx_free_mcmd+0x40/0x80 [tcm_qla2xxx] LR [d00000001dc1e6f8] qlt_response_pkt+0x190/0xa10 [qla2xxx] Call Trace: [c000003fff27bb50] [c000003fff27bc10] 0xc000003fff27bc10 (unreliable) [c000003fff27bb70] [d00000001dc1e6f8] qlt_response_pkt+0x190/0xa10 [qla2xxx] [c000003fff27bc10] [d00000001dbc2be0] qla24xx_process_response_queue+0x5d8/0xbd0 [qla2xxx] [c000003fff27bd50] [d00000001dbc632c] qla24xx_msix_rsp_q+0x64/0x150 [qla2xxx] [c000003fff27bde0] [c000000000187200] __handle_irq_event_percpu+0x90/0x310 [c000003fff27bea0] [c0000000001874b8] handle_irq_event_percpu+0x38/0x90 [c000003fff27bee0] [c000000000187574] handle_irq_event+0x64/0xb0 [c000003fff27bf10] [c00000000018cd38] handle_fasteoi_irq+0xe8/0x280 [c000003fff27bf40] [c000000000185ccc] generic_handle_irq+0x4c/0x70 [c000003fff27bf60] [c000000000016cec] __do_irq+0x7c/0x1d0 [c000003fff27bf90] [c00000000002a530] call_do_irq+0x14/0x24 [c00000207d2cba90] [c000000000016edc] do_IRQ+0x9c/0x130 [c00000207d2cbae0] [c000000000008bf4] hardware_interrupt_common+0x114/0x120 --- interrupt: 501 at arch_local_irq_restore+0x74/0x90 LR = arch_local_irq_restore+0x74/0x90 [c00000207d2cbdd0] [c0000000001c64fc] tick_broadcast_oneshot_control+0x4c/0x60 (unreliable) [c00000207d2cbdf0] [c0000000007ac840] cpuidle_enter_state+0xf0/0x450 [c00000207d2cbe50] [c00000000016b81c] call_cpuidle+0x4c/0x90 [c00000207d2cbe70] [c00000000016bc30] do_idle+0x2b0/0x330 [c00000207d2cbec0] [c00000000016beec] cpu_startup_entry+0x3c/0x50 [c00000207d2cbef0] [c00000000004a06c] start_secondary+0x63c/0x670 [c00000207d2cbf90] [c00000000000aa6c] start_secondary_prolog+0x10/0x14 The crash can be triggered by ACL deletion when there's active I/O. During ACL deletion, qla2xxx performs implicit LOGO that's invisible for the initiator. Only the driver and firmware are aware of the logout. Therefore the initiator continues to send SCSI commands and the target always responds with SAM STATUS BUSY as it can't find the session. The command times out after a while and initiator invokes ABORT TASK TMF for the command. The TMF is mapped to ABTS-LS in FCP. The target can't find session for S_ID originating ABTS-LS so it never allocates mcmd. And since N_Port handle was deleted after LOGO, it is no longer valid and ABTS Response IOCB is returned from firmware with status 31. Then free_mcmd is invoked on NULL pointer and the kernel crashes. [ 7734.578642] qla2xxx [0000:00:0c.0]-e837:6: ABTS_RECV_24XX: instance 0 [ 7734.578644] qla2xxx [0000:00:0c.0]-f811:6: qla_target(0): task abort (s_id=1:2:0, tag=1209504, param=0) [ 7734.578645] find_sess_by_s_id: 0x010200 [ 7734.578645] Unable to locate s_id: 0x010200 [ 7734.578646] qla2xxx [0000:00:0c.0]-f812:6: qla_target(0): task abort for non-existent session [ 7734.578648] qla2xxx [0000:00:0c.0]-e806:6: Sending task mgmt ABTS response (ha=c0000000d5819000, atio=c0000000d3fd4700, status=4 [ 7734.578730] qla2xxx [0000:00:0c.0]-e838:6: ABTS_RESP_24XX: compl_status 31 [ 7734.578732] qla2xxx [0000:00:0c.0]-e863:6: qla_target(0): ABTS_RESP_24XX failed 31 (subcode 19:a) [ 7734.578740] Unable to handle kernel paging request for data at address 0x00000200 Fixes: 6b0431d6fa20b ("scsi: qla2xxx: Fix out of order Termination and ABTS response") Cc: Quinn Tran Cc: Bart Van Assche Cc: Thomas Abraham Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191125165702.1013-2-r.bolshakov@yadro.com Acked-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Reviewed-by: Bart Van Assche Signed-off-by: Roman Bolshakov Signed-off-by: Martin K. Petersen commit b9ea0bae260f6aae546db224daa6ac1bd9d94b91 Author: Rafael J. Wysocki Date: Wed Dec 4 02:54:27 2019 +0100 ACPI: PM: Avoid attaching ACPI PM domain to certain devices Certain ACPI-enumerated devices represented as platform devices in Linux, like fans, require special low-level power management handling implemented by their drivers that is not in agreement with the ACPI PM domain behavior. That leads to problems with managing ACPI fans during system-wide suspend and resume. For this reason, make acpi_dev_pm_attach() skip the affected devices by adding a list of device IDs to avoid to it and putting the IDs of the affected devices into that list. Fixes: e5cc8ef31267 (ACPI / PM: Provide ACPI PM callback routines for subsystems) Reported-by: Zhang Rui Tested-by: Todd Brandt Cc: 3.10+ # 3.10+ Signed-off-by: Rafael J. Wysocki commit 30388cc075720aa0af4f2cb5933afa1f8f39d313 Author: Guillaume La Roque Date: Thu Dec 5 14:19:00 2019 +0100 arm64: dts: meson-sm1-sei610: add gpio bluetooth interrupt add gpio irq to support interrupt trigger mode. Signed-off-by: Guillaume La Roque Signed-off-by: Kevin Hilman commit 4881873f4cc1460f63d85fa81363d56be328ccdc Author: Martin Blumenstingl Date: Sat Nov 30 19:53:37 2019 +0100 dt-bindings: reset: meson8b: fix duplicate reset IDs According to the public S805 datasheet the RESET2 register uses the following bits for the PIC_DC, PSC and NAND reset lines: - PIC_DC is at bit 3 (meaning: RESET_VD_RMEM + 3) - PSC is at bit 4 (meaning: RESET_VD_RMEM + 4) - NAND is at bit 5 (meaning: RESET_VD_RMEM + 4) Update the reset IDs of these three reset lines so they don't conflict with PIC_DC and map to the actual hardware reset lines. Fixes: 79795e20a184eb ("dt-bindings: reset: Add bindings for the Meson SoC Reset Controller") Signed-off-by: Martin Blumenstingl Signed-off-by: Kevin Hilman commit c67aafd60d7e323fe74bf45fab60148f84cf9b95 Author: Martin Blumenstingl Date: Sat Nov 30 15:58:21 2019 +0100 soc: amlogic: meson-ee-pwrc: propagate errors from pm_genpd_init() pm_genpd_init() can return an error. Propagate the error code to prevent the driver from indicating that it successfully probed while there were errors during pm_genpd_init(). Fixes: eef3c2ba0a42a6 ("soc: amlogic: Add support for Everything-Else power domains controller") Signed-off-by: Martin Blumenstingl Signed-off-by: Kevin Hilman commit 0766d65e6afaea8b80205a468207de9f18cd7ec8 Author: Martin Blumenstingl Date: Sat Nov 30 15:58:20 2019 +0100 soc: amlogic: meson-ee-pwrc: propagate PD provider registration errors of_genpd_add_provider_onecell() can return an error. Propagate the error so the driver registration fails when of_genpd_add_provider_onecell() did not work. Fixes: eef3c2ba0a42a6 ("soc: amlogic: Add support for Everything-Else power domains controller") Signed-off-by: Martin Blumenstingl Signed-off-by: Kevin Hilman commit 9a1b0b9a6dab452fb0e39fe96880c4faf3878369 Author: Bo Wu Date: Sat Dec 7 03:22:46 2019 +0000 scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func When phba->mbox_ext_buf_ctx.seqNum != phba->mbox_ext_buf_ctx.numBuf, dd_data should be freed before return SLI_CONFIG_HANDLED. When lpfc_sli_issue_mbox func return fails, pmboxq should be also freed in job_error tag. Link: https://lore.kernel.org/r/EDBAAA0BBBA2AC4E9C8B6B81DEEE1D6915E7A966@DGGEML525-MBS.china.huawei.com Signed-off-by: Bo Wu Reviewed-by: Zhiqiang Liu Reviewed-by: James Smart Signed-off-by: Martin K. Petersen commit c868907e1ac6a08a17f8fa9ce482c0a496896e9e Author: Michael Hernandez Date: Tue Dec 3 14:36:57 2019 -0800 scsi: qla2xxx: Fix incorrect SFUB length used for Secure Flash Update MB Cmd SFUB length should be in DWORDs when passed to FW. Fixes: 3f006ac342c03 ("scsi: qla2xxx: Secure flash update support for ISP28XX") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191203223657.22109-4-hmadhani@marvell.com Signed-off-by: Michael Hernandez Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit a530bf691f0e4691214562c165e6c8889dc51e57 Author: Michael Hernandez Date: Tue Dec 3 14:36:56 2019 -0800 scsi: qla2xxx: Added support for MPI and PEP regions for ISP28XX This patch adds support for MPI/PEP region updates which is required with secure flash updates for ISP28XX. Fixes: 3f006ac342c0 ("scsi: qla2xxx: Secure flash update support for ISP28XX") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191203223657.22109-3-hmadhani@marvell.com Signed-off-by: Michael Hernandez Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 4e71dcae0c4cd1e9d19b8b3d80214a4bcdca5a42 Author: Himanshu Madhani Date: Tue Dec 3 14:36:55 2019 -0800 scsi: qla2xxx: Correctly retrieve and interpret active flash region ISP27XX/28XX supports multiple flash regions. This patch fixes issue where active flash region was not interpreted correctly during secure flash update process. [mkp: typo] Fixes: 5fa8774c7f38c ("scsi: qla2xxx: Add 28xx flash primary/secondary status/image mechanism") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191203223657.22109-2-hmadhani@marvell.com Signed-off-by: Michael Hernandez Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 991a34593bad5047420d281737b074cc6f821af4 Author: Davide Caratti Date: Mon Dec 9 17:58:52 2019 +0100 tc-testing: unbreak full listing of tdc testcases the following command currently fails: [root@fedora tc-testing]# ./tdc.py -l The following test case IDs are not unique: {'6f5e'} Please correct them before continuing. this happens because there are two tests having the same id: [root@fedora tc-testing]# grep -r 6f5e tc-tests/* tc-tests/actions/pedit.json: "id": "6f5e", tc-tests/filters/basic.json: "id": "6f5e", fix it replacing the latest duplicate id with a brand new one: [root@fedora tc-testing]# sed -i 's/6f5e//1' tc-tests/filters/basic.json [root@fedora tc-testing]# ./tdc.py -i Fixes: 4717b05328ba ("tc-testing: Introduced tdc tests for basic filter") Signed-off-by: Davide Caratti Signed-off-by: David S. Miller commit a288f105a03a7e0e629a8da2b31f34ebf0343ee2 Author: Chuhong Yuan Date: Tue Dec 10 00:22:07 2019 +0800 fjes: fix missed check in fjes_acpi_add fjes_acpi_add() misses a check for platform_device_register_simple(). Add a check to fix it. Fixes: 658d439b2292 ("fjes: Introduce FUJITSU Extended Socket Network Device driver") Signed-off-by: Chuhong Yuan Signed-off-by: David S. Miller commit b43d1f9f7067c6759b1051e8ecb84e82cef569fe Author: Mao Wenan Date: Mon Dec 9 21:31:25 2019 +0800 af_packet: set defaule value for tmo There is softlockup when using TPACKET_V3: ... NMI watchdog: BUG: soft lockup - CPU#2 stuck for 60010ms! (__irq_svc) from [] (_raw_spin_unlock_irqrestore+0x44/0x54) (_raw_spin_unlock_irqrestore) from [] (mod_timer+0x210/0x25c) (mod_timer) from [] (prb_retire_rx_blk_timer_expired+0x68/0x11c) (prb_retire_rx_blk_timer_expired) from [] (call_timer_fn+0x90/0x17c) (call_timer_fn) from [] (run_timer_softirq+0x2d4/0x2fc) (run_timer_softirq) from [] (__do_softirq+0x218/0x318) (__do_softirq) from [] (irq_exit+0x88/0xac) (irq_exit) from [] (msa_irq_exit+0x11c/0x1d4) (msa_irq_exit) from [] (handle_IPI+0x650/0x7f4) (handle_IPI) from [] (gic_handle_irq+0x108/0x118) (gic_handle_irq) from [] (__irq_usr+0x44/0x5c) ... If __ethtool_get_link_ksettings() is failed in prb_calc_retire_blk_tmo(), msec and tmo will be zero, so tov_in_jiffies is zero and the timer expire for retire_blk_timer is turn to mod_timer(&pkc->retire_blk_timer, jiffies + 0), which will trigger cpu usage of softirq is 100%. Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") Tested-by: Xiao Jiangfeng Signed-off-by: Mao Wenan Signed-off-by: David S. Miller commit 8a2b22203f8596729c54eba221b4044351bfe167 Author: Grygorii Strashko Date: Mon Dec 9 13:19:24 2019 +0200 net: ethernet: ti: davinci_cpdma: fix warning "device driver frees DMA memory with different size" The TI CPSW(s) driver produces warning with DMA API debug options enabled: WARNING: CPU: 0 PID: 1033 at kernel/dma/debug.c:1025 check_unmap+0x4a8/0x968 DMA-API: cpsw 48484000.ethernet: device driver frees DMA memory with different size [device address=0x00000000abc6aa02] [map size=64 bytes] [unmap size=42 bytes] CPU: 0 PID: 1033 Comm: ping Not tainted 5.3.0-dirty #41 Hardware name: Generic DRA72X (Flattened Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xd8/0x110) [] (dump_stack) from [] (__warn+0xe0/0x10c) [] (__warn) from [] (warn_slowpath_fmt+0x44/0x6c) [] (warn_slowpath_fmt) from [] (check_unmap+0x4a8/0x968) [] (check_unmap) from [] (debug_dma_unmap_page+0x80/0x90) [] (debug_dma_unmap_page) from [] (__cpdma_chan_free+0x114/0x16c) [] (__cpdma_chan_free) from [] (__cpdma_chan_process+0x158/0x17c) [] (__cpdma_chan_process) from [] (cpdma_chan_process+0x3c/0x5c) [] (cpdma_chan_process) from [] (cpsw_tx_mq_poll+0x48/0x94) [] (cpsw_tx_mq_poll) from [] (net_rx_action+0x108/0x4e4) [] (net_rx_action) from [] (__do_softirq+0xec/0x598) [] (__do_softirq) from [] (do_softirq.part.4+0x68/0x74) [] (do_softirq.part.4) from [] (__local_bh_enable_ip+0x124/0x17c) [] (__local_bh_enable_ip) from [] (ip_finish_output2+0x294/0xb7c) [] (ip_finish_output2) from [] (ip_output+0x210/0x364) [] (ip_output) from [] (ip_send_skb+0x1c/0xf8) [] (ip_send_skb) from [] (raw_sendmsg+0x9a8/0xc74) [] (raw_sendmsg) from [] (sock_sendmsg+0x14/0x24) [] (sock_sendmsg) from [] (__sys_sendto+0xbc/0x100) [] (__sys_sendto) from [] (__sys_trace_return+0x0/0x14) Exception stack(0xea9a7fa8 to 0xea9a7ff0) ... The reason is that cpdma_chan_submit_si() now stores original buffer length (sw_len) in CPDMA descriptor instead of adjusted buffer length (hw_len) used to map the buffer. Hence, fix an issue by passing correct buffer length in CPDMA descriptor. Cc: Ivan Khoronzhuk Fixes: 6670acacd59e ("net: ethernet: ti: davinci_cpdma: add dma mapped submit") Signed-off-by: Grygorii Strashko Reviewed-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit 7da538c1e154635e1f84b2fc41e482680e770844 Merge: f8fc57e8d7c5 7acd9378dc65 Author: David S. Miller Date: Mon Dec 9 14:03:33 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Wait for rcu grace period after releasing netns in ctnetlink, from Florian Westphal. 2) Incorrect command type in flowtable offload ndo invocation, from wenxu. 3) Incorrect callback type in flowtable offload flow tuple updates, also from wenxu. 4) Fix compile warning on flowtable offload infrastructure due to possible reference to uninitialized variable, from Nathan Chancellor. 5) Do not inline nf_ct_resolve_clash(), this is called from slow path / stress situations. From Florian Westphal. 6) Missing IPv6 flow selector description in flowtable offload. 7) Missing check for NETDEV_UNREGISTER in nf_tables offload infrastructure, from wenxu. 8) Update NAT selftest to use randomized netns names, from Florian Westphal. 9) Restore nfqueue bridge support, from Marco Oliverio. 10) Compilation warning in SCTP_CHUNKMAP_*() on xt_sctp header. From Phil Sutter. 11) Fix bogus lookup/get match for non-anonymous rbtree sets. 12) Missing netlink validation for NFT_SET_ELEM_INTERVAL_END elements. 13) Missing netlink validation for NFT_DATA_VALUE after nft_data_init(). 14) If rule specifies no actions, offload infrastructure returns EOPNOTSUPP. 15) Module refcount leak in object updates. 16) Missing sanitization for ARP traffic from br_netfilter, from Eric Dumazet. 17) Compilation breakage on big-endian due to incorrect memcpy() size in the flowtable offload infrastructure. ==================== Signed-off-by: David S. Miller commit 46c9585ed4af688ff1be6d4e76d7ed2f04de4fba Author: Martin Blumenstingl Date: Sun Nov 17 16:41:54 2019 +0100 ARM: dts: meson8: fix the size of the PMU registers The PMU registers are at least 0x18 bytes wide. Meson8b already uses a size of 0x18. The structure of the PMU registers on Meson8 and Meson8b is similar but not identical. Meson8 and Meson8b have the following registers in common (starting at AOBUS + 0xe0): #define AO_RTI_PWR_A9_CNTL0 0xe0 (0x38 << 2) #define AO_RTI_PWR_A9_CNTL1 0xe4 (0x39 << 2) #define AO_RTI_GEN_PWR_SLEEP0 0xe8 (0x3a << 2) #define AO_RTI_GEN_PWR_ISO0 0x4c (0x3b << 2) Meson8b additionally has these three registers: #define AO_RTI_GEN_PWR_ACK0 0xf0 (0x3c << 2) #define AO_RTI_PWR_A9_MEM_PD0 0xf4 (0x3d << 2) #define AO_RTI_PWR_A9_MEM_PD1 0xf8 (0x3e << 2) Thus we can assume that the register size of the PMU IP blocks is identical on both SoCs (and Meson8 just contains some reserved registers in that area) because the CEC registers start right after the PMU (AO_RTI_*) registers at AOBUS + 0x100 (0x40 << 2). The upcoming power domain driver will need to read and write the AO_RTI_GEN_PWR_SLEEP0 and AO_RTI_GEN_PWR_ISO0 registers, so the updated size is needed for that driver to work. Fixes: 4a5a27116b447d ("ARM: dts: meson8: add support for booting the secondary CPU cores") Signed-off-by: Martin Blumenstingl Signed-off-by: Kevin Hilman commit f424da7f78a7fbc17bc66216c2b3664b22d30a27 Author: Kevin Hilman Date: Wed Nov 13 16:41:40 2019 -0800 arm64: dts: meson-sm1-sei610: gpio-keys: switch to IRQs Switch the GPIO buttons/switches to use interrupts instead of polling. While at it, add the mic mute switch and the power button. Signed-off-by: Kevin Hilman commit 6794862a16ef41f753abd75c03a152836e4c8028 Merge: 184b8f7f91ca 78f926f72e43 Author: Linus Torvalds Date: Mon Dec 9 12:14:31 2019 -0800 Merge tag 'for-5.5-rc1-kconfig-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs Kconfig fix from David Sterba: "This adds the config dependency integrating the crypto code and btrfs support for blake2b (added in this dev cycle, via different trees). Without it the option had to be selected manually" * tag 'for-5.5-rc1-kconfig-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: add Kconfig dependency for BLAKE2B commit da08e1e1d7c3f805f8771ad6a6fd3a7a30ba4fe2 Author: Xiubo Li Date: Tue Nov 26 07:24:20 2019 -0500 ceph: add more debug info when decoding mdsmap Show the laggy state. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit bd84fbcb319852f7aeaabc0db5bdeb87e3337bf3 Author: Xiubo Li Date: Tue Dec 3 03:00:51 2019 -0500 ceph: switch to global cap helper __ceph_is_any_caps is a duplicate helper. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit bba1560bd4a46aa0d16bb7d81abd9d0eb47dea36 Author: Xiubo Li Date: Tue Nov 26 07:32:22 2019 -0500 ceph: trigger the reclaim work once there has enough pending caps The nr in ceph_reclaim_caps_nr() is very possibly larger than 1, so we may miss it and the reclaim work couldn't triggered as expected. Signed-off-by: Xiubo Li Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 3a3430affce5de301fc8e6e50fa3543d7597820e Author: Jeff Layton Date: Wed Nov 20 12:00:59 2019 -0500 ceph: show tasks waiting on caps in debugfs caps file Add some visibility of tasks that are waiting for caps to the "caps" debugfs file. Display the tgid of the waiting task, inode number, and the caps the task needs and wants. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit ad8c28a9eb81ca90fda29f48cfb4d19305943737 Author: Jeff Layton Date: Mon Sep 9 15:58:55 2019 -0400 ceph: convert int fields in ceph_mount_options to unsigned int Most of these values should never be negative, so convert them to unsigned values. Add some sanity checking to the parsed values, and clean up some unneeded casts. Note that while caps_max should never be negative, this patch leaves it signed, since this value ends up later being compared to a signed counter. Just ensure that userland never passes in a negative value for caps_max. Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 184b8f7f91ca7938c09533df83ce84817e682975 Merge: 316eaf170252 969bea5e4d8b Author: Linus Torvalds Date: Mon Dec 9 11:48:21 2019 -0800 Merge tag 'printk-for-5.5-pr-warning-removal' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk Pull pr_warning() removal from Petr Mladek. - Final removal of the unused pr_warning() alias. You're supposed to use just "pr_warn()" in the kernel. * tag 'printk-for-5.5-pr-warning-removal' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk: checkpatch: Drop pr_warning check printk: Drop pr_warning definition Fix up for "printk: Drop pr_warning definition" workqueue: Use pr_warn instead of pr_warning commit 7acd9378dc65296b2531758aa62ee9bcf55b371c Author: Pablo Neira Ayuso Date: Sat Dec 7 18:38:12 2019 +0100 netfilter: nf_flow_table_offload: Correct memcpy size for flow_overload_mangle() In function 'memcpy', inlined from 'flow_offload_mangle' at net/netfilter/nf_flow_table_offload.c:112:2, inlined from 'flow_offload_port_dnat' at net/netfilter/nf_flow_table_offload.c:373:2, inlined from 'nf_flow_rule_route_ipv4' at net/netfilter/nf_flow_table_offload.c:424:3: ./include/linux/string.h:376:4: error: call to '__read_overflow2' declared with attribute error: detected read beyond size of object passed as 2nd parameter 376 | __read_overflow2(); | ^~~~~~~~~~~~~~~~~~ The original u8* was done in the hope to make this more adaptable but consensus is to keep this like it is in tc pedit. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Reported-by: Laura Abbott Signed-off-by: Pablo Neira Ayuso commit 480136343cbe89426d6c2ab74ffb4e3ee572c7ee Author: Takashi Sakamoto Date: Tue Dec 10 00:05:41 2019 +0900 ALSA: fireface: fix return value in error path of isochronous resources reservation Even if isochronous resources reservation fails, error code doesn't return in pcm.hw_params callback. Cc: #5.3+ Fixes: 55162d2bb0e8 ("ALSA: fireface: reserve/release isochronous resources in pcm.hw_params/hw_free callbacks") Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20191209151655.GA8090@workstation Signed-off-by: Takashi Iwai commit 59a126aa3113fc23f03fedcafe3705f1de5aff50 Author: Takashi Sakamoto Date: Tue Dec 10 00:03:04 2019 +0900 ALSA: oxfw: fix return value in error path of isochronous resources reservation Even if isochronous resources reservation fails, error code doesn't return in pcm.hw_params callback. Cc: #5.3+ Fixes: 4f380d007052 ("ALSA: oxfw: configure packet format in pcm.hw_params callback") Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20191209151655.GA8090@workstation Signed-off-by: Takashi Iwai commit 316eaf170252f3b50e0d7d5d17ac1f0ee8ae70ef Merge: e42617b825f8 6e456dca47c5 Author: Linus Torvalds Date: Mon Dec 9 10:59:00 2019 -0800 Merge tag 'thermal-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal fixes from Zhang Rui: "Starting from this release cycle, we have Daniel Lezcano work as the new thermal co-maintainer because Eduardo's email is bouncing for sometime and we can not reach him. We also have a new shared git tree so that both Daniel and I can actively working on it. Specifics: - Update MAINTAINER file for new thermal co-maintainer and new thermal git tree address. (Daniel Lezcano, Florian Fainelli, Zhang Rui) - Fix a Kconfig warning. (YueHaibing)" * tag 'thermal-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: MAINTAINERS: thermal: Change the git tree location MAINTAINERS: thermal: Add Daniel Lezcano as the thermal maintainer MAINTAINERS: thermal: Eduardo's email is bouncing thermal: power_allocator: Fix Kconfig warning commit 2030abddec6884aaf5892f5724c48fc340e6826f Author: Steve Wise Date: Mon Dec 2 20:03:20 2019 -0600 rxe: correctly calculate iCRC for unaligned payloads If RoCE PDUs being sent or received contain pad bytes, then the iCRC is miscalculated, resulting in PDUs being emitted by RXE with an incorrect iCRC, as well as ingress PDUs being dropped due to erroneously detecting a bad iCRC in the PDU. The fix is to include the pad bytes, if any, in iCRC computations. Note: This bug has caused broken on-the-wire compatibility with actual hardware RoCE devices since the soft-RoCE driver was first put into the mainstream kernel. Fixing it will create an incompatibility with the original soft-RoCE devices, but is necessary to be compatible with real hardware devices. Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Steve Wise Link: https://lore.kernel.org/r/20191203020319.15036-2-larrystevenwise@gmail.com Signed-off-by: Doug Ledford commit 71bbac6e2f23e946875475ce2fb9f6752900d463 Author: Steve Wise Date: Mon Dec 2 20:03:18 2019 -0600 Update mailmap info for Steve Wise Signed-off-by: Steve Wise Link: https://lore.kernel.org/r/20191203020319.15036-1-larrystevenwise@gmail.com Signed-off-by: Doug Ledford commit 3194d2533efffae8b815d84729ecc58b6a9000ab Author: Christophe Leroy Date: Mon Dec 9 15:27:27 2019 +0000 spi: fsl: don't map irq during probe With lastest kernel, the following warning is observed at startup: [ 1.500609] ------------[ cut here ]------------ [ 1.505225] remove_proc_entry: removing non-empty directory 'irq/22', leaking at least 'fsl_spi' [ 1.514234] WARNING: CPU: 0 PID: 1 at fs/proc/generic.c:682 remove_proc_entry+0x198/0x1c0 [ 1.522403] CPU: 0 PID: 1 Comm: swapper Not tainted 5.4.0-s3k-dev-02248-g93532430a4ff #2564 [ 1.530724] NIP: c0197694 LR: c0197694 CTR: c0050d80 [ 1.535762] REGS: df4a5af0 TRAP: 0700 Not tainted (5.4.0-02248-g93532430a4ff) [ 1.543818] MSR: 00029032 CR: 22028222 XER: 00000000 [ 1.550524] [ 1.550524] GPR00: c0197694 df4a5ba8 df4a0000 00000054 00000000 00000000 00004a38 00000010 [ 1.550524] GPR08: c07c5a30 00000800 00000000 00001032 22000208 00000000 c0004b14 00000000 [ 1.550524] GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 c0830000 c07fc078 [ 1.550524] GPR24: c08e8ca0 df665d10 df60ea98 c07c9db8 00000001 df5d5ae3 df5d5a80 df43f8e3 [ 1.585327] NIP [c0197694] remove_proc_entry+0x198/0x1c0 [ 1.590628] LR [c0197694] remove_proc_entry+0x198/0x1c0 [ 1.595829] Call Trace: [ 1.598280] [df4a5ba8] [c0197694] remove_proc_entry+0x198/0x1c0 (unreliable) [ 1.605321] [df4a5bd8] [c0067acc] unregister_irq_proc+0x5c/0x70 [ 1.611238] [df4a5bf8] [c005fbc4] free_desc+0x3c/0x80 [ 1.616286] [df4a5c18] [c005fe2c] irq_free_descs+0x70/0xa8 [ 1.621778] [df4a5c38] [c033d3fc] of_fsl_spi_probe+0xdc/0x3cc [ 1.627525] [df4a5c88] [c02f0f64] platform_drv_probe+0x44/0xa4 [ 1.633350] [df4a5c98] [c02eee44] really_probe+0x1ac/0x418 [ 1.638829] [df4a5cc8] [c02ed3e8] bus_for_each_drv+0x64/0xb0 [ 1.644481] [df4a5cf8] [c02ef950] __device_attach+0xd4/0x128 [ 1.650132] [df4a5d28] [c02ed61c] bus_probe_device+0xa0/0xbc [ 1.655783] [df4a5d48] [c02ebbe8] device_add+0x544/0x74c [ 1.661096] [df4a5d88] [c0382b78] of_platform_device_create_pdata+0xa4/0x100 [ 1.668131] [df4a5da8] [c0382cf4] of_platform_bus_create+0x120/0x20c [ 1.674474] [df4a5df8] [c0382d50] of_platform_bus_create+0x17c/0x20c [ 1.680818] [df4a5e48] [c0382e88] of_platform_bus_probe+0x9c/0xf0 [ 1.686907] [df4a5e68] [c0751404] __machine_initcall_cmpcpro_cmpcpro_declare_of_platform_devices+0x74/0x1a4 [ 1.696629] [df4a5e98] [c072a4cc] do_one_initcall+0x8c/0x1d4 [ 1.702282] [df4a5ef8] [c072a768] kernel_init_freeable+0x154/0x204 [ 1.708455] [df4a5f28] [c0004b2c] kernel_init+0x18/0x110 [ 1.713769] [df4a5f38] [c00122ac] ret_from_kernel_thread+0x14/0x1c [ 1.719926] Instruction dump: [ 1.722889] 2c030000 4182004c 3863ffb0 3c80c05f 80e3005c 388436a0 3c60c06d 7fa6eb78 [ 1.730630] 7fe5fb78 38840280 38634178 4be8c611 <0fe00000> 4bffff6c 3c60c071 7fe4fb78 [ 1.738556] ---[ end trace 05d0720bf2e352e2 ]--- The problem comes from the error path which calls irq_dispose_mapping() while the IRQ has been requested with devm_request_irq(). IRQ doesn't need to be mapped with irq_of_parse_and_map(). The only need is to get the IRQ virtual number. For that, use of_irq_to_resource() instead of the irq_of_parse_and_map()/irq_dispose_mapping() pair. Fixes: 500a32abaf81 ("spi: fsl: Call irq_dispose_mapping in err path") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Link: https://lore.kernel.org/r/518cfb83347d5372748e7fe72f94e2e9443d0d4a.1575905123.git.christophe.leroy@c-s.fr Signed-off-by: Mark Brown commit a841e2853e1afecc2ee692b8cc5bff606bc84e4c Author: Chuhong Yuan Date: Fri Dec 6 15:55:00 2019 +0800 spi: spi-cavium-thunderx: Add missing pci_release_regions() The driver forgets to call pci_release_regions() in probe failure and remove. Add the missed calls to fix it. Signed-off-by: Chuhong Yuan Link: https://lore.kernel.org/r/20191206075500.18525-1-hslester96@gmail.com Signed-off-by: Mark Brown commit 6d30fc511bec82dd8801b9bb8718cbeea1366ad8 Author: Cristian Marussi Date: Mon Dec 9 12:52:39 2019 +0000 regulator: core: avoid unneeded .list_voltage calls Inside machine_constraints_voltage() a loop is in charge of verifying that each of the defined voltages are within the configured constraints and that those constraints are in fact compatible with the available voltages' list. When the registered regulator happens to be defined with a wide range of possible voltages the above O(n) loop can be costly. Moreover since this behaviour is triggered during the registration process, it means also that it can be easily triggered at probe time, slowing down considerably some module loading. On the other side if such wide range of voltage values happens to be also continuous and without discontinuity of any kind, the above potentially cumbersome operation is also useless. For these reasons, avoid such .list_voltage poll loop when regulator is described as 'continuous_voltage_range' as is, indeed, similarly already done inside regulator_is_supported_voltage(). Signed-off-by: Cristian Marussi Link: https://lore.kernel.org/r/20191209125239.46054-1-cristian.marussi@arm.com Signed-off-by: Mark Brown commit cd4c2493fa588e43ad9e066594698c9bd55d28a4 Author: Mike Rapoport Date: Mon Dec 9 17:31:35 2019 +0200 ARC: mm: drop stale define of __ARCH_USE_5LEVEL_HACK Commit 6aae3425aa9c ("ARC: mm: remove __ARCH_USE_5LEVEL_HACK") make ARC paging code 5-level compliant but left behind a stale define of __ARCH_USE_5LEVEL_HACK in arch/arc/include/asm/hugepage.h. Remove it. Signed-off-by: Mike Rapoport Signed-off-by: Vineet Gupta commit 1928b36cfa4df1aeedf5f2644d0c33f3a1fcfd7b Author: Randy Dunlap Date: Tue Nov 26 17:54:09 2019 -0800 arc: eznps: fix allmodconfig kconfig warning Fix kconfig warning for arch/arc/plat-eznps/Kconfig allmodconfig: WARNING: unmet direct dependencies detected for CLKSRC_NPS Depends on [n]: GENERIC_CLOCKEVENTS [=y] && !PHYS_ADDR_T_64BIT [=y] Selected by [y]: - ARC_PLAT_EZNPS [=y] Signed-off-by: Randy Dunlap Cc: Vineet Gupta Cc: Ofer Levi Cc: linux-snps-arc@lists.infradead.org Signed-off-by: Vineet Gupta commit c593642c8be046915ca3a4a300243a68077cd207 Author: Pankaj Bharadiya Date: Mon Dec 9 10:31:43 2019 -0800 treewide: Use sizeof_field() macro Replace all the occurrences of FIELD_SIZEOF() with sizeof_field() except at places where these are defined. Later patches will remove the unused definition of FIELD_SIZEOF(). This patch is generated using following script: EXCLUDE_FILES="include/linux/stddef.h|include/linux/kernel.h" git grep -l -e "\bFIELD_SIZEOF\b" | while read file; do if [[ "$file" =~ $EXCLUDE_FILES ]]; then continue fi sed -i -e 's/\bFIELD_SIZEOF\b/sizeof_field/g' $file; done Signed-off-by: Pankaj Bharadiya Link: https://lore.kernel.org/r/20190924105839.110713-3-pankaj.laxminarayan.bharadiya@intel.com Co-developed-by: Kees Cook Signed-off-by: Kees Cook Acked-by: David Miller # for net commit e43723292d6d7f217b572aab07f1f165189a1b56 Author: Pankaj Bharadiya Date: Tue Sep 24 16:28:37 2019 +0530 MIPS: OCTEON: Replace SIZEOF_FIELD() macro Switch to the standard sizeof_field() macro to find the size of a member of a struct and remove the custom SIZEOF_FIELD() macro. Signed-off-by: Pankaj Bharadiya Link: https://lore.kernel.org/r/20190924105839.110713-4-pankaj.laxminarayan.bharadiya@intel.com Co-developed-by: Kees Cook Signed-off-by: Kees Cook commit f8fc57e8d7c5d95f4180b127d3b167de403557c0 Author: Martin Schiller Date: Mon Dec 9 08:21:34 2019 +0100 net/x25: add new state X25_STATE_5 This is needed, because if the flag X25_ACCPT_APPRV_FLAG is not set on a socket (manual call confirmation) and the channel is cleared by remote before the manual call confirmation was sent, this situation needs to be handled. Signed-off-by: Martin Schiller Signed-off-by: David S. Miller commit 99e51aa8f70137310496f98937cfeecac0529a5a Author: Brendan Higgins Date: Tue Nov 19 17:17:00 2019 -0800 Documentation: kunit: add documentation for kunit_tool Add documentation for the Python script used to build, run, and collect results from the kernel known as kunit_tool. kunit_tool (tools/testing/kunit/kunit.py) was already added in previous commits. Signed-off-by: Brendan Higgins Reviewed-by: David Gow Cc: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Shuah Khan commit e7d7ad0e413f14f191b75d39e2c4a9dbf2683a71 Author: Brendan Higgins Date: Tue Nov 19 15:38:10 2019 -0800 Documentation: kunit: fix typos and gramatical errors Fix typos and gramatical errors in the Getting Started and Usage guide for KUnit. Reported-by: Randy Dunlap Link: https://patchwork.kernel.org/patch/11156481/ Reported-by: Rinat Ibragimov Link: https://github.com/google/kunit-docs/issues/1 Signed-off-by: Brendan Higgins Reviewed-by: David Gow Acked-by: Randy Dunlap Signed-off-by: Shuah Khan commit 70efb58bbbc28f0cbd4060c9aa581d79201c8b1a Author: Heidi Fahim Date: Mon Dec 2 15:53:29 2019 -0800 kunit: testing kunit: Bug fix in test_run_timeout function Assert in test_run_timeout was not updated with the build_dir argument and caused the following error: AssertionError: Expected call: run_kernel(timeout=3453) Actual call: run_kernel(build_dir=None, timeout=3453) Needed to update kunit_tool_test to reflect this fix https://lkml.org/lkml/2019/9/6/351 Signed-off-by: Heidi Fahim Reviewed-by: SeongJae Park Reviewed-by: Brendan Higgins Tested-by: Brendan Higgins Signed-off-by: Shuah Khan commit 65cb13986229cec02635a1ecbcd1e2dd18353201 Author: Ido Schimmel Date: Mon Dec 9 08:56:34 2019 +0200 selftests: forwarding: Delete IPv6 address at the end When creating the second host in h2_create(), two addresses are assigned to the interface, but only one is deleted. When running the test twice in a row the following error is observed: $ ./router_bridge_vlan.sh TEST: ping [ OK ] TEST: ping6 [ OK ] TEST: vlan [ OK ] $ ./router_bridge_vlan.sh RTNETLINK answers: File exists TEST: ping [ OK ] TEST: ping6 [ OK ] TEST: vlan [ OK ] Fix this by deleting the address during cleanup. Fixes: 5b1e7f9ebd56 ("selftests: forwarding: Test routed bridge interface") Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 62201c00c4679ad8f0730d6d925a5d23651dfad2 Author: Ido Schimmel Date: Mon Dec 9 08:55:20 2019 +0200 mlxsw: spectrum_router: Remove unlikely user-triggerable warning In case the driver vetoes the addition of an IPv6 multipath route, the IPv6 stack will emit delete notifications for the sibling routes that were already added to the FIB trie. Since these siblings are not present in hardware, a warning will be generated. Have the driver ignore notifications for routes it does not have. Fixes: ebee3cad835f ("ipv6: Add IPv6 multipath notifications for add / replace") Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit b6f3320b1d5267e7b583a6d0c88dda518101740c Author: Xin Long Date: Mon Dec 9 13:45:54 2019 +0800 sctp: fully initialize v4 addr in some functions Syzbot found a crash: BUG: KMSAN: uninit-value in crc32_body lib/crc32.c:112 [inline] BUG: KMSAN: uninit-value in crc32_le_generic lib/crc32.c:179 [inline] BUG: KMSAN: uninit-value in __crc32c_le_base+0x4fa/0xd30 lib/crc32.c:202 Call Trace: crc32_body lib/crc32.c:112 [inline] crc32_le_generic lib/crc32.c:179 [inline] __crc32c_le_base+0x4fa/0xd30 lib/crc32.c:202 chksum_update+0xb2/0x110 crypto/crc32c_generic.c:90 crypto_shash_update+0x4c5/0x530 crypto/shash.c:107 crc32c+0x150/0x220 lib/libcrc32c.c:47 sctp_csum_update+0x89/0xa0 include/net/sctp/checksum.h:36 __skb_checksum+0x1297/0x12a0 net/core/skbuff.c:2640 sctp_compute_cksum include/net/sctp/checksum.h:59 [inline] sctp_packet_pack net/sctp/output.c:528 [inline] sctp_packet_transmit+0x40fb/0x4250 net/sctp/output.c:597 sctp_outq_flush_transports net/sctp/outqueue.c:1146 [inline] sctp_outq_flush+0x1823/0x5d80 net/sctp/outqueue.c:1194 sctp_outq_uncork+0xd0/0xf0 net/sctp/outqueue.c:757 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1781 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1184 [inline] sctp_do_sm+0x8fe1/0x9720 net/sctp/sm_sideeffect.c:1155 sctp_primitive_REQUESTHEARTBEAT+0x175/0x1a0 net/sctp/primitive.c:185 sctp_apply_peer_addr_params+0x212/0x1d40 net/sctp/socket.c:2433 sctp_setsockopt_peer_addr_params net/sctp/socket.c:2686 [inline] sctp_setsockopt+0x189bb/0x19090 net/sctp/socket.c:4672 The issue was caused by transport->ipaddr set with uninit addr param, which was passed by: sctp_transport_init net/sctp/transport.c:47 [inline] sctp_transport_new+0x248/0xa00 net/sctp/transport.c:100 sctp_assoc_add_peer+0x5ba/0x2030 net/sctp/associola.c:611 sctp_process_param net/sctp/sm_make_chunk.c:2524 [inline] where 'addr' is set by sctp_v4_from_addr_param(), and it doesn't initialize the padding of addr->v4. Later when calling sctp_make_heartbeat(), hbinfo.daddr(=transport->ipaddr) will become the part of skb, and the issue occurs. This patch is to fix it by initializing the padding of addr->v4 in sctp_v4_from_addr_param(), as well as other functions that do the similar thing, and these functions shouldn't trust that the caller initializes the memory, as Marcelo suggested. Reported-by: syzbot+6dcbfea81cd3d4dd0b02@syzkaller.appspotmail.com Signed-off-by: Xin Long Acked-by: Neil Horman Signed-off-by: David S. Miller commit 39101b2265440dfe83646a4bfc33015c86f36d71 Author: Iurii Zaikin Date: Wed Nov 27 10:55:24 2019 -0800 fs/ext4/inode-test: Fix inode test on 32 bit platforms. Fixes the issue caused by the fact that in C in the expression of the form -1234L only 1234L is the actual literal, the unary minus is an operation applied to the literal. Which means that to express the lower bound for the type one has to negate the upper bound and subtract 1. Original error: Expected test_data[i].expected.tv_sec == timestamp.tv_sec, but test_data[i].expected.tv_sec == -2147483648 timestamp.tv_sec == 2147483648 1901-12-13 Lower bound of 32bit < 0 timestamp, no extra bits: msb:1 lower_bound:1 extra_bits: 0 Expected test_data[i].expected.tv_sec == timestamp.tv_sec, but test_data[i].expected.tv_sec == 2147483648 timestamp.tv_sec == 6442450944 2038-01-19 Lower bound of 32bit <0 timestamp, lo extra sec bit on: msb:1 lower_bound:1 extra_bits: 1 Expected test_data[i].expected.tv_sec == timestamp.tv_sec, but test_data[i].expected.tv_sec == 6442450944 timestamp.tv_sec == 10737418240 2174-02-25 Lower bound of 32bit <0 timestamp, hi extra sec bit on: msb:1 lower_bound:1 extra_bits: 2 not ok 1 - inode_test_xtimestamp_decoding not ok 1 - ext4_inode_test Reported-by: Geert Uytterhoeven Signed-off-by: Iurii Zaikin Tested-by: Geert Uytterhoeven Acked-by: Brendan Higgins Signed-off-by: Shuah Khan commit fac2c2da3596d77c343988bb0d41a8c533b2e73c Author: Florian Fainelli Date: Fri Dec 6 10:19:09 2019 -0800 ARM: dts: Cygnus: Fix MDIO node address/size cells The MDIO node on Cygnus had an reversed #address-cells and #size-cells properties, correct those. Fixes: 40c26d3af60a ("ARM: dts: Cygnus: Add the ethernet switch and ethernet PHY") Reported-by: Simon Horman Reviewed-by: Ray Jui Reviewed-by: Simon Horman Signed-off-by: Florian Fainelli commit 0634a2dc9566de977970c78a06c7ea15cd9c890f Author: Nicolas Saenz Julienne Date: Wed Dec 4 13:56:33 2019 +0100 ARM: dts: bcm2711: fix soc's node dma-ranges Raspberry Pi's firmware has a feature to select how much memory to reserve for its GPU called 'gpu_mem'. The possible values go from 16MB to 944MB, with a default of 64MB. This memory resides in the topmost part of the lower 1GB memory area and grows bigger expanding towards the begging of memory. It turns out that with low 'gpu_mem' values (16MB and 32MB) the size of the memory available to the system in the lower 1GB area can outgrow the interconnect's dma-range as its size was selected based on the maximum system memory available given the default gpu_mem configuration. This makes that memory slice unavailable for DMA. And may cause nasty kernel warnings if CMA happens to include it. Change soc's dma-ranges to really reflect it's HW limitation, which is being able to only DMA to the lower 1GB area. Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") Signed-off-by: Nicolas Saenz Julienne Reviewed-by: Phil Elwell Signed-off-by: Florian Fainelli commit a2315d3aea5976acd919d3d3fcf82f752562c25b Author: Marek Szyprowski Date: Fri Dec 6 13:47:21 2019 +0100 ARM: exynos_defconfig: Restore debugfs support Commit 9f532d26c75c ("ARM: exynos_defconfig: Trim and reorganize with savedefconfig") removed explicit enable line for CONFIG_DEBUG_FS, because that feature has been selected by other enabled options: CONFIG_TRACING, which in turn had been selected by CONFIG_PERF_EVENTS and CONFIG_PROVE_LOCKING. In meantime, commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") removed the dependency between CONFIG_DEBUG_FS and CONFIG_TRACING, so CONFIG_DEBUG_FS is no longer enabled in default builds. Enable it again explicitly, as debugfs support is essential for various automated testing tools. Signed-off-by: Marek Szyprowski Signed-off-by: Krzysztof Kozlowski commit 94fd07925577caaaec9e0efd60c173959600de13 Author: Krzysztof Kozlowski Date: Thu Dec 5 21:04:22 2019 +0100 MAINTAINERS: Include Samsung SoC serial driver in Samsung SoC entry Samsung SoC (S3C, S5P and Exynos) serial driver does not have dedicated reviewing person so some patches might be missed be Samsung-related folks (e.g. not even reaching Samsung SoC mailing list). Include them in generic Samsung SoC maintainer entry to provide some level of reviewing and care. This will not change handling of patches (via serial tree). Cc: Greg Kroah-Hartman Cc: Jiri Slaby Signed-off-by: Krzysztof Kozlowski commit 702600eef73033ddd4eafcefcbb6560f3e3a90f7 Author: Greg Kroah-Hartman Date: Fri Dec 6 16:26:00 2019 +0100 lib: raid6: fix awk build warnings Newer versions of awk spit out these fun warnings: awk: ../lib/raid6/unroll.awk:16: warning: regexp escape sequence `\#' is not a known regexp operator As commit 700c1018b86d ("x86/insn: Fix awk regexp warnings") showed, it turns out that there are a number of awk strings that do not need to be escaped and newer versions of awk now warn about this. Fix the string up so that no warning is produced. The exact same kernel module gets created before and after this patch, showing that it wasn't needed. Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20191206152600.GA75093@kroah.com Signed-off-by: Greg Kroah-Hartman commit 8ef1ec0ca32c6f8a87f5b4c24b1db26da67c5609 Author: Masami Hiramatsu Date: Thu Dec 5 21:21:16 2019 +0900 selftests: safesetid: Fix Makefile to set correct test program Fix Makefile to set safesetid-test.sh to TEST_PROGS instead of non existing run_tests.sh. Without this fix, I got following error. ---- TAP version 13 1..1 # selftests: safesetid: run_tests.sh # Warning: file run_tests.sh is missing! not ok 1 selftests: safesetid: run_tests.sh ---- Fixes: c67e8ec03f3f ("LSM: SafeSetID: add selftest") Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan commit 295c4e21cf27ac9af542140e3e797df9e0cf7b5f Author: Masami Hiramatsu Date: Thu Dec 5 21:21:07 2019 +0900 selftests: safesetid: Check the return value of setuid/setgid Check the return value of setuid() and setgid(). This fixes the following warnings and improves test result. safesetid-test.c: In function ‘main’: safesetid-test.c:294:2: warning: ignoring return value of ‘setuid’, declared with attribute warn_unused_result [-Wunused-result] setuid(NO_POLICY_USER); ^~~~~~~~~~~~~~~~~~~~~~ safesetid-test.c:295:2: warning: ignoring return value of ‘setgid’, declared with attribute warn_unused_result [-Wunused-result] setgid(NO_POLICY_USER); ^~~~~~~~~~~~~~~~~~~~~~ safesetid-test.c:309:2: warning: ignoring return value of ‘setuid’, declared with attribute warn_unused_result [-Wunused-result] setuid(RESTRICTED_PARENT); ^~~~~~~~~~~~~~~~~~~~~~~~~ safesetid-test.c:310:2: warning: ignoring return value of ‘setgid’, declared with attribute warn_unused_result [-Wunused-result] setgid(RESTRICTED_PARENT); ^~~~~~~~~~~~~~~~~~~~~~~~~ safesetid-test.c: In function ‘test_setuid’: safesetid-test.c:216:3: warning: ignoring return value of ‘setuid’, declared with attribute warn_unused_result [-Wunused-result] setuid(child_uid); ^~~~~~~~~~~~~~~~~ Fixes: c67e8ec03f3f ("LSM: SafeSetID: add selftest") Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan commit be12252212fa3dfed6e75112865095c484c0ce87 Author: Masami Hiramatsu Date: Thu Dec 5 21:20:58 2019 +0900 selftests: safesetid: Move link library to LDLIBS Move -lcap to LDLIBS from CFLAGS because it is a library to be linked. Without this, safesetid failed to build with link error as below. ---- /usr/bin/ld: /tmp/ccL8rZHT.o: in function `drop_caps': safesetid-test.c:(.text+0xe7): undefined reference to `cap_get_proc' /usr/bin/ld: safesetid-test.c:(.text+0x107): undefined reference to `cap_set_flag' /usr/bin/ld: safesetid-test.c:(.text+0x10f): undefined reference to `cap_set_proc' /usr/bin/ld: safesetid-test.c:(.text+0x117): undefined reference to `cap_free' /usr/bin/ld: safesetid-test.c:(.text+0x136): undefined reference to `cap_clear' collect2: error: ld returned 1 exit status ---- Fixes: c67e8ec03f3f ("LSM: SafeSetID: add selftest") Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan commit 5cc6c8d4a99d0ee4d5466498e258e593df1d3eb6 Author: Masami Hiramatsu Date: Tue Nov 26 17:34:42 2019 +0900 selftests/ftrace: Fix multiple kprobe testcase Fix multiple kprobe event testcase to work it correctly. There are 2 bugfixes. - Since `wc -l FILE` returns not only line number but also FILE filename, following "if" statement always failed. Fix this bug by replacing it with 'cat FILE | wc -l' - Since "while do-done loop" block with pipeline becomes a subshell, $N local variable is not update outside of the loop. Fix this bug by using actual target number (256) instead of $N. Signed-off-by: Masami Hiramatsu Reviewed-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan commit ba1b9c5048e43716921abe3a1db19cebebf4a5f5 Author: Masami Hiramatsu Date: Tue Nov 26 17:34:33 2019 +0900 selftests/ftrace: Do not to use absolute debugfs path Use relative path to trigger file instead of absolute debugfs path, because if the user uses tracefs instead of debugfs, it can be mounted at /sys/kernel/tracing. Anyway, since the ftracetest is designed to be run at the tracing directory, user doesn't need to use absolute path. Signed-off-by: Masami Hiramatsu Reviewed-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan commit 25deae098e748d8d36bc35129a66734b8f6925c9 Author: Masami Hiramatsu Date: Wed Nov 27 08:42:21 2019 +0900 selftests/ftrace: Fix ftrace test cases to check unsupported Since dynamic function tracer can be disabled, set_ftrace_filter can be disappeared. Test cases which depends on it, must check whether the set_ftrace_filter exists or not before testing and if not, return as unsupported. Also, if the function tracer itself is disabled, we can not set "function" to current_tracer. Test cases must check it before testing, and return as unsupported. Signed-off-by: Masami Hiramatsu Reviewed-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan commit fd1baf6ca2ea3550ea47f2bb0bdcf34ec764a779 Author: Masami Hiramatsu Date: Tue Nov 26 17:34:16 2019 +0900 selftests/ftrace: Fix to check the existence of set_ftrace_filter If we run ftracetest on the kernel with CONFIG_DYNAMIC_FTRACE=n, there is no set_ftrace_filter and all test cases are failed, because reset_ftrace_filter() returns an error. Let's check whether set_ftrace_filter exists in reset_ftrace_filter() and clean up only set_ftrace_notrace in initialize_ftrace(). Signed-off-by: Masami Hiramatsu Reviewed-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan commit af3ea3c126ac677dbeae1b93868f69f928bccc13 Author: Lukasz Luba Date: Mon Dec 9 09:39:07 2019 +0000 MAINTAINERS: Update Lukasz Luba's email address Update Lukasz Luba's email address to @arm.com in MAINTAINERS and map it correctly in .mailmap file. Signed-off-by: Lukasz Luba Signed-off-by: Krzysztof Kozlowski commit 9e99bfefdbce2e23ef37487a3bcb4adf90a791d1 Author: Eric Dumazet Date: Sat Dec 7 14:10:34 2019 -0800 bonding: fix bond_neigh_init() 1) syzbot reported an uninit-value in bond_neigh_setup() [1] bond_neigh_setup() uses a temporary on-stack 'struct neigh_parms parms', but only clears parms.neigh_setup field. A stacked bonding device would then enter bond_neigh_setup() and read garbage from parms->dev. If we get really unlucky and garbage is matching @dev, then we could recurse and eventually crash. Let's make sure the whole structure is cleared to avoid surprises. 2) bond_neigh_setup() can be called while another cpu manipulates the master device, removing or adding a slave. We need at least rcu protection to prevent use-after-free. Note: Prior code does not support a stack of bonding devices, this patch does not attempt to fix this, and leave a comment instead. [1] BUG: KMSAN: uninit-value in bond_neigh_setup+0xa4/0x110 drivers/net/bonding/bond_main.c:3655 CPU: 0 PID: 11256 Comm: syz-executor.0 Not tainted 5.4.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108 __msan_warning+0x57/0xa0 mm/kmsan/kmsan_instr.c:245 bond_neigh_setup+0xa4/0x110 drivers/net/bonding/bond_main.c:3655 bond_neigh_init+0x216/0x4b0 drivers/net/bonding/bond_main.c:3626 ___neigh_create+0x169e/0x2c40 net/core/neighbour.c:613 __neigh_create+0xbd/0xd0 net/core/neighbour.c:674 ip6_finish_output2+0x149a/0x2670 net/ipv6/ip6_output.c:113 __ip6_finish_output+0x83d/0x8f0 net/ipv6/ip6_output.c:142 ip6_finish_output+0x2db/0x420 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0x5d3/0x720 net/ipv6/ip6_output.c:175 dst_output include/net/dst.h:436 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] mld_sendpack+0xebd/0x13d0 net/ipv6/mcast.c:1682 mld_send_cr net/ipv6/mcast.c:1978 [inline] mld_ifc_timer_expire+0x116b/0x1680 net/ipv6/mcast.c:2477 call_timer_fn+0x232/0x530 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers+0xd60/0x1270 kernel/time/timer.c:1773 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1786 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 invoke_softirq kernel/softirq.c:375 [inline] irq_exit+0x230/0x280 kernel/softirq.c:416 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:536 smp_apic_timer_interrupt+0x48/0x70 arch/x86/kernel/apic/apic.c:1138 apic_timer_interrupt+0x2e/0x40 arch/x86/entry/entry_64.S:835 RIP: 0010:kmsan_free_page+0x18d/0x1c0 mm/kmsan/kmsan_shadow.c:439 Code: 4c 89 ff 44 89 f6 e8 82 0d ee ff 65 ff 0d 9f 26 3b 60 65 8b 05 98 26 3b 60 85 c0 75 24 e8 5b f6 35 ff 4c 89 6d d0 ff 75 d0 9d <48> 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 0f 0b 0f 0b 0f RSP: 0018:ffffb328034af818 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000000 RBX: ffffe2d7471f8360 RCX: 0000000000000000 RDX: ffffffffadea7000 RSI: 0000000000000004 RDI: ffff93496fcda104 RBP: ffffb328034af850 R08: ffff934a47e86d00 R09: ffff93496fc41900 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000246 R14: 0000000000000000 R15: ffffe2d7472225c0 free_pages_prepare mm/page_alloc.c:1138 [inline] free_pcp_prepare mm/page_alloc.c:1230 [inline] free_unref_page_prepare+0x1d9/0x770 mm/page_alloc.c:3025 free_unref_page mm/page_alloc.c:3074 [inline] free_the_page mm/page_alloc.c:4832 [inline] __free_pages+0x154/0x230 mm/page_alloc.c:4840 __vunmap+0xdac/0xf20 mm/vmalloc.c:2277 __vfree mm/vmalloc.c:2325 [inline] vfree+0x7c/0x170 mm/vmalloc.c:2355 copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:883 [inline] get_entries net/ipv6/netfilter/ip6_tables.c:1041 [inline] do_ip6t_get_ctl+0xfa4/0x1030 net/ipv6/netfilter/ip6_tables.c:1709 nf_sockopt net/netfilter/nf_sockopt.c:104 [inline] nf_getsockopt+0x481/0x4e0 net/netfilter/nf_sockopt.c:122 ipv6_getsockopt+0x264/0x510 net/ipv6/ipv6_sockglue.c:1400 tcp_getsockopt+0x1c6/0x1f0 net/ipv4/tcp.c:3688 sock_common_getsockopt+0x13f/0x180 net/core/sock.c:3110 __sys_getsockopt+0x533/0x7b0 net/socket.c:2129 __do_sys_getsockopt net/socket.c:2144 [inline] __se_sys_getsockopt+0xe1/0x100 net/socket.c:2141 __x64_sys_getsockopt+0x62/0x80 net/socket.c:2141 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45d20a Code: b8 34 01 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 8d 8b fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 6a 8b fb ff c3 66 0f 1f 84 00 00 00 00 00 RSP: 002b:0000000000a6f618 EFLAGS: 00000212 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 0000000000a6f640 RCX: 000000000045d20a RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003 RBP: 0000000000717cc0 R08: 0000000000a6f63c R09: 0000000000004000 R10: 0000000000a6f740 R11: 0000000000000212 R12: 0000000000000003 R13: 0000000000000000 R14: 0000000000000029 R15: 0000000000715b00 Local variable description: ----parms@bond_neigh_init Variable was created at: bond_neigh_init+0x8c/0x4b0 drivers/net/bonding/bond_main.c:3617 bond_neigh_init+0x8c/0x4b0 drivers/net/bonding/bond_main.c:3617 Fixes: 9918d5bf329d ("bonding: modify only neigh_parms owned by us") Fixes: 234bcf8a499e ("net/bonding: correctly proxy slave neigh param setup ndo function") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Jay Vosburgh Cc: Veaceslav Falico Cc: Andy Gospodarek Signed-off-by: David S. Miller commit f394722fb0d0f701119368959d7cd0ecbc46363a Author: Eric Dumazet Date: Sat Dec 7 12:23:21 2019 -0800 neighbour: remove neigh_cleanup() method neigh_cleanup() has not been used for seven years, and was a wrong design. Messing with shared pointer in bond_neigh_init() without proper memory barriers would at least trigger syzbot complains eventually. It is time to remove this stuff. Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup in xmit path") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 093c3f94e922d83a734fc4da08cc5814990f32c6 Author: Florian Fainelli Date: Thu Dec 5 16:01:20 2019 -0800 ARM: dts: BCM5301X: Fix MDIO node address/size cells The MDIO node on BCM5301X had an reversed #address-cells and #size-cells properties, correct those, silencing checker warnings: .../linux/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dt.yaml: mdio@18003000: #address-cells:0:0: 1 was expected Reported-by: Simon Horman Fixes: 23f1eca6d59b ("ARM: dts: BCM5301X: Specify MDIO bus in the DT") Signed-off-by: Florian Fainelli commit 43aad8104bdaa7176a8f87143ac0e559bc891293 Merge: e42617b825f8 da2311a6385c Author: David S. Miller Date: Mon Dec 9 09:27:47 2019 -0800 Merge tag 'linux-can-fixes-for-5.5-20191208' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2019-12-08 this is a pull request of 13 patches for net/master. The first two patches are by Dan Murphy. He adds himself as a maintainer to the m-can MMIO and tcan SPI driver. The next two patches the j1939 stack. The first one is by Oleksij Rempel and fixes a locking problem found by the syzbot, the second one is by me an fixes a mistake in the documentation. Srinivas Neeli fixes missing RX CAN packets on CANFD2.0 in the xilinx driver. Sean Nyekjaer fixes a possible deadlock in the the flexcan driver after suspend/resume. Joakim Zhang contributes two patches for the flexcan driver that fix problems with the low power enter/exit. The next 4 patches all target the tcan part of the m_can driver. Sean Nyekjaer adds the required delay after reset and fixes the device tree binding example. Dan Murphy's patches make the wake-gpio optional. In the last patch Xiaolong Huang fixes several kernel memory info leaks to the USB device in the kvaser_usb_leaf driver. ==================== Signed-off-by: David S. Miller commit df4a6ff19224b5434237e781979fbace0a7feebd Merge: e42617b825f8 c9385887cbbf Author: Olof Johansson Date: Mon Dec 9 09:17:09 2019 -0800 Merge tag 'vexpress-fixes-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes ARMv7 Vexpress fixes for v5.5 Switching the cpumask from topology core to OPP sharing, as the topology core cpumask can be modified during cpu hotplug to avoid setting up wrong cpufreq policy cpumask. * tag 'vexpress-fixes-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: cpufreq: vexpress-spc: Switch cpumask from topology core to OPP sharing ARM: vexpress: Set-up shared OPP table instead of individual for each CPU Link: https://lore.kernel.org/r/20191209140037.GC25155@bogus Signed-off-by: Olof Johansson commit 44a7b6759000ac51b92715579a7bba9e3f9245c2 Author: Chuhong Yuan Date: Fri Dec 6 09:24:26 2019 +0800 RDMA/cma: add missed unregister_pernet_subsys in init failure The driver forgets to call unregister_pernet_subsys() in the error path of cma_init(). Add the missed call to fix it. Fixes: 4be74b42a6d0 ("IB/cma: Separate port allocation to network namespaces") Signed-off-by: Chuhong Yuan Reviewed-by: Parav Pandit Link: https://lore.kernel.org/r/20191206012426.12744-1-hslester96@gmail.com Signed-off-by: Doug Ledford commit 78f926f72e43e4b974f69688593a9b682089e82a Author: David Sterba Date: Thu Nov 28 13:02:32 2019 +0100 btrfs: add Kconfig dependency for BLAKE2B Because the BLAKE2B code went through a different tree, it was not available at the time the btrfs part was merged. Now that the Kconfig symbol exists, add it to the list. Signed-off-by: David Sterba commit bcbccaf2edcf1b76f73f890e968babef446151a4 Author: David Howells Date: Mon Dec 9 15:04:45 2019 +0000 afs: Fix SELinux setting security label on /afs Make the AFS dynamic root superblock R/W so that SELinux can set the security label on it. Without this, upgrades to, say, the Fedora filesystem-afs RPM fail if afs is mounted on it because the SELinux label can't be (re-)applied. It might be better to make it possible to bypass the R/O check for LSM label application through setxattr. Fixes: 4d673da14533 ("afs: Support the AFS dynamic root") Signed-off-by: David Howells Reviewed-by: Marc Dionne cc: selinux@vger.kernel.org cc: linux-security-module@vger.kernel.org commit 9bd0160d12370a076e44f8d1320cde9c83f2c647 Author: Marc Dionne Date: Mon Dec 9 15:04:43 2019 +0000 afs: Fix afs_find_server lookups for ipv4 peers afs_find_server tries to find a server that has an address that matches the transport address of an rxrpc peer. The code assumes that the transport address is always ipv6, with ipv4 represented as ipv4 mapped addresses, but that's not the case. If the transport family is AF_INET, srx->transport.sin6.sin6_addr.s6_addr32[] will be beyond the actual ipv4 address and will always be 0, and all ipv4 addresses will be seen as matching. As a result, the first ipv4 address seen on any server will be considered a match, and the server returned may be the wrong one. One of the consequences is that callbacks received over ipv4 will only be correctly applied for the server that happens to have the first ipv4 address on the fs_addresses4 list. Callbacks over ipv4 from all other servers are dropped, causing the client to serve stale data. This is fixed by looking at the transport family, and comparing ipv4 addresses based on a sockaddr_in structure rather than a sockaddr_in6. Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation") Signed-off-by: Marc Dionne Signed-off-by: David Howells commit 36deeddcd3699c2755ed21c8d2595b1728d844e5 Author: Chris Wilson Date: Thu Dec 5 14:59:34 2019 +0000 drm/i915/gt: Save irqstate around virtual_context_destroy As virtual_context_destroy() may be called from a request signal, it may be called from inside an irq-off section, and so we need to do a full save/restore of the irq state rather than blindly re-enable irqs upon unlocking. <4> [110.024262] WARNING: inconsistent lock state <4> [110.024277] 5.4.0-rc8-CI-CI_DRM_7489+ #1 Tainted: G U <4> [110.024292] -------------------------------- <4> [110.024305] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. <4> [110.024323] kworker/0:0/5 [HC0[0]:SC0[0]:HE1:SE1] takes: <4> [110.024338] ffff88826a0c7a18 (&(&rq->lock)->rlock){?.-.}, at: i915_request_retire+0x221/0x930 [i915] <4> [110.024592] {IN-HARDIRQ-W} state was registered at: <4> [110.024612] lock_acquire+0xa7/0x1c0 <4> [110.024627] _raw_spin_lock_irqsave+0x33/0x50 <4> [110.024788] intel_engine_breadcrumbs_irq+0x38c/0x600 [i915] <4> [110.024808] irq_work_run_list+0x49/0x70 <4> [110.024824] irq_work_run+0x26/0x50 <4> [110.024839] smp_irq_work_interrupt+0x44/0x1e0 <4> [110.024855] irq_work_interrupt+0xf/0x20 <4> [110.024871] __do_softirq+0xb7/0x47f <4> [110.024885] irq_exit+0xba/0xc0 <4> [110.024898] do_IRQ+0x83/0x160 <4> [110.024910] ret_from_intr+0x0/0x1d <4> [110.024922] irq event stamp: 172864 <4> [110.024938] hardirqs last enabled at (172863): [] _raw_spin_unlock_irq+0x24/0x50 <4> [110.024963] hardirqs last disabled at (172864): [] _raw_spin_lock_irq+0xa/0x40 <4> [110.024988] softirqs last enabled at (172812): [] __do_softirq+0x385/0x47f <4> [110.025012] softirqs last disabled at (172797): [] irq_exit+0xba/0xc0 <4> [110.025031] other info that might help us debug this: <4> [110.025049] Possible unsafe locking scenario: <4> [110.025065] CPU0 <4> [110.025075] ---- <4> [110.025084] lock(&(&rq->lock)->rlock); <4> [110.025099] <4> [110.025109] lock(&(&rq->lock)->rlock); <4> [110.025124] *** DEADLOCK *** <4> [110.025144] 4 locks held by kworker/0:0/5: <4> [110.025156] #0: ffff88827588f528 ((wq_completion)events){+.+.}, at: process_one_work+0x1de/0x620 <4> [110.025187] #1: ffffc9000006fe78 ((work_completion)(&engine->retire_work)){+.+.}, at: process_one_work+0x1de/0x620 <4> [110.025219] #2: ffff88825605e270 (&kernel#2){+.+.}, at: engine_retire+0x57/0xe0 [i915] <4> [110.025405] #3: ffff88826a0c7a18 (&(&rq->lock)->rlock){?.-.}, at: i915_request_retire+0x221/0x930 [i915] <4> [110.025634] stack backtrace: <4> [110.025653] CPU: 0 PID: 5 Comm: kworker/0:0 Tainted: G U 5.4.0-rc8-CI-CI_DRM_7489+ #1 <4> [110.025675] Hardware name: /NUC7i5BNB, BIOS BNKBL357.86A.0054.2017.1025.1822 10/25/2017 <4> [110.025856] Workqueue: events engine_retire [i915] <4> [110.025872] Call Trace: <4> [110.025891] dump_stack+0x71/0x9b <4> [110.025907] mark_lock+0x49a/0x500 <4> [110.025926] ? print_shortest_lock_dependencies+0x200/0x200 <4> [110.025946] mark_held_locks+0x49/0x70 <4> [110.025962] ? _raw_spin_unlock_irq+0x24/0x50 <4> [110.025978] lockdep_hardirqs_on+0xa2/0x1c0 <4> [110.025995] _raw_spin_unlock_irq+0x24/0x50 <4> [110.026171] virtual_context_destroy+0xc5/0x2e0 [i915] <4> [110.026376] __active_retire+0xb4/0x290 [i915] <4> [110.026396] dma_fence_signal_locked+0x9e/0x1b0 <4> [110.026613] i915_request_retire+0x451/0x930 [i915] <4> [110.026766] retire_requests+0x4d/0x60 [i915] <4> [110.026919] engine_retire+0x63/0xe0 [i915] Fixes: b1e3177bd1d8 ("drm/i915: Coordinate i915_active with its own mutex") Fixes: 6d06779e8672 ("drm/i915: Load balancing across a virtual engine") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191205145934.663183-1-chris@chris-wilson.co.uk (cherry picked from commit 6f7ac8285371fb0df58aba861eaab387f79ed04d) Signed-off-by: Joonas Lahtinen commit d935bd50dd14a7714cbdba9a76435dbb56edb1ae Author: Geert Uytterhoeven Date: Wed Nov 27 10:59:19 2019 +0100 gpio: Fix error message on out-of-range GPIO in lookup table When a GPIO offset in a lookup table is out-of-range, the printed error message (1) does not include the actual out-of-range value, and (2) contains an off-by-one error in the upper bound. Avoid user confusion by also printing the actual GPIO offset, and correcting the upper bound of the range. While at it, use "%u" for unsigned int. Sample impact: -requested GPIO 0 is out of range [0..32] for chip e6052000.gpio +requested GPIO 0 (45) is out of range [0..31] for chip e6052000.gpio Fixes: 2a3cf6a3599e9015 ("gpiolib: return -ENOENT if no GPIO mapping exists") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20191127095919.4214-1-geert+renesas@glider.be Signed-off-by: Linus Walleij commit 322f6a3182d42df18059a89c53b09d33919f755e Author: Johnson CH Chen (陳昭勳) Date: Tue Nov 26 06:51:11 2019 +0000 gpio: mpc8xxx: Add platform device to gpiochip->parent Dear Linus Walleij, In old kernels, some APIs still try to use parent->of_node from struct gpio_chip, and it could be resulted in kernel panic because parent is NULL. Adding platform device to gpiochip->parent can fix this problem. Signed-off-by: Johnson Chen Link: https://patchwork.kernel.org/patch/11234609 Link: https://lore.kernel.org/r/HK0PR01MB3521489269F76467DFD7843FFA450@HK0PR01MB3521.apcprd01.prod.exchangelabs.com Signed-off-by: Linus Walleij commit 348b80b273fbf4ce2a307f9e38eadecf37828cad Author: Aaron Ma Date: Wed Dec 4 20:42:07 2019 +0800 HID: multitouch: Add LG MELF0410 I2C touchscreen support Add multitouch support for LG MELF I2C touchscreen. Apply the same workaround as LG USB touchscreen. Signed-off-by: Aaron Ma Signed-off-by: Jiri Kosina commit be54e7461ffdc5809b67d2aeefc1ddc9a91470c7 Author: Marcel Holtmann Date: Wed Dec 4 03:43:55 2019 +0100 HID: uhid: Fix returning EPOLLOUT from uhid_char_poll Always return EPOLLOUT from uhid_char_poll to allow polling /dev/uhid for writable state. Fixes: 1f9dec1e0164 ("HID: uhid: allow poll()'ing on uhid devices") Signed-off-by: Marcel Holtmann Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina commit 9f3b61dc1dd7b81e99e7ed23776bb64a35f39e1a Author: Marcel Holtmann Date: Wed Dec 4 03:37:13 2019 +0100 HID: hidraw: Fix returning EPOLLOUT from hidraw_poll When polling a connected /dev/hidrawX device, it is useful to get the EPOLLOUT when writing is possible. Since writing is possible as soon as the device is connected, always return it. Right now EPOLLOUT is only returned when there are also input reports are available. This works if devices start sending reports when connected, but some HID devices might need an output report first before sending any input reports. This change will allow using EPOLLOUT here as well. Fixes: 378b80370aa1 ("hidraw: Return EPOLLOUT from hidraw_poll") Signed-off-by: Marcel Holtmann Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina commit 5604285839aaedfb23ebe297799c6e558939334d Author: Eric Dumazet Date: Sat Dec 7 14:43:39 2019 -0800 netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() syzbot is kind enough to remind us we need to call skb_may_pull() BUG: KMSAN: uninit-value in br_nf_forward_arp+0xe61/0x1230 net/bridge/br_netfilter_hooks.c:665 CPU: 1 PID: 11631 Comm: syz-executor.1 Not tainted 5.4.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108 __msan_warning+0x64/0xc0 mm/kmsan/kmsan_instr.c:245 br_nf_forward_arp+0xe61/0x1230 net/bridge/br_netfilter_hooks.c:665 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline] nf_hook_slow+0x18b/0x3f0 net/netfilter/core.c:512 nf_hook include/linux/netfilter.h:260 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] __br_forward+0x78f/0xe30 net/bridge/br_forward.c:109 br_flood+0xef0/0xfe0 net/bridge/br_forward.c:234 br_handle_frame_finish+0x1a77/0x1c20 net/bridge/br_input.c:162 nf_hook_bridge_pre net/bridge/br_input.c:245 [inline] br_handle_frame+0xfb6/0x1eb0 net/bridge/br_input.c:348 __netif_receive_skb_core+0x20b9/0x51a0 net/core/dev.c:4830 __netif_receive_skb_one_core net/core/dev.c:4927 [inline] __netif_receive_skb net/core/dev.c:5043 [inline] process_backlog+0x610/0x13c0 net/core/dev.c:5874 napi_poll net/core/dev.c:6311 [inline] net_rx_action+0x7a6/0x1aa0 net/core/dev.c:6379 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 do_softirq_own_stack+0x49/0x80 arch/x86/entry/entry_64.S:1091 do_softirq kernel/softirq.c:338 [inline] __local_bh_enable_ip+0x184/0x1d0 kernel/softirq.c:190 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:688 [inline] __dev_queue_xmit+0x38e8/0x4200 net/core/dev.c:3819 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3825 packet_snd net/packet/af_packet.c:2959 [inline] packet_sendmsg+0x8234/0x9100 net/packet/af_packet.c:2984 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] __sys_sendto+0xc44/0xc70 net/socket.c:1952 __do_sys_sendto net/socket.c:1964 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1960 __x64_sys_sendto+0x6e/0x90 net/socket.c:1960 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45a679 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f0a3c9e5c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045a679 RDX: 000000000000000e RSI: 0000000020000200 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 00000000200000c0 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0a3c9e66d4 R13: 00000000004c8ec1 R14: 00000000004dfe28 R15: 00000000ffffffff Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline] kmsan_internal_poison_shadow+0x5c/0x110 mm/kmsan/kmsan.c:132 kmsan_slab_alloc+0x97/0x100 mm/kmsan/kmsan_hooks.c:86 slab_alloc_node mm/slub.c:2773 [inline] __kmalloc_node_track_caller+0xe27/0x11a0 mm/slub.c:4381 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x306/0xa10 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] alloc_skb_with_frags+0x18c/0xa80 net/core/skbuff.c:5662 sock_alloc_send_pskb+0xafd/0x10a0 net/core/sock.c:2244 packet_alloc_skb net/packet/af_packet.c:2807 [inline] packet_snd net/packet/af_packet.c:2902 [inline] packet_sendmsg+0x63a6/0x9100 net/packet/af_packet.c:2984 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] __sys_sendto+0xc44/0xc70 net/socket.c:1952 __do_sys_sendto net/socket.c:1964 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1960 __x64_sys_sendto+0x6e/0x90 net/socket.c:1960 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: c4e70a87d975 ("netfilter: bridge: rename br_netfilter.c to br_netfilter_hooks.c") Signed-off-by: Eric Dumazet Reported-by: syzbot Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 81ec61074bcf68acfcb2820cda3ff9d9984419c7 Author: Pablo Neira Ayuso Date: Fri Dec 6 22:49:58 2019 +0100 netfilter: nf_tables_offload: return EOPNOTSUPP if rule specifies no actions If the rule only specifies the matching side, return EOPNOTSUPP. Otherwise, the front-end relies on the drivers to reject this rule. Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support") Signed-off-by: Pablo Neira Ayuso commit fd57d0cbe187e93f63777d36e9f49293311d417f Author: Pablo Neira Ayuso Date: Fri Dec 6 22:25:55 2019 +0100 netfilter: nf_tables: skip module reference count bump on object updates Use __nft_obj_type_get() instead, otherwise there is a module reference counter leak. Fixes: d62d0ba97b58 ("netfilter: nf_tables: Introduce stateful object update operation") Signed-off-by: Pablo Neira Ayuso commit 0d2c96af797ba149e559c5875c0151384ab6dd14 Author: Pablo Neira Ayuso Date: Fri Dec 6 22:09:14 2019 +0100 netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() Userspace might bogusly sent NFT_DATA_VERDICT in several netlink attributes that assume NFT_DATA_VALUE. Moreover, make sure that error path invokes nft_data_release() to decrement the reference count on the chain object. Fixes: 96518518cc41 ("netfilter: add nftables") Fixes: 0f3cd9b36977 ("netfilter: nf_tables: add range expression") Signed-off-by: Pablo Neira Ayuso commit bffc124b6fe37d0ae9b428d104efb426403bb5c9 Author: Pablo Neira Ayuso Date: Fri Dec 6 21:55:20 2019 +0100 netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END Only NFTA_SET_ELEM_KEY and NFTA_SET_ELEM_FLAGS make sense for elements whose NFT_SET_ELEM_INTERVAL_END flag is set on. Fixes: 96518518cc41 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso commit db3b665dd77b34e34df00e17d7b299c98fcfb2c5 Author: Pablo Neira Ayuso Date: Fri Dec 6 20:23:29 2019 +0100 netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets The existing rbtree implementation might store consecutive elements where the closing element and the opening element might overlap, eg. [ a, a+1) [ a+1, a+2) This patch removes the optimization for non-anonymous sets in the exact matching case, where it is assumed to stop searching in case that the closing element is found. Instead, invalidate candidate interval and keep looking further in the tree. The lookup/get operation might return false, while there is an element in the rbtree. Moreover, the get operation returns true as if a+2 would be in the tree. This happens with named sets after several set updates. The existing lookup optimization (that only works for the anonymous sets) might not reach the opening [ a+1,... element if the closing ...,a+1) is found in first place when walking over the rbtree. Hence, walking the full tree in that case is needed. This patch fixes the lookup and get operations. Fixes: e701001e7cbe ("netfilter: nft_rbtree: allow adjacent intervals with dynamic updates") Fixes: ba0e4d9917b4 ("netfilter: nf_tables: get set elements via netlink") Signed-off-by: Pablo Neira Ayuso commit 164166558aacea01b99c8c8ffb710d930405ba69 Author: Phil Sutter Date: Thu Dec 5 13:35:11 2019 +0100 netfilter: uapi: Avoid undefined left-shift in xt_sctp.h With 'bytes(__u32)' being 32, a left-shift of 31 may happen which is undefined for the signed 32-bit value 1. Avoid this by declaring 1 as unsigned. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit c9385887cbbf292ee367f75b400874f00ea34890 Author: Sudeep Holla Date: Wed Nov 27 16:04:26 2019 +0000 cpufreq: vexpress-spc: Switch cpumask from topology core to OPP sharing Since commit ca74b316df96 ("arm: Use common cpu_topology structure and functions.") the core cpumask has to be modified during cpu hotplug operations. So using them to set up cpufreq policy cpumask may be incorrect as it may contain only cpus that are online at that instance. Instead, we can use the cpumask setup by OPP library that contains all the cpus sharing OPP table using dev_pm_opp_get_sharing_cpus. Acked-by: Viresh Kumar Tested-by: Dietmar Eggemann Signed-off-by: Sudeep Holla commit 2a76352ad2cc6b78e58f737714879cc860903802 Author: Sudeep Holla Date: Wed Nov 27 15:56:40 2019 +0000 ARM: vexpress: Set-up shared OPP table instead of individual for each CPU Currently we add individual copy of same OPP table for each CPU within the cluster. This is redundant and doesn't reflect the reality. We can't use core cpumask to set policy->cpus in ve_spc_cpufreq_init() anymore as it gets called via cpuhp_cpufreq_online()->cpufreq_online() ->cpufreq_driver->init() and the cpumask gets updated upon CPU hotplug operations. It also may cause issues when the vexpress_spc_cpufreq driver is built as a module. Since ve_spc_clk_init is built-in device initcall, we should be able to use the same topology_core_cpumask to set the opp sharing cpumask via dev_pm_opp_set_sharing_cpus and use the same later in the driver via dev_pm_opp_get_sharing_cpus. Cc: Liviu Dudau Cc: Lorenzo Pieralisi Acked-by: Viresh Kumar Tested-by: Dietmar Eggemann Signed-off-by: Sudeep Holla commit b9a19bdbc843abd659e8ec6b1b3c32ae3a2455eb Author: Hans de Goede Date: Thu Nov 14 11:08:04 2019 +0100 pinctrl: cherryview: Pass irqchip when adding gpiochip We need to convert all old gpio irqchips to pass the irqchip setup along when adding the gpio_chip. For more info see drivers/gpio/TODO. For chained irqchips this is a pretty straight-forward conversion. Acked-by: Mika Westerberg Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit bd90633a5c5433bcb53d55843a7118e6c032b1a2 Author: Hans de Goede Date: Thu Nov 14 11:08:03 2019 +0100 pinctrl: cherryview: Add GPIO <-> pin mapping ranges via callback When IRQ chip is instantiated via GPIO library flow, the few functions, in particular the ACPI event registration mechanism, on some of ACPI based platforms expect that the pin ranges are initialized to that point. Add GPIO <-> pin mapping ranges via callback in the GPIO library flow. Acked-by: Mika Westerberg Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit 82d9beb4b7f701cb2bb4c892e777c5ada14ce99e Author: Hans de Goede Date: Thu Nov 14 11:08:02 2019 +0100 pinctrl: cherryview: Split out irq hw-init into a separate helper function Split out irq hw-init into a separate chv_gpio_irq_init_hw() function. This is a preparation patch for passing the irqchip when adding the gpiochip. Acked-by: Mika Westerberg Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit ca8a958e2acb418846e6506f3ff2cdf161a3c806 Author: Andy Shevchenko Date: Tue Nov 5 15:41:11 2019 +0200 pinctrl: baytrail: Pass irqchip when adding gpiochip We need to convert all old gpio irqchips to pass the irqchip setup along when adding the gpio_chip. For more info see drivers/gpio/TODO. For chained irqchips this is a pretty straight-forward conversion. Cc: Andy Shevchenko Cc: Mika Westerberg Cc: Thierry Reding Signed-off-by: Linus Walleij Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Reviewed-by: Hans de Goede Tested-by: Hans de Goede commit ed3c156462516f3a10c8842cdf6358d20ffa34f5 Author: Andy Shevchenko Date: Mon Nov 4 19:07:30 2019 +0200 pinctrl: baytrail: Add GPIO <-> pin mapping ranges via callback When IRQ chip is instantiated via GPIO library flow, the few functions, in particular the ACPI event registration mechanism, on some of ACPI based platforms expect that the pin ranges are initialized to that point. Add GPIO <-> pin mapping ranges via callback in the GPIO library flow. Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Reviewed-by: Hans de Goede Tested-by: Hans de Goede commit 9c9b65203492927cc4ae419e9601e837ecbd889e Author: Curtis Malainey Date: Wed Nov 27 17:13:58 2019 -0800 ASoC: core: only flush inited work during free There are many paths to soc_free_pcm_runtime which can both have and have not yet inited the workqueue yet. When we flush the queue when we have not yet inited the queue we cause warnings to be printed. An example is soc_cleanup_card_resources which is called by snd_soc_bind_card which has multiple failure points before and after soc_link_init -> soc_new_pcm which is where the queue is inited. Signed-off-by: Curtis Malainey Link: https://lore.kernel.org/r/20191128011358.39234-1-cujomalainey@chromium.org Signed-off-by: Mark Brown commit b30b736a2b3d5a032fd91ab34c558148cda6590f Author: Andy Shevchenko Date: Tue Nov 12 16:24:41 2019 +0200 pinctrl: baytrail: Update North Community pin list Update North Community pin list to be more clear about pin functions. Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg commit 40ecab551232972a39cdd8b6f17ede54a3fdb296 Author: Hans de Goede Date: Tue Nov 19 16:46:41 2019 +0100 pinctrl: baytrail: Really serialize all register accesses Commit 39ce8150a079 ("pinctrl: baytrail: Serialize all register access") added a spinlock around all register accesses because: "There is a hardware issue in Intel Baytrail where concurrent GPIO register access might result reads of 0xffffffff and writes might get dropped completely." Testing has shown that this does not catch all cases, there are still 2 problems remaining 1) The original fix uses a spinlock per byt_gpio device / struct, additional testing has shown that this is not sufficient concurent accesses to 2 different GPIO banks also suffer from the same problem. This commit fixes this by moving to a single global lock. 2) The original fix did not add a lock around the register accesses in the suspend/resume handling. Since pinctrl-baytrail.c is using normal suspend/resume handlers, interrupts are still enabled during suspend/resume handling. Nothing should be using the GPIOs when they are being taken down, _but_ the GPIOs themselves may still cause interrupts, which are likely to use (read) the triggering GPIO. So we need to protect against concurrent GPIO register accesses in the suspend/resume handlers too. This commit fixes this by adding the missing spin_lock / unlock calls. The 2 fixes together fix the Acer Switch 10 SW5-012 getting completely confused after a suspend resume. The DSDT for this device has a bug in its _LID method which reprograms the home and power button trigger- flags requesting both high and low _level_ interrupts so the IRQs for these 2 GPIOs continuously fire. This combined with the saving of registers during suspend, triggers concurrent GPIO register accesses resulting in saving 0xffffffff as pconf0 value during suspend and then when restoring this on resume the pinmux settings get all messed up, resulting in various I2C busses being stuck, the wifi no longer working and often the tablet simply not coming out of suspend at all. Cc: stable@vger.kernel.org Fixes: 39ce8150a079 ("pinctrl: baytrail: Serialize all register access") Signed-off-by: Hans de Goede Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 634f0348fe336fce8f6cab1933139115e983ed2f Author: Max Filippov Date: Tue Nov 26 11:30:27 2019 -0800 gpio: xtensa: fix driver build Commit cad6fade6e78 ("xtensa: clean up WSR*/RSR*/get_sr/set_sr") removed {RSR,WSR}_CPENABLE from xtensa code, but did not fix up all users, breaking gpio-xtensa driver build. Update gpio-xtensa to use new xtensa_{get,set}_sr API. Cc: stable@vger.kernel.org # v5.0+ Fixes: cad6fade6e78 ("xtensa: clean up WSR*/RSR*/get_sr/set_sr") Signed-off-by: Max Filippov Signed-off-by: Bartosz Golaszewski commit 36fcb4292473cb9c9ce7706d038bcf0eda5cabeb Author: Marcelo Tosatti Date: Fri Dec 6 13:07:41 2019 -0200 cpuidle: use first valid target residency as poll time Commit 259231a04561 ("cpuidle: add poll_limit_ns to cpuidle_device structure") changed, by mistake, the target residency from the first available sleep state to the last available sleep state (which should be longer). This might cause excessive polling. Fixes: 259231a04561 ("cpuidle: add poll_limit_ns to cpuidle_device structure") Signed-off-by: Marcelo Tosatti Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki commit e8ad8d5108e0304532fc800433714ed664ecf71d Merge: e42617b825f8 27dbc542f651 Author: Rafael J. Wysocki Date: Mon Dec 9 09:31:24 2019 +0100 Merge tag 'devfreq-fixes-for-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux Pull devfreq updates for 5.5-rc1 from Chanwoo Choi: "Update devfreq core: - Add PM QoS support for devfreq device with following QoS type. External user of devfreq device can request the minimum and maximum frequency according to their multiple requirements. : DEV_PM_QOS_MIN_FREQUENCY is used for requesting the minimum device frequency. : DEV_PM_QOS_MAX_FREQUENCY is used for requesting the maximum device frequency. - Use PM QoS interface when entering the min/max_freq via sysfs interface. - Add get_freq_range() helper function in order to get the final min/max frequency among the multiple requirements of min/max frequency. - Fix a function return value and modify code for more correct exception handling if errors happen." * tag 'devfreq-fixes-for-5.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux: PM / devfreq: Use PM QoS for sysfs min/max_freq PM / devfreq: Add PM QoS support PM / devfreq: Don't fail devfreq_dev_release if not in list PM / devfreq: Introduce get_freq_range helper PM / devfreq: Set scaling_max_freq to max on OPP notifier error PM / devfreq: Fix devfreq_notifier_call returning errno commit 7347f09a198a045d5f6ea5e9c8fcc1db98e5a854 Merge: e42617b825f8 9fd229c478fb Author: Greg Kroah-Hartman Date: Mon Dec 9 09:27:52 2019 +0100 Merge tag 'iio-fixes-for-5.5a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of fixes for IIO in the 5.5 cycle. Mixture of old things people have just hit, and a few late breaking issues with things that went in during the merge window. Being sent promptly to resolve potential DT breakage causing issues for binding test builds. * ad7606 - Avoid reading extra data from the device over what was intended. * ad7124 - Enable the internal reference when in use. * ad7292 - Fix up license for newly added binding. Better to not have this go out in a release with more limited header than intended. - Fix a constraint on number of channels. * ad7949 - Fix an issue which can result in readouts being from the wrong channel. * hdc100x - Fix wrong ABI usage (units) for relative humidity channel. * intel mrfld - Allocate right amount of private data (currently allocating too much). * ltc2983 - Avoid a potential issue with machine endianness and wrong length device tree read. * max1027 - Clean up leak of an iio_trigger on probe failure. * max9611 - Ensure we sleep long enough to successfully initialize the sensor. * mpu6050 - Fix wrong ABI usage (units) for temperature channel. * st_accel - Fix an unused variable warning. * st_lsm6dsx - Fix decimation factor issue that can lead to missaligned datasets (and hence garbage) - Fix an issue with how we track enabled fifo channels. - Avoid powering off the device if wake up events are enabled. * tag 'iio-fixes-for-5.5a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: adc: max9611: Fix too short conversion time delay iio: ad7949: fix channels mixups iio: imu: st_lsm6dsx: do not power-off accel if events are enabled iio: imu: st_lsm6dsx: track hw FIFO buffering with fifo_mask iio: imu: st_lsm6dsx: fix decimation factor estimation iio: imu: inv_mpu6050: fix temperature reporting using bad unit iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting iio: adc: max1027: fix not unregistered iio trigger iio: adc: intel_mrfld_adc: Allocating too much data in probe() iio: adc: ad7124: Enable internal reference dt-bindings: iio: adc: ad7292: fix constraint over channel quantity dt-bindings: iio: adc: ad7292: Update SPDX identifier iio: temperature: ltc2983: fix u32 read into a unsigned long long iio: st_accel: Fix unused variable warning iio: adc: ad7606: fix reading unnecessary data from device commit 4ff40d140e2a2060ef6051800a4a9eab07624f42 Author: Yunhao Tian <18373444@buaa.edu.cn> Date: Mon Nov 25 20:58:32 2019 +0800 clk: sunxi-ng: v3s: Fix incorrect number of hw_clks. The hws field of sun8i_v3s_hw_clks has only 74 members. However, the number specified by CLK_NUMBER is 77 (= CLK_I2S0 + 1). This leads to runtime segmentation fault that is not always reproducible. This patch fixes the problem by specifying correct clock number. Signed-off-by: Yunhao Tian <18373444@buaa.edu.cn> [Maxime: Also remove the CLK_NUMBER definition] Signed-off-by: Maxime Ripard commit 3d615c2fc2d111b51d2e20516b920138d4ae29a2 Author: Stefan Mavrodiev Date: Fri Nov 29 13:39:41 2019 +0200 arm64: dts: allwinner: a64: olinuxino: Fix SDIO supply regulator A64-OLinuXino uses DCDC1 (VCC-IO) for MMC1 supply. In commit 916b68cfe4b5 ("arm64: dts: a64-olinuxino: Enable RTL8723BS WiFi") ALDO2 is set, which is VCC-PL. Since DCDC1 is always present, the boards are working without a problem. This patch sets the correct regulator. Fixes: 916b68cfe4b5 ("arm64: dts: a64-olinuxino: Enable RTL8723BS WiFi") Cc: stable@vger.kernel.org # v4.16+ Signed-off-by: Stefan Mavrodiev Signed-off-by: Maxime Ripard commit 8467ebbf708e5c4574b4eb5f663558fc724945ac Author: Stefan Mavrodiev Date: Fri Nov 29 13:39:39 2019 +0200 arm64: dts: allwinner: a64: olinuxino: Fix eMMC supply regulator A64-OLinuXino-eMMC uses 1.8V for eMMC supply. This is done via a triple jumper, which sets VCC-PL to either 1.8V or 3.3V. This setting is different for boards with and without eMMC. This is not a big issue for DDR52 mode, however the eMMC will not work in HS200/HS400, since these modes explicitly requires 1.8V. Fixes: 94f68f3a4b2a ("arm64: dts: allwinner: a64: Add A64 OlinuXino board (with eMMC)") Cc: stable@vger.kernel.org # v5.4 Signed-off-by: Stefan Mavrodiev Signed-off-by: Maxime Ripard commit 43cb86799ff03e9819c07f37f72f80f8246ad7ed Author: Martin Blumenstingl Date: Sun Dec 8 18:18:31 2019 +0100 drm: meson: venc: cvbs: fix CVBS mode matching With commit 222ec1618c3ace ("drm: Add aspect ratio parsing in DRM layer") the drm core started honoring the picture_aspect_ratio field when comparing two drm_display_modes. Prior to that it was ignored. When the CVBS encoder driver was initially submitted there was no aspect ratio check. Switch from drm_mode_equal() to drm_mode_match() without DRM_MODE_MATCH_ASPECT_RATIO to fix "kmscube" and X.org output using the CVBS connector. When (for example) kmscube sets the output mode when using the CVBS connector it passes HDMI_PICTURE_ASPECT_NONE, making the drm_mode_equal() fail as it include the aspect ratio. Prior to this patch kmscube reported: failed to set mode: Invalid argument The CVBS mode checking in the sun4i (drivers/gpu/drm/sun4i/sun4i_tv.c sun4i_tv_mode_to_drm_mode) and ZTE (drivers/gpu/drm/zte/zx_tvenc.c tvenc_mode_{pal,ntsc}) drivers don't set the "picture_aspect_ratio" at all. The Meson VPU driver does not rely on the aspect ratio for the CVBS output so we can safely decouple it from the hdmi_picture_aspect setting. Cc: Fixes: 222ec1618c3ace ("drm: Add aspect ratio parsing in DRM layer") Fixes: bbbe775ec5b5da ("drm: Add support for Amlogic Meson Graphic Controller") Signed-off-by: Martin Blumenstingl Acked-by: Neil Armstrong [narmstrong: squashed with drm: meson: venc: cvbs: deduplicate the meson_cvbs_mode lookup code] Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20191208171832.1064772-3-martin.blumenstingl@googlemail.com commit 781d5eb4b4a63df352d6f222c85f2628988aba87 Merge: e42617b825f8 6645d42d79d3 Author: Dave Airlie Date: Mon Dec 9 17:13:13 2019 +1000 Merge tag 'drm-misc-fixes-2019-11-25' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes - A fix for a memory leak in the dma-buf support - One in mcde DSI support that leads to a pointer dereference Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20191125094336.GA14723@gilmour.lan commit 9ff3483e5c552311676369b31bc64f0e8208fcd2 Author: Takashi Sakamoto Date: Mon Dec 9 08:22:26 2019 +0900 ALSA: firewire-motu: fix double unlocked 'motu->mutex' Mutex is doubly unlocked in some error path of pcm.open. This commit fixes ALSA firewire-motu driver in Linux kernel v5.5. Reported-by: kbuild test robot Reported-by: Dan Carpenter Fixes: 3fd80b200388 ("ALSA: firewire-motu: use the same size of period for PCM substream in AMDTP streams") Fixes: 0f5482e7875b ("ALSA: firewire-motu: share PCM buffer size for both direction") Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20191208232226.6685-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit bc3e8f5d42d5cfac3f7ac9b458c2eeb02e8b1cf7 Author: Kefeng Wang Date: Thu Oct 24 15:20:03 2019 +0800 riscv: only select serial sifive if TTY is enabled There is some warning if TTY is not enabled, and lead to build error, only select serial sifive if TTY enabled, and this also makes randconfig happy. Signed-off-by: Kefeng Wang [paul.walmsley@sifive.com: updated to apply] Signed-off-by: Paul Walmsley commit 0e72a2f9c1a386aaa8337f9f524f89a7884b82cf Author: Olof Johansson Date: Sat Dec 7 13:29:16 2019 -0800 riscv: Fix build dependency for loader The Makefile addition for the flat image loader missed an obj prefix. For most parallel builds this worked out fine, but with -j1 the dependency wasn't fulfilled and thus fails: arch/riscv/boot/loader.S: Assembler messages: arch/riscv/boot/loader.S:7: Error: file not found: arch/riscv/boot/Image Fixes: 405fe7aa0dba ("riscv: provide a flat image loader") Cc: Christoph Hellwig Signed-off-by: Olof Johansson Reviewed-by: Anup Patel Signed-off-by: Paul Walmsley commit 27dbc542f651ed09de910f274b32634904103774 Author: Leonard Crestez Date: Thu Dec 5 12:05:07 2019 +0200 PM / devfreq: Use PM QoS for sysfs min/max_freq Switch the handling of min_freq and max_freq from sysfs to use the dev_pm_qos_request interface. Since PM QoS handles frequencies as kHz this change reduces the precision of min_freq and max_freq. This shouldn't introduce problems because frequencies which are not an integer number of kHz are likely not an integer number of Hz either. Try to ensure compatibility by rounding min values down and rounding max values up. Signed-off-by: Leonard Crestez Acked-by: Chanwoo Choi Reviewed-by: Matthias Kaehlcke Tested-by: Matthias Kaehlcke [cw00.choi: Return -EAGAIN instead of -EINVAL if dev_pm_qos is inactive] Signed-off-by: Chanwoo Choi commit 05d7ae15cfb18f9ce55eef85bb6bcd62d31acc57 Author: Leonard Crestez Date: Thu Dec 5 12:05:06 2019 +0200 PM / devfreq: Add PM QoS support Register notifiers with the PM QoS framework in order to respond to requests for DEV_PM_QOS_MIN_FREQUENCY and DEV_PM_QOS_MAX_FREQUENCY. No notifiers are added by this patch but PM QoS constraints can be imposed externally (for example from other devices). Signed-off-by: Leonard Crestez Acked-by: Chanwoo Choi Reviewed-by: Matthias Kaehlcke Tested-by: Matthias Kaehlcke Signed-off-by: Chanwoo Choi commit 42a6b25e67df6ee6675e8d1eaf18065bd73328ba Author: Leonard Crestez Date: Thu Nov 14 01:21:31 2019 +0200 PM / devfreq: Don't fail devfreq_dev_release if not in list Right now devfreq_dev_release will print a warning and abort the rest of the cleanup if the devfreq instance is not part of the global devfreq_list. But this is a valid scenario, for example it can happen if the governor can't be found or on any other init error that happens after device_register. Initialize devfreq->node to an empty list head in devfreq_add_device so that list_del becomes a safe noop inside devfreq_dev_release and we can continue the rest of the cleanup. Signed-off-by: Leonard Crestez Reviewed-by: Matthias Kaehlcke Reviewed-by: Chanwoo Choi Signed-off-by: Chanwoo Choi commit 46cecc0bf095bbffdf58618a1b4a5f9c9f073bf8 Author: Leonard Crestez Date: Thu Oct 31 23:34:26 2019 +0200 PM / devfreq: Introduce get_freq_range helper Moving handling of min/max freq to a single function and call it from update_devfreq and for printing min/max freq values in sysfs. This changes the behavior of out-of-range min_freq/max_freq: clamping is now done at evaluation time. This means that if an out-of-range constraint is imposed by sysfs and it later becomes valid then it will be enforced. Signed-off-by: Leonard Crestez Reviewed-by: Matthias Kaehlcke Reviewed-by: Chanwoo Choi Signed-off-by: Chanwoo Choi commit e7cc792d00049c874010b398a27c3cc7bc8fef34 Author: Leonard Crestez Date: Thu Oct 31 23:34:19 2019 +0200 PM / devfreq: Set scaling_max_freq to max on OPP notifier error The devfreq_notifier_call functions will update scaling_min_freq and scaling_max_freq when the OPP table is updated. If fetching the maximum frequency fails then scaling_max_freq remains set to zero which is confusing. Set to ULONG_MAX instead so we don't need special handling for this case in other places. Signed-off-by: Leonard Crestez Reviewed-by: Matthias Kaehlcke Reviewed-by: Chanwoo Choi Signed-off-by: Chanwoo Choi commit e876e710ede23f670494331e062d643928e4142a Author: Leonard Crestez Date: Thu Oct 31 23:34:18 2019 +0200 PM / devfreq: Fix devfreq_notifier_call returning errno Notifier callbacks shouldn't return negative errno but one of the NOTIFY_OK/DONE/BAD values. The OPP core will ignore return values from notifiers but returning a value that matches NOTIFY_STOP_MASK will stop the notification chain. Fix by always returning NOTIFY_OK. Signed-off-by: Leonard Crestez Reviewed-by: Matthias Kaehlcke Reviewed-by: Chanwoo Choi Signed-off-by: Chanwoo Choi commit ed11e31709d7ddb19d4dc451d5bbfb15129f4cad Author: Peng Fan Date: Fri Nov 22 06:11:42 2019 +0000 clk: imx: clk-imx7ulp: Add missing sentinel of ulp_div_table There should be a sentinel of ulp_div_table, otherwise _get_table_div may access data out of the array. Fixes: b1260067ac3d ("clk: imx: add imx7ulp clk driver") Signed-off-by: Peng Fan Cc: Signed-off-by: Shawn Guo commit 92c17f6043647652e1f4a772636e4288d4ecea3e Author: Yongqiang Niu Date: Wed Nov 27 18:04:19 2019 +0800 drm/mediatek: Fix can't get component for external display plane. The original logic is ok for primary display, but will not find out component for external display. For example, plane->index is 6 for external display, but there are only 2 layer nr in external display, and this condition will never happen: if (plane->index < (count + mtk_ddp_comp_layer_nr(comp))) Fix this by using the offset of the plane to mtk_crtc->planes as index, instead of plane->index. Fixes: d6b53f68356f ("drm/mediatek: Add helper to get component for a plane") Signed-off-by: Yongqiang Niu Signed-off-by: Pi-Hsun Shih Signed-off-by: CK Hu commit 13b0ba33d78b32384ea38abd03bc2b795fcab194 Author: Pi-Hsun Shih Date: Mon Nov 18 14:18:05 2019 +0800 drm/mediatek: Check return value of mtk_drm_ddp_comp_for_plane. The mtk_drm_ddp_comp_for_plane can return NULL, but the usage doesn't check for it. Add check for it. Fixes: d6b53f68356f ("drm/mediatek: Add helper to get component for a plane") Signed-off-by: Pi-Hsun Shih Signed-off-by: CK Hu commit cf6b58ab2d55f5a143c88c219c8e66ff0720fa69 Author: Masahiro Yamada Date: Wed Dec 4 11:51:48 2019 +0900 kbuild: fix 'No such file or directory' warning when cleaning Since commit fcbb8461fd23 ("kbuild: remove header compile test"), 'make clean' with O= option in the pristine source tree emits 'No such file or directory' warning. $ git clean -d -f -x $ make O=foo clean make[1]: Entering directory '/home/masahiro/linux/foo' find: ‘usr/include’: No such file or directory make[1]: Leaving directory '/home/masahiro/linux/foo' Fixes: fcbb8461fd23 ("kbuild: remove header compile test") Reported-by: kbuild test robot Signed-off-by: Masahiro Yamada commit b731fadff4899c97be9ff33f3f2bd379b7a6be75 Author: Andreas Kemnade Date: Mon Nov 11 21:29:59 2019 +0100 ARM: dts: e60k02: fix power button The power button was only producing irqs, but no key events, Forced power down with long key press works, so probably only a short spike arrives at the SoC. Further investigation shows that LDORTC2 is off after boot of the vendor kernel. LDORTC2 is shared with a GPIO at the pmic which probably transfers the button press to the SoC. That regulator off at boot, so "regulator-boot-on" is definitively wrong. So remove that. Reported-by: H. Nikolaus Schaller Signed-off-by: Andreas Kemnade Fixes: c100ea86e6ab ("ARM: dts: add Netronix E60K02 board common file") Signed-off-by: Shawn Guo commit 073a01e8d7c23b3efb59a3d4c20aa546f9ec29a9 Author: Peng Fan Date: Fri Nov 1 10:16:19 2019 +0000 clk: imx: clk-composite-8m: add lock to gate/mux There is a lock to divider in the composite driver, but that's not enough. lock to gate/mux are also needed to provide exclusive access to the register. Fixes: d3ff9728134e ("clk: imx: Add imx composite clock") Signed-off-by: Peng Fan Cc: Signed-off-by: Shawn Guo commit 0aeb1f2b74f3402e9cdb7c0b8e2c369c9767301e Author: Stefan Roese Date: Tue Nov 5 14:04:56 2019 +0100 ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing Without this "jedec,spi-nor" compatible property, probing of the SPI NOR does not work on the NXP i.MX6ULL EVK. Fix this by adding this compatible property to the DT. Fixes: 7d77b8505aa9 ("ARM: dts: imx6ull: fix the imx6ull-14x14-evk configuration") Signed-off-by: Stefan Roese Reviewed-by: Fabio Estevam Reviewed-by: Frieder Schrempf Signed-off-by: Shawn Guo commit e42617b825f8073569da76dc4510bfa019b1c35a Author: Linus Torvalds Date: Sun Dec 8 14:57:55 2019 -0800 Linux 5.5-rc1 commit 95e6ba5133163f8241c9ea2439369cec0452fec6 Merge: 138f371ddf4f 0fc75219fe9a Author: Linus Torvalds Date: Sun Dec 8 13:28:11 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) More jumbo frame fixes in r8169, from Heiner Kallweit. 2) Fix bpf build in minimal configuration, from Alexei Starovoitov. 3) Use after free in slcan driver, from Jouni Hogander. 4) Flower classifier port ranges don't work properly in the HW offload case, from Yoshiki Komachi. 5) Use after free in hns3_nic_maybe_stop_tx(), from Yunsheng Lin. 6) Out of bounds access in mqprio_dump(), from Vladyslav Tarasiuk. 7) Fix flow dissection in dsa TX path, from Alexander Lobakin. 8) Stale syncookie timestampe fixes from Guillaume Nault. [ Did an evil merge to silence a warning introduced by this pull - Linus ] * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (84 commits) r8169: fix rtl_hw_jumbo_disable for RTL8168evl net_sched: validate TCA_KIND attribute in tc_chain_tmplt_add() r8169: add missing RX enabling for WoL on RTL8125 vhost/vsock: accept only packets with the right dst_cid net: phy: dp83867: fix hfs boot in rgmii mode net: ethernet: ti: cpsw: fix extra rx interrupt inet: protect against too small mtu values. gre: refetch erspan header from skb->data after pskb_may_pull() pppoe: remove redundant BUG_ON() check in pppoe_pernet tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() tcp: tighten acceptance of ACKs not matching a child socket tcp: fix rejected syncookies due to stale timestamps lpc_eth: kernel BUG on remove tcp: md5: fix potential overestimation of TCP option space net: sched: allow indirect blocks to bind to clsact in TC net: core: rename indirect block ingress cb function net-sysfs: Call dev_hold always in netdev_queue_add_kobject net: dsa: fix flow dissection on Tx path net/tls: Fix return values to avoid ENOTSUPP net: avoid an indirect call in ____sys_recvmsg() ... commit 138f371ddf4ff50207dbe33ebfc237e756cd6222 Merge: a78f7cdddbbb 1eb9151eb7c5 Author: Linus Torvalds Date: Sun Dec 8 12:23:42 2019 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "Eleven patches, all in drivers (no core changes) that are either minor cleanups or small fixes. They were late arriving, but still safe for -rc1" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: MAINTAINERS: Add the linux-scsi mailing list to the ISCSI entry scsi: megaraid_sas: Make poll_aen_lock static scsi: sd_zbc: Improve report zones error printout scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI scsi: qla2xxx: unregister ports after GPN_FT failure scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan scsi: pm80xx: Remove unused include of linux/version.h scsi: pm80xx: fix logic to break out of loop when register value is 2 or 3 scsi: scsi_transport_sas: Fix memory leak when removing devices scsi: lpfc: size cpu map by last cpu id set scsi: ibmvscsi_tgt: Remove unneeded variable rc commit a78f7cdddbbb2bb2ed6851fbb792072570517650 Merge: 5bf9a06a5f7c 231e2a0ba567 Author: Linus Torvalds Date: Sun Dec 8 12:12:18 2019 -0800 Merge tag '5.5-rc-smb3-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Nine cifs/smb3 fixes: - one fix for stable (oops during oplock break) - two timestamp fixes including important one for updating mtime at close to avoid stale metadata caching issue on dirty files (also improves perf by using SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB over the wire) - two fixes for "modefromsid" mount option for file create (now allows mode bits to be set more atomically and accurately on create by adding "sd_context" on create when modefromsid specified on mount) - two fixes for multichannel found in testing this week against different servers - two small cleanup patches" * tag '5.5-rc-smb3-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6: smb3: improve check for when we send the security descriptor context on create smb3: fix mode passed in on create for modetosid mount option cifs: fix possible uninitialized access and race on iface_list cifs: Fix lookup of SMB connections on multichannel smb3: query attributes on file close smb3: remove unused flag passed into close functions cifs: remove redundant assignment to pointer pneg_ctxt fs: cifs: Fix atime update check vs mtime CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks commit 5bf9a06a5f7ca525621f4117257a49dc5a2786da Merge: 9455d25f4e3b 5c8b0dfc6f4a Author: Linus Torvalds Date: Sun Dec 8 11:08:28 2019 -0800 Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs cleanups from Al Viro: "No common topic, just three cleanups". * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: make __d_alloc() static fs/namespace: add __user to open_tree and move_mount syscalls fs/fnctl: fix missing __user in fcntl_rw_hint() commit 9fd229c478fbf77c41c8528aa757ef14210365f6 Author: Geert Uytterhoeven Date: Mon Dec 2 09:55:46 2019 +0100 iio: adc: max9611: Fix too short conversion time delay As of commit b9ddd5091160793e ("iio: adc: max9611: Fix temperature reading in probe"), max9611 initialization sometimes fails on the Salvator-X(S) development board with: max9611 4-007f: Invalid value received from ADC 0x8000: aborting max9611: probe of 4-007f failed with error -5 The max9611 driver tests communications with the chip by reading the die temperature during the probe function, which returns an invalid value. According to the datasheet, the typical ADC conversion time is 2 ms, but no minimum or maximum values are provided. Maxim Technical Support confirmed this was tested with temperature Ta=25 degreeC, and promised to inform me if a maximum/minimum value is available (they didn't get back to me, so I assume it is not). However, the driver assumes a 1 ms conversion time. Usually the usleep_range() call returns after more than 1.8 ms, hence it succeeds. When it returns earlier, the data register may be read too early, and the previous measurement value will be returned. After boot, this is the temperature POR (power-on reset) value, causing the failure above. Fix this by increasing the delay from 1000-2000 µs to 3000-3300 µs. Note that this issue has always been present, but it was exposed by the aformentioned commit. Fixes: 69780a3bbc0b1e7e ("iio: adc: Add Maxim max9611 ADC driver") Signed-off-by: Geert Uytterhoeven Reviewed-by: Jacopo Mondi Reviewed-by: Wolfram Sang Signed-off-by: Jonathan Cameron commit 3b71f6b59508b1c9befcb43de434866aafc76520 Author: Andrea Merello Date: Mon Dec 2 15:13:36 2019 +0100 iio: ad7949: fix channels mixups Each time we need to read a sample (from the sysfs interface, since the driver supports only it) the driver writes the configuration register with the proper settings needed to perform the said read, then it runs another xfer to actually read the resulting value. Most notably the configuration register is updated to set the ADC internal MUX depending by which channel the read targets. Unfortunately this seems not enough to ensure correct operation because the ADC works in a pipelined-like fashion and the new configuration isn't applied in time. The ADC alternates two phases: acquisition and conversion. During the acquisition phase the ADC samples the analog signal in an internal capacitor; in the conversion phase the ADC performs the actual analog to digital conversion of the stored voltage. Note that of course the MUX needs to be set to the proper channel when the acquisition phase is performed. Once the conversion phase has been completed, the device automatically switches back to a new acquisition; on the other hand the device switches from acquisition to conversion on the rising edge of SPI cs signal (that is when the xfer finishes). Only after both two phases have been completed (with the proper settings already written in the configuration register since the beginning) it is possible to read the outcome from SPI bus. With the current driver implementation, we end up in the following situation: _______ 1st xfer ____________ 2nd xfer ___________________ SPI cs.. \_________/ \_________/ SPI rd.. idle |(val N-2)+ idle | val N-1 + idle ... SPI wr.. idle | cfg N + idle | (X) + idle ... ------------------------ + -------------------- + ------------------ AD .. acq N-1 + cnv N-1 | acq N + cnv N | acq N+1 As shown in the diagram above, the value we read in the Nth read belongs to configuration setting N-1. In case the configuration is not changed (config[N] == config[N-1]), then we still get correct data, but in case the configuration changes (i.e. switching the MUX on another channel), we get wrong data (data from the previously selected channel). This patch fixes this by performing one more "dummy" transfer in order to ending up in reading the data when it's really ready, as per the following timing diagram. _______ 1st xfer ____________ 2nd xfer ___________ 3rd xfer ___ SPI cs.. \_________/ \_________/ \_________/ SPI rd.. idle |(val N-2)+ idle |(val N-1)+ idle | val N + .. SPI wr.. idle | cfg N + idle | (X) + idle | (X) + .. ------------------------ + -------------------- + ------------------- + -- AD .. acq N-1 + cnv N-1 | acq N + cnv N | acq N+1 | .. NOTE: in the latter case (cfg changes), the acquisition phase for the value to be read begins after the 1st xfer, that is after the read request has been issued on sysfs. On the other hand, if the cfg doesn't change, then we can refer to the fist diagram assuming N == (N - 1); the acquisition phase _begins_ before the 1st xfer (potentially a lot of time before the read has been issued via sysfs, but it _ends_ after the 1st xfer, that is _after_ the read has started. This should guarantee a reasonably fresh data, which value represents the voltage that the sampled signal has after the read start or maybe just around it. Signed-off-by: Andrea Merello Reviewed-by: Charles-Antoine Couret Cc: Signed-off-by: Jonathan Cameron commit bd41c445b7b96e46efb799ff33bdf870479488cf Author: Lorenzo Bianconi Date: Fri Nov 29 11:37:24 2019 +0200 iio: imu: st_lsm6dsx: do not power-off accel if events are enabled Do not power-off accel unconditionally if wake-up events are enabled powering off the hw FIFO. At the same time do not power-off the accel sensor if it is 'batched' in the hw FIFO disabling sensor events Fixes: b5969abfa8b8 ("iio: imu: st_lsm6dsx: add motion events") Tested-by: Sean Nyekjaer Signed-off-by: Lorenzo Bianconi Signed-off-by: Jonathan Cameron commit c2686eb2aed322c642b5a291d5b9d67fe4301d4a Author: Lorenzo Bianconi Date: Thu Nov 28 17:42:30 2019 +0200 iio: imu: st_lsm6dsx: track hw FIFO buffering with fifo_mask Track hw FIFO state introducing fifo_mask since now the accel sensor can be enabled during suspend/resume in order to trigger the wake-up enabling the FIFO in st_lsm6dsx_resume even if it was disabled before the suspend. Hence we must separately track the fifo state. Fixes: 4c997dfa692d ("iio: imu: st_lsm6dsx: add wakeup-source option") Signed-off-by: Lorenzo Bianconi Tested-by: Sean Nyekjaer Signed-off-by: Jonathan Cameron commit 5685b145c138b2ca696076106d0fb87b7b90b14a Author: Lorenzo Bianconi Date: Thu Nov 28 17:55:18 2019 +0200 iio: imu: st_lsm6dsx: fix decimation factor estimation Fix decimation factor and sip estimation for LSM6DSM series (max value for decimation factor is 32). If gyro and accel sensors are enabled at 12.5Hz and 416Hz respectively, decimation factor lookup will fail, producing unaligned data. Remove unused decimator filed in st_lsm6dsx_sensor structure. Fixes: f8710f0357bc ("iio: imu: st_lsm6dsx: express odr in mHZ") Signed-off-by: Lorenzo Bianconi Signed-off-by: Jonathan Cameron commit 53eaa9c27fdc01b4f4d885223e29f97393409e7e Author: Jean-Baptiste Maneyrol Date: Tue Nov 26 17:19:12 2019 +0100 iio: imu: inv_mpu6050: fix temperature reporting using bad unit Temperature should be reported in milli-degrees, not degrees. Fix scale and offset values to use the correct unit. This is a fix for an issue that has been present for a long time. The fixes tag reflects the point at which the code last changed in a fashion that would make this fix patch no longer apply. Backports will be necessary to fix those elements that predate that patch. Fixes: 1615fe41a195 ("iio: imu: mpu6050: Fix FIFO layout for ICM20602") Cc: stable@vger.kernel.org Signed-off-by: Jean-Baptiste Maneyrol Signed-off-by: Jonathan Cameron commit 342a6928bd5017edbdae376042d8ad6af3d3b943 Author: Chris Lesiak Date: Thu Nov 21 20:39:42 2019 +0000 iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting The IIO_HUMIDITYRELATIVE channel was being incorrectly reported back as percent when it should have been milli percent. This is via an incorrect scale value being returned to userspace. Signed-off-by: Chris Lesiak Acked-by: Matt Ranostay Cc: Signed-off-by: Jonathan Cameron commit c41d79b74b3b106310b43d68fd5a304735c3369f Author: Chuhong Yuan Date: Mon Nov 18 19:40:18 2019 +0800 iio: adc: max1027: fix not unregistered iio trigger The driver forgets to unregister the iio trigger in probe failure and remove. Use devm API to fix it. Signed-off-by: Chuhong Yuan Signed-off-by: Jonathan Cameron commit 1f310f77efa25660fcbf58629a96f8ee6aac85ba Author: Dan Carpenter Date: Tue Nov 19 09:21:24 2019 +0300 iio: adc: intel_mrfld_adc: Allocating too much data in probe() This probe function is passing the wrong size to devm_iio_device_alloc(). It is supposed to be the size of the private data. Fortunately, sizeof(*indio_dev) is larger than sizeof(struct mrfld_adc) so it doesn't cause a runtime problem. Fixes: a7118662734a ("iio: adc: intel_mrfld_adc: Add Basin Cove ADC driver") Signed-off-by: Dan Carpenter Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 11d7c8d3b1259c303fb52789febed58f0bc35ad1 Author: Mircea Caprioru Date: Mon Nov 18 10:38:57 2019 +0200 iio: adc: ad7124: Enable internal reference When the internal reference was selected by a channel it was not enabled. This patch fixes that and enables it. Fixes: b3af341bbd96 ("iio: adc: Add ad7124 support") Signed-off-by: Mircea Caprioru Cc: Signed-off-by: Jonathan Cameron commit ada971cbdc37bd1f0f9b6d7373c24b67e14c5c13 Author: Marcelo Schmitt Date: Sat Nov 16 17:51:13 2019 -0300 dt-bindings: iio: adc: ad7292: fix constraint over channel quantity Change items property of AD7292 channels to correctly constrain their quantity. Signed-off-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit dd587a7f0af5bdb2567e68da0093bbe654ecc950 Author: Marcelo Schmitt Date: Sat Nov 16 17:50:29 2019 -0300 dt-bindings: iio: adc: ad7292: Update SPDX identifier Update SPDX identifier to the preferred dual GPL-2.0 OR BSD-2-Clause licensing. Signed-off-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit 2e19b6c3efcf074528533c7b98a42bcb1234ebb9 Author: Colin Ian King Date: Tue Nov 5 20:28:18 2019 +0000 iio: temperature: ltc2983: fix u32 read into a unsigned long long Currently the read of temp using of_property_read_u32_index is reading a u32 value into a unsigned long long. This relies on machine endianness to work correctly, so fix this by reading a u32 value and setting temp to this value. Addresses-Coverity: ("Reliance on integer endianness") Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983") Signed-off-by: Colin Ian King Acked-by: Nuno Sá Signed-off-by: Jonathan Cameron commit 0163c1c521ff8b09cd8ca395003cc00178161d77 Author: YueHaibing Date: Mon Nov 11 11:21:15 2019 +0800 iio: st_accel: Fix unused variable warning drivers/iio/accel/st_accel_core.c:1005:44: warning: mount_matrix_ext_info defined but not used [-Wunused-const-variable=] Using stub helper while CONFIG_ACPI is disabled to fix it. Suggested-by: Ladislav Michl Signed-off-by: YueHaibing Signed-off-by: Jonathan Cameron commit 341826a065660d1b77d89e6335b6095cd654271c Author: Beniamin Bia Date: Mon Nov 4 18:26:34 2019 +0200 iio: adc: ad7606: fix reading unnecessary data from device When a conversion result is being read from ADC, the driver reads the number of channels + 1 because it thinks that IIO_CHAN_SOFT_TIMESTAMP is also a physical channel. This patch fixes this issue. Fixes: 2985a5d88455 ("staging: iio: adc: ad7606: Move out of staging") Reported-by: Robert Wörle Signed-off-by: Beniamin Bia Cc: Signed-off-by: Jonathan Cameron commit ffafde478309af01b2a495ecaf203125abfb35bd Author: Gao Xiang Date: Sat Dec 7 10:37:26 2019 +0800 erofs: update documentation Some on-disk structures, fields have been renamed in v5.4, the corresponding document should be updated as well. Also fix misrespresentation of file time and words about fixed-sized output compression, data inline, etc. Link: https://lore.kernel.org/r/20191207025509.6614-1-hsiangkao@aol.com/ Signed-off-by: Gao Xiang commit b418d660bb9798d2249ac6a46c844389ef50b6a5 Author: Andy Shevchenko Date: Fri Dec 6 16:55:42 2019 +0000 efi/earlycon: Remap entire framebuffer after page initialization When commit: 69c1f396f25b ("efi/x86: Convert x86 EFI earlyprintk into generic earlycon implementation") moved the x86 specific EFI earlyprintk implementation to a shared location, it also tweaked the behaviour. In particular, it dropped a trick with full framebuffer remapping after page initialization, leading to two regressions: 1) very slow scrolling after page initialization, 2) kernel hang when the 'keep_bootcon' command line argument is passed. Putting the tweak back fixes #2 and mitigates #1, i.e., it limits the slow behavior to the early boot stages, presumably due to eliminating heavy map()/unmap() operations per each pixel line on the screen. [ ardb: ensure efifb is unmapped again unless keep_bootcon is in effect. ] [ mingo: speling fixes. ] Signed-off-by: Andy Shevchenko Signed-off-by: Ard Biesheuvel Cc: Arvind Sankar Cc: Bhupesh Sharma Cc: Masayoshi Mizuma Cc: linux-efi@vger.kernel.org Fixes: 69c1f396f25b ("efi/x86: Convert x86 EFI earlyprintk into generic earlycon implementation") Link: https://lkml.kernel.org/r/20191206165542.31469-7-ardb@kernel.org Signed-off-by: Ingo Molnar commit 9fa76ca7b8bdcdf51fc8c7b7b7a7bfc4eccceb58 Author: Arvind Sankar Date: Fri Dec 6 16:55:41 2019 +0000 efi: Fix efi_loaded_image_t::unload type The ::unload field is a function pointer, so it should be u32 for 32-bit, u64 for 64-bit. Add a prototype for it in the native efi_loaded_image_t type. Also change type of parent_handle and device_handle from void * to efi_handle_t for documentation purposes. The unload method is not used, so no functional change. Signed-off-by: Arvind Sankar Signed-off-by: Ard Biesheuvel Cc: Andy Shevchenko Cc: Bhupesh Sharma Cc: Linus Torvalds Cc: Masayoshi Mizuma Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: https://lkml.kernel.org/r/20191206165542.31469-6-ardb@kernel.org Signed-off-by: Ingo Molnar commit ff397be685e410a59c34b21ce0c55d4daa466bb7 Author: Arvind Sankar Date: Fri Dec 6 16:55:40 2019 +0000 efi/gop: Fix memory leak in __gop_query32/64() efi_graphics_output_protocol::query_mode() returns info in callee-allocated memory which must be freed by the caller, which we aren't doing. We don't actually need to call query_mode() in order to obtain the info for the current graphics mode, which is already there in gop->mode->info, so just access it directly in the setup_gop32/64() functions. Also nothing uses the size of the info structure, so don't update the passed-in size (which is the size of the gop_handle table in bytes) unnecessarily. Signed-off-by: Arvind Sankar Signed-off-by: Ard Biesheuvel Cc: Andy Shevchenko Cc: Bhupesh Sharma Cc: Masayoshi Mizuma Cc: linux-efi@vger.kernel.org Link: https://lkml.kernel.org/r/20191206165542.31469-5-ardb@kernel.org Signed-off-by: Ingo Molnar commit dbd89c303b4420f6cdb689fd398349fc83b059dd Author: Arvind Sankar Date: Fri Dec 6 16:55:39 2019 +0000 efi/gop: Return EFI_SUCCESS if a usable GOP was found If we've found a usable instance of the Graphics Output Protocol (GOP) with a framebuffer, it is possible that one of the later EFI calls fails while checking if any support console output. In this case status may be an EFI error code even though we found a usable GOP. Fix this by explicitly return EFI_SUCCESS if a usable GOP has been located. Signed-off-by: Arvind Sankar Signed-off-by: Ard Biesheuvel Cc: Andy Shevchenko Cc: Bhupesh Sharma Cc: Masayoshi Mizuma Cc: linux-efi@vger.kernel.org Link: https://lkml.kernel.org/r/20191206165542.31469-4-ardb@kernel.org Signed-off-by: Ingo Molnar commit 6fc3cec30dfeee7d3c5db8154016aff9d65503c5 Author: Arvind Sankar Date: Fri Dec 6 16:55:38 2019 +0000 efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs If we don't find a usable instance of the Graphics Output Protocol (GOP) because none of them have a framebuffer (i.e. they were all PIXEL_BLT_ONLY), but all the EFI calls succeeded, we will return EFI_SUCCESS even though we didn't find a usable GOP. Fix this by explicitly returning EFI_NOT_FOUND if no usable GOPs are found, allowing the caller to probe for UGA instead. Signed-off-by: Arvind Sankar Signed-off-by: Ard Biesheuvel Cc: Andy Shevchenko Cc: Bhupesh Sharma Cc: Masayoshi Mizuma Cc: linux-efi@vger.kernel.org Link: https://lkml.kernel.org/r/20191206165542.31469-3-ardb@kernel.org Signed-off-by: Ingo Molnar commit ab0eb16205b43ece4c78e2259e681ff3d645ea66 Author: Ard Biesheuvel Date: Fri Dec 6 16:55:37 2019 +0000 efi/memreserve: Register reservations as 'reserved' in /proc/iomem Memory regions that are reserved using efi_mem_reserve_persistent() are recorded in a special EFI config table which survives kexec, allowing the incoming kernel to honour them as well. However, such reservations are not visible in /proc/iomem, and so the kexec tools that load the incoming kernel and its initrd into memory may overwrite these reserved regions before the incoming kernel has a chance to reserve them from further use. Address this problem by adding these reservations to /proc/iomem as they are created. Note that reservations that are inherited from a previous kernel are memblock_reserve()'d early on, so they are already visible in /proc/iomem. Tested-by: Masayoshi Mizuma Tested-by: Bhupesh Sharma Signed-off-by: Ard Biesheuvel Reviewed-by: Bhupesh Sharma Cc: # v5.4+ Cc: Andy Shevchenko Cc: Arvind Sankar Cc: linux-efi@vger.kernel.org Link: https://lkml.kernel.org/r/20191206165542.31469-2-ardb@kernel.org Signed-off-by: Ingo Molnar commit da2311a6385c3b499da2ed5d9be59ce331fa93e9 Author: Xiaolong Huang Date: Sat Dec 7 22:40:24 2019 +0800 can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices Uninitialized Kernel memory can leak to USB devices. Fix this by using kzalloc() instead of kmalloc(). Signed-off-by: Xiaolong Huang Fixes: 7259124eac7d ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c") Cc: linux-stable # >= v4.19 Signed-off-by: Marc Kleine-Budde commit 2de497356955ce58cd066fb03d2da5235f3c7c23 Author: Dan Murphy Date: Wed Dec 4 11:51:12 2019 -0600 can: tcan45x: Make wake-up GPIO an optional GPIO The device has the ability to disable the wake-up pin option. The wake-up pin can be either force to GND or Vsup and does not have to be tied to a GPIO. In order for the device to not use the wake-up feature write the register to disable the WAKE_CONFIG option. Signed-off-by: Dan Murphy Cc: Sean Nyekjaer Reviewed-by: Sean Nyekjaer Signed-off-by: Marc Kleine-Budde commit 1202d2318e2f370befe6c154db75ffaad3ec7ba0 Author: Dan Murphy Date: Wed Dec 4 11:51:11 2019 -0600 dt-bindings: tcan4x5x: Make wake-gpio an optional gpio The wake-up of the device can be configured as an optional feature of the device. Move the wake-up gpio from a requried property to an optional property. Signed-off-by: Dan Murphy Cc: Rob Herring Reviewed-by: Sean Nyekjaer Tested-by: Sean Nyekjaer Signed-off-by: Marc Kleine-Budde commit 9c9e1b012a218019079d676a95b9570b7f444f7f Author: Sean Nyekjaer Date: Fri Dec 6 16:29:23 2019 +0100 dt-bindings: can: tcan4x5x: reset pin is active high Change the reset pin example to active high to be in line with the datasheet Signed-off-by: Sean Nyekjaer Cc: Rob Herring Signed-off-by: Marc Kleine-Budde commit 60552253e29c8860ee5bf1e6064591b0917c0394 Author: Sean Nyekjaer Date: Fri Dec 6 16:29:22 2019 +0100 can: m_can: tcan4x5x: add required delay after reset According to section "8.3.8 RST Pin" in the datasheet we are required to wait >700us after the device is reset. Signed-off-by: Sean Nyekjaer Acked-by: Dan Murphy Cc: linux-stable # >= v5.4 Signed-off-by: Marc Kleine-Budde commit 048e3a34a2e7669bf475eb56c7345ad9d8d2b8e3 Author: Joakim Zhang Date: Wed Dec 4 11:36:14 2019 +0000 can: flexcan: poll MCR_LPM_ACK instead of GPR ACK for stop mode acknowledgment Stop Mode is entered when Stop Mode is requested at chip level and MCR[LPM_ACK] is asserted by the FlexCAN. Double check with IP owner, the MCR[LPM_ACK] bit should be polled for stop mode acknowledgment, not the acknowledgment from chip level which is used to gate flexcan clocks. This patch depends on: b7603d080ffc ("can: flexcan: add low power enter/exit acknowledgment helper") Fixes: 5f186c257fa4 (can: flexcan: fix stop mode acknowledgment) Tested-by: Sean Nyekjaer Signed-off-by: Joakim Zhang Cc: linux-stable # >= v5.0 Signed-off-by: Marc Kleine-Budde commit b7603d080ffcf8689ec91ca300caf84d8dbed317 Author: Joakim Zhang Date: Wed Dec 4 11:36:11 2019 +0000 can: flexcan: add low power enter/exit acknowledgment helper The MCR[LPMACK] read-only bit indicates that FlexCAN is in a lower-power mode (Disabled mode, Doze mode, Stop mode). The CPU can poll this bit to know when FlexCAN has actually entered low power mode. The low power enter/exit acknowledgment helper will reduce code duplication for disabled mode, doze mode and stop mode. Tested-by: Sean Nyekjaer Signed-off-by: Joakim Zhang Signed-off-by: Marc Kleine-Budde commit e707180ae2df1c87e26ec7a6fd70d07483bde7fd Author: Sean Nyekjaer Date: Wed Dec 4 11:36:06 2019 +0000 can: flexcan: fix possible deadlock and out-of-order reception after wakeup When suspending, and there is still CAN traffic on the interfaces the flexcan immediately wakes the platform again. As it should :-). But it throws this error msg: [ 3169.378661] PM: noirq suspend of devices failed On the way down to suspend the interface that throws the error message calls flexcan_suspend() but fails to call flexcan_noirq_suspend(). That means flexcan_enter_stop_mode() is called, but on the way out of suspend the driver only calls flexcan_resume() and skips flexcan_noirq_resume(), thus it doesn't call flexcan_exit_stop_mode(). This leaves the flexcan in stop mode, and with the current driver it can't recover from this even with a soft reboot, it requires a hard reboot. This patch fixes the deadlock when using self wakeup, by calling flexcan_exit_stop_mode() from flexcan_resume() instead of flexcan_noirq_resume(). This also fixes another issue: CAN frames are received out-of-order in first IRQ handler run after wakeup. The problem is that the wakeup latency from frame reception to the IRQ handler (where the CAN frames are sorted by timestamp) is much bigger than the time stamp counter wrap around time. This means it's impossible to sort the CAN frames by timestamp. The reason is that the controller exits stop mode during noirq resume, which means it receives frames immediately, but interrupt handling is still not possible. So exit stop mode during resume stage instead of noirq resume fixes this issue. Fixes: de3578c198c6 ("can: flexcan: add self wakeup support") Signed-off-by: Sean Nyekjaer Tested-by: Sean Nyekjaer Signed-off-by: Joakim Zhang Cc: linux-stable # >= v5.0 Signed-off-by: Marc Kleine-Budde commit 9ab79b06ddf3cdf6484d60b3e5fe113e733145c8 Author: Srinivas Neeli Date: Tue Dec 3 17:46:36 2019 +0530 can: xilinx_can: Fix missing Rx can packets on CANFD2.0 CANFD2.0 core uses BRAM for storing acceptance filter ID(AFID) and MASK (AFMASK)registers. So by default AFID and AFMASK registers contain random data. Due to random data, we are not able to receive all CAN ids. Initializing AFID and AFMASK registers with Zero before enabling acceptance filter to receive all packets irrespective of ID and Mask. Fixes: 0db9071353a0 ("can: xilinx: add can 2.0 support") Signed-off-by: Michal Simek Signed-off-by: Srinivas Neeli Reviewed-by: Naga Sureshkumar Relli Cc: linux-stable # >= v5.0 Signed-off-by: Marc Kleine-Budde commit 8ac9d71d601374222a230804e419cd40c4492e1c Author: Marc Kleine-Budde Date: Thu Nov 21 10:47:50 2019 +0100 can: j1939: fix address claim code example During development the define J1939_PGN_ADDRESS_REQUEST was renamed to J1939_PGN_REQUEST. It was forgotten to adjust the documentation accordingly. This patch fixes the name of the symbol. Reported-by: https://github.com/linux-can/can-utils/issues/159#issuecomment-556538798 Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Cc: Oleksij Rempel Signed-off-by: Marc Kleine-Budde commit 00d4e14d2e4caf5f7254a505fee5eeca8cd37bd4 Author: Oleksij Rempel Date: Fri Dec 6 15:18:35 2019 +0100 can: j1939: j1939_sk_bind(): take priv after lock is held syzbot reproduced following crash: =============================================================================== kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9844 Comm: syz-executor.0 Not tainted 5.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__lock_acquire+0x1254/0x4a00 kernel/locking/lockdep.c:3828 Code: 00 0f 85 96 24 00 00 48 81 c4 f0 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 0b 28 00 00 49 81 3e 20 19 78 8a 0f 84 5f ee ff RSP: 0018:ffff888099c3fb48 EFLAGS: 00010006 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000218 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffff888099c3fc60 R08: 0000000000000001 R09: 0000000000000001 R10: fffffbfff146e1d0 R11: ffff888098720400 R12: 00000000000010c0 R13: 0000000000000000 R14: 00000000000010c0 R15: 0000000000000000 FS: 00007f0559e98700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe4d89e0000 CR3: 0000000099606000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4485 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x33/0x50 kernel/locking/spinlock.c:175 spin_lock_bh include/linux/spinlock.h:343 [inline] j1939_jsk_del+0x32/0x210 net/can/j1939/socket.c:89 j1939_sk_bind+0x2ea/0x8f0 net/can/j1939/socket.c:448 __sys_bind+0x239/0x290 net/socket.c:1648 __do_sys_bind net/socket.c:1659 [inline] __se_sys_bind net/socket.c:1657 [inline] __x64_sys_bind+0x73/0xb0 net/socket.c:1657 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45a679 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f0559e97c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a679 RDX: 0000000000000018 RSI: 0000000020000240 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0559e986d4 R13: 00000000004c09e9 R14: 00000000004d37d0 R15: 00000000ffffffff Modules linked in: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 9844 at kernel/locking/mutex.c:1419 mutex_trylock+0x279/0x2f0 kernel/locking/mutex.c:1427 =============================================================================== This issues was caused by null pointer deference. Where j1939_sk_bind() was using currently not existing priv. Possible scenario may look as following: cpu0 cpu1 bind() bind() j1939_sk_bind() j1939_sk_bind() priv = jsk->priv; priv = jsk->priv; lock_sock(sock->sk); priv = j1939_netdev_start(ndev); j1939_jsk_add(priv, jsk); jsk->priv = priv; relase_sock(sock->sk); lock_sock(sock->sk); j1939_jsk_del(priv, jsk); ..... ooops ...... With this patch we move "priv = jsk->priv;" after the lock, to avoid assigning of wrong priv pointer. Reported-by: syzbot+99e9e1b200a1e363237d@syzkaller.appspotmail.com Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Signed-off-by: Oleksij Rempel Cc: linux-stable # >= v5.4 Signed-off-by: Marc Kleine-Budde commit 1a2e9d2f794e8789d8b4503340ea3465163db2f8 Author: Dan Murphy Date: Thu Dec 5 11:57:16 2019 -0600 MAINTAINERS: Add myself as a maintainer for TCAN4x5x Adding myself to support the TI TCAN4X5X SPI CAN device. Signed-off-by: Dan Murphy Signed-off-by: Marc Kleine-Budde commit fd230ffaa48b28954cde1bf1121aedcbb8db3883 Author: Dan Murphy Date: Thu Dec 5 11:57:15 2019 -0600 MAINTAINERS: Add myself as a maintainer for MMIO m_can Since I refactored the code to create a m_can framework and we have a MMIO MCAN IP as well add myself to help maintain the code. Signed-off-by: Dan Murphy Signed-off-by: Marc Kleine-Budde commit c08f0a92f4bef9467810551a2db0201d1b95d01e Author: Olof Johansson Date: Sat Dec 7 14:49:53 2019 -0800 ALSA: echoaudio: simplify get_audio_levels The loop optimizer seems to go astray here, and produces some warnings that don't seem valid. Still, the code can be simplified -- just clear the whole array at the beginning, and fill in whatever values are valid on the platform. Warnings before this change (GCC 8.2.0 ARM allmodconfig): In file included from ../sound/pci/echoaudio/gina24.c:115: ../sound/pci/echoaudio/echoaudio.c: In function 'snd_echo_vumeters_get': ../sound/pci/echoaudio/echoaudio_dsp.c:647:9: warning: iteration 1073741824 invokes undefined behavior [-Waggressive-loop-optimizations] In file included from ../sound/pci/echoaudio/layla24.c:112: ../sound/pci/echoaudio/echoaudio.c: In function 'snd_echo_vumeters_get': ../sound/pci/echoaudio/echoaudio_dsp.c:658:9: warning: iteration 1073741824 invokes undefined behavior [-Waggressive-loop-optimizations] ../sound/pci/echoaudio/echoaudio_dsp.c:647:9: warning: iteration 1073741824 invokes undefined behavior [-Waggressive-loop-optimizations] Signed-off-by: Olof Johansson Link: https://lore.kernel.org/r/20191207224953.25944-1-olof@lixom.net Signed-off-by: Takashi Iwai commit 9455d25f4e3b3d009fa1b810862e5b06229530e4 Merge: 737214515d79 9b5b99a89f64 Author: Linus Torvalds Date: Sat Dec 7 18:38:17 2019 -0800 Merge tag 'ntb-5.5' of git://github.com/jonmason/ntb Pull NTB update from Jon Mason: "Just a simple patch to add a new Hygon Device ID to the AMD NTB device driver" * tag 'ntb-5.5' of git://github.com/jonmason/ntb: NTB: Add Hygon Device ID commit 737214515d7965485c52bc5f869e57a6976cf216 Merge: 95207d554b96 afbd65f5e71a Author: Linus Torvalds Date: Sat Dec 7 18:33:01 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull more input updates from Dmitry Torokhov: - fixups for Synaptics RMI4 driver - a quirk for Goodinx touchscreen on Teclast tablet - a new keycode definition for activating privacy screen feature found on a few "enterprise" laptops - updates to snvs_pwrkey driver - polling uinput device for writing (which is always allowed) now works * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash Input: goodix - add upside-down quirk for Teclast X89 tablet Input: add privacy screen toggle keycode Input: uinput - fix returning EPOLLOUT from uinput_poll Input: snvs_pwrkey - remove gratuitous NULL initializers Input: snvs_pwrkey - send key events for i.MX6 S, DL and Q commit 95207d554b968a552cc93a834af6c1ec295ebaba Merge: 50caca9d7f63 c275779ff2dd Author: Linus Torvalds Date: Sat Dec 7 17:07:18 2019 -0800 Merge tag 'iomap-5.5-merge-14' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap fixes from Darrick Wong: "Fix a race condition and a use-after-free error: - Fix a UAF when reporting writeback errors - Fix a race condition when handling page uptodate on fragmented file with blocksize < pagesize" * tag 'iomap-5.5-merge-14' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: stop using ioend after it's been freed in iomap_finish_ioend() iomap: fix sub-page uptodate handling commit 50caca9d7f633bb2aad7f979c40db01a4811abcd Merge: 316933cf74b0 798a9cada469 Author: Linus Torvalds Date: Sat Dec 7 17:05:33 2019 -0800 Merge tag 'xfs-5.5-merge-17' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "Fix a couple of resource management errors and a hang: - fix a crash in the log setup code when log mounting fails - fix a hang when allocating space on the realtime device - fix a block leak when freeing space on the realtime device" * tag 'xfs-5.5-merge-17' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix mount failure crash on invalid iclog memory access xfs: don't check for AG deadlock for realtime files in bunmapi xfs: fix realtime file data space leak commit 316933cf74b07c6fedcbb0de4564af82f0820a43 Merge: 911d137ab027 f9bbb68233aa Author: Linus Torvalds Date: Sat Dec 7 16:59:25 2019 -0800 Merge tag 'for-linus-5.5-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs update from Mike Marshall: "orangefs: posix open permission checking... Orangefs has no open, and orangefs checks file permissions on each file access. Posix requires that file permissions be checked on open and nowhere else. Orangefs-through-the-kernel needs to seem posix compliant. The VFS opens files, even if the filesystem provides no method. We can see if a file was successfully opened for read and or for write by looking at file->f_mode. When writes are flowing from the page cache, file is no longer available. We can trust the VFS to have checked file->f_mode before writing to the page cache. The mode of a file might change between when it is opened and IO commences, or it might be created with an arbitrary mode. We'll make sure we don't hit EACCES during the IO stage by using UID 0" [ This is "posixish", but not a great solution in the long run, since a proper secure network server shouldn't really trust the client like this. But proper and secure POSIX behavior requires an open method and a resulting cookie for IO of some kind, or similar. - Linus ] * tag 'for-linus-5.5-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: orangefs: posix open permission checking... commit 911d137ab027e6dac03695bfe71702e64b6aa161 Merge: fb9bf40cf028 38a2204f5298 Author: Linus Torvalds Date: Sat Dec 7 16:56:00 2019 -0800 Merge tag 'nfsd-5.5' of git://linux-nfs.org/~bfields/linux Pull nfsd updates from Bruce Fields: "This is a relatively quiet cycle for nfsd, mainly various bugfixes. Possibly most interesting is Trond's fixes for some callback races that were due to my incomplete understanding of rpc client shutdown. Unfortunately at the last minute I've started noticing a new intermittent failure to send callbacks. As the logic seems basically correct, I'm leaving Trond's patches in for now, and hope to find a fix in the next week so I don't have to revert those patches" * tag 'nfsd-5.5' of git://linux-nfs.org/~bfields/linux: (24 commits) nfsd: depend on CRYPTO_MD5 for legacy client tracking NFSD fixing possible null pointer derefering in copy offload nfsd: check for EBUSY from vfs_rmdir/vfs_unink. nfsd: Ensure CLONE persists data and metadata changes to the target file SUNRPC: Fix backchannel latency metrics nfsd: restore NFSv3 ACL support nfsd: v4 support requires CRYPTO_SHA256 nfsd: Fix cld_net->cn_tfm initialization lockd: remove __KERNEL__ ifdefs sunrpc: remove __KERNEL__ ifdefs race in exportfs_decode_fh() nfsd: Drop LIST_HEAD where the variable it declares is never used. nfsd: document callback_wq serialization of callback code nfsd: mark cb path down on unknown errors nfsd: Fix races between nfsd4_cb_release() and nfsd4_shutdown_callback() nfsd: minor 4.1 callback cleanup SUNRPC: Fix svcauth_gss_proxy_init() SUNRPC: Trace gssproxy upcall results sunrpc: fix crash when cache_head become valid before update nfsd: remove private bin2hex implementation ... commit fb9bf40cf028ebbe7d5bdf8f7e93abe8e30bed0d Merge: 94e89b402354 a264abad51d8 Author: Linus Torvalds Date: Sat Dec 7 16:50:55 2019 -0800 Merge tag 'nfs-for-5.5-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Highlights include: Features: - NFSv4.2 now supports cross device offloaded copy (i.e. offloaded copy of a file from one source server to a different target server). - New RDMA tracepoints for debugging congestion control and Local Invalidate WRs. Bugfixes and cleanups - Drop the NFSv4.1 session slot if nfs4_delegreturn_prepare waits for layoutreturn - Handle bad/dead sessions correctly in nfs41_sequence_process() - Various bugfixes to the delegation return operation. - Various bugfixes pertaining to delegations that have been revoked. - Cleanups to the NFS timespec code to avoid unnecessary conversions between timespec and timespec64. - Fix unstable RDMA connections after a reconnect - Close race between waking an RDMA sender and posting a receive - Wake pending RDMA tasks if connection fails - Fix MR list corruption, and clean up MR usage - Fix another RPCSEC_GSS issue with MIC buffer space" * tag 'nfs-for-5.5-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (79 commits) SUNRPC: Capture completion of all RPC tasks SUNRPC: Fix another issue with MIC buffer space NFS4: Trace lock reclaims NFS4: Trace state recovery operation NFSv4.2 fix memory leak in nfs42_ssc_open NFSv4.2 fix kfree in __nfs42_copy_file_range NFS: remove duplicated include from nfs4file.c NFSv4: Make _nfs42_proc_copy_notify() static NFS: Fallocate should use the nfs4_fattr_bitmap NFS: Return -ETXTBSY when attempting to write to a swapfile fs: nfs: sysfs: Remove NULL check before kfree NFS: remove unneeded semicolon NFSv4: add declaration of current_stateid NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for layoutreturn NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process() nfsv4: Move NFSPROC4_CLNT_COPY_NOTIFY to end of list SUNRPC: Avoid RPC delays when exiting suspend NFS: Add a tracepoint in nfs_fh_to_dentry() NFSv4: Don't retry the GETATTR on old stateid in nfs4_delegreturn_done() NFSv4: Handle NFS4ERR_OLD_STATEID in delegreturn ... commit 231e2a0ba56733c95cb77d8920e76502b2134e72 Author: Steve French Date: Sat Dec 7 17:38:22 2019 -0600 smb3: improve check for when we send the security descriptor context on create We had cases in the previous patch where we were sending the security descriptor context on SMB3 open (file create) in cases when we hadn't mounted with with "modefromsid" mount option. Add check for that mount flag before calling ad_sd_context in open init. Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit 94e89b40235476a83a53a47b9ffb0cb91a4c335e Merge: f74fd13f4585 9917b54aded1 Author: Linus Torvalds Date: Sat Dec 7 14:51:04 2019 -0800 Merge tag 'vfio-v5.5-rc1' of git://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Remove hugepage checks for reserved pfns (Ben Luo) - Fix irq-bypass unregister ordering (Jiang Yi) * tag 'vfio-v5.5-rc1' of git://github.com/awilliam/linux-vfio: vfio/pci: call irq_bypass_unregister_producer() before freeing irq vfio/type1: remove hugepage checks in is_invalid_reserved_pfn() commit f74fd13f4585e418a3e630a82468be58bf1d98c1 Merge: 6dc517a3872b 14855954f636 Author: Linus Torvalds Date: Sat Dec 7 14:49:20 2019 -0800 Merge tag 'for-linus-5.5b-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull more xen updates from Juergen Gross: - a patch to fix a build warning - a cleanup of no longer needed code in the Xen event handling - a small series for the Xen grant driver avoiding high order allocations and replacing an insane global limit by a per-call one - a small series fixing Xen frontend/backend module referencing * tag 'for-linus-5.5b-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen-blkback: allow module to be cleanly unloaded xen/xenbus: reference count registered modules xen/gntdev: switch from kcalloc() to kvcalloc() xen/gntdev: replace global limit of mapped pages by limit per call xen/gntdev: remove redundant non-zero check on ret xen/events: remove event handling recursion detection commit 6dc517a3872ba280c20b2348f2170e4e26e25953 Merge: 85190d15f4ea 68d4b3dfcaf2 Author: Linus Torvalds Date: Sat Dec 7 14:43:46 2019 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc Kconfig updates from Andrew Morton: "A number of changes to Kconfig files under lib/ from Changbin Du and Krzysztof Kozlowski" * emailed patches from Andrew Morton : lib/: fix Kconfig indentation kernel-hacking: move DEBUG_FS to 'Generic Kernel Debugging Instruments' kernel-hacking: move DEBUG_BUGVERBOSE to 'printk and dmesg options' kernel-hacking: create a submenu for scheduler debugging options kernel-hacking: move SCHED_STACK_END_CHECK after DEBUG_STACK_USAGE kernel-hacking: move Oops into 'Lockups and Hangs' kernel-hacking: move kernel testing and coverage options to same submenu kernel-hacking: group kernel data structures debugging together kernel-hacking: create submenu for arch special debugging options kernel-hacking: group sysrq/kgdb/ubsan into 'Generic Kernel Debugging Instruments' commit 0fc75219fe9a3c90631453e9870e4f6d956f0ebc Author: Heiner Kallweit Date: Sat Dec 7 22:21:52 2019 +0100 r8169: fix rtl_hw_jumbo_disable for RTL8168evl In referenced fix we removed the RTL8168e-specific jumbo config for RTL8168evl in rtl_hw_jumbo_enable(). We have to do the same in rtl_hw_jumbo_disable(). v2: fix referenced commit id Fixes: 14012c9f3bb9 ("r8169: fix jumbo configuration for RTL8168evl") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 85190d15f4ea88e60047256fecb8216d5323ea47 Author: Linus Torvalds Date: Sat Dec 7 13:53:09 2019 -0800 pipe: don't use 'pipe_wait() for basic pipe IO pipe_wait() may be simple, but since it relies on the pipe lock, it means that we have to do the wakeup while holding the lock. That's unfortunate, because the very first thing the waked entity will want to do is to get the pipe lock for itself. So get rid of the pipe_wait() usage by simply releasing the pipe lock, doing the wakeup (if required) and then using wait_event_interruptible() to wait on the right condition instead. wait_event_interruptible() handles races on its own by comparing the wakeup condition before and after adding itself to the wait queue, so you can use an optimistic unlocked condition for it. Cc: David Howells Signed-off-by: Linus Torvalds commit 9b5b99a89f641555d9d00452afb0a8aea4471eba Author: Jiasen Lin Date: Sun Nov 17 16:48:36 2019 -0500 NTB: Add Hygon Device ID Signed-off-by: Jiasen Lin Signed-off-by: Jon Mason commit a28c8b9db8a1014aa572cd19a3bdb9ddebd3e555 Author: Linus Torvalds Date: Sat Dec 7 13:21:01 2019 -0800 pipe: remove 'waiting_writers' merging logic This code is ancient, and goes back to when we only had a single page for the pipe buffers. The exact history is hidden in the mists of time (ie "before git", and in fact predates the BK repository too). At that long-ago point in time, it actually helped to try to merge big back-and-forth pipe reads and writes, and not limit pipe reads to the single pipe buffer in length just because that was all we had at a time. However, since then we've expanded the pipe buffers to multiple pages, and this logic really doesn't seem to make sense. And a lot of it is somewhat questionable (ie "hmm, the user asked for a non-blocking read, but we see that there's a writer pending, so let's wait anyway to get the extra data that the writer will have"). But more importantly, it makes the "go to sleep" logic much less obvious, and considering the wakeup issues we've had, I want to make for less of those kinds of things. Cc: David Howells Signed-off-by: Linus Torvalds commit f467a6a66419a18f782f87507464a5dedc942dec Author: Linus Torvalds Date: Sat Dec 7 12:54:26 2019 -0800 pipe: fix and clarify pipe read wakeup logic This is the read side version of the previous commit: it simplifies the logic to only wake up waiting writers when necessary, and makes sure to use a synchronous wakeup. This time not so much for GNU make jobserver reasons (that pipe never fills up), but simply to get the writer going quickly again. A bit less verbose commentary this time, if only because I assume that the write side commentary isn't going to be ignored if you touch this code. Cc: David Howells Signed-off-by: Linus Torvalds commit 1b6b26ae7053e4914181eedf70f2d92c12abda8a Author: Linus Torvalds Date: Sat Dec 7 12:14:28 2019 -0800 pipe: fix and clarify pipe write wakeup logic The pipe rework ends up having been extra painful, partly becaused of actual bugs with ordering and caching of the pipe state, but also because of subtle performance issues. In particular, the pipe rework caused the kernel build to inexplicably slow down. The reason turns out to be that the GNU make jobserver (which limits the parallelism of the build) uses a pipe to implement a "token" system: a parallel submake will read a character from the pipe to get the job token before starting a new job, and will write a character back to the pipe when it is done. The overall job limit is thus easily controlled by just writing the appropriate number of initial token characters into the pipe. But to work well, that really means that the old behavior of write wakeups being synchronous (WF_SYNC) is very important - when the pipe writer wakes up a reader, we want the reader to actually get scheduled immediately. Otherwise you lose the parallelism of the build. The pipe rework lost that synchronous wakeup on write, and we had clearly all forgotten the reasons and rules for it. This rewrites the pipe write wakeup logic to do the required Wsync wakeups, but also clarifies the logic and avoids extraneous wakeups. It also ends up addign a number of comments about what oit does and why, so that we hopefully don't end up forgetting about this next time we change this code. Cc: David Howells Signed-off-by: Linus Torvalds commit 2dd5616ecdcebdf5a8d007af64e040d4e9214efe Author: Eric Dumazet Date: Sat Dec 7 11:34:45 2019 -0800 net_sched: validate TCA_KIND attribute in tc_chain_tmplt_add() Use the new tcf_proto_check_kind() helper to make sure user provided value is well formed. BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:606 [inline] BUG: KMSAN: uninit-value in string+0x4be/0x600 lib/vsprintf.c:668 CPU: 0 PID: 12358 Comm: syz-executor.1 Not tainted 5.4.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108 __msan_warning+0x64/0xc0 mm/kmsan/kmsan_instr.c:245 string_nocheck lib/vsprintf.c:606 [inline] string+0x4be/0x600 lib/vsprintf.c:668 vsnprintf+0x218f/0x3210 lib/vsprintf.c:2510 __request_module+0x2b1/0x11c0 kernel/kmod.c:143 tcf_proto_lookup_ops+0x171/0x700 net/sched/cls_api.c:139 tc_chain_tmplt_add net/sched/cls_api.c:2730 [inline] tc_ctl_chain+0x1904/0x38a0 net/sched/cls_api.c:2850 rtnetlink_rcv_msg+0x115a/0x1580 net/core/rtnetlink.c:5224 netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5242 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x110f/0x1330 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311 __sys_sendmsg net/socket.c:2356 [inline] __do_sys_sendmsg net/socket.c:2365 [inline] __se_sys_sendmsg+0x305/0x460 net/socket.c:2363 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2363 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45a649 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f0790795c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a649 RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000006 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f07907966d4 R13: 00000000004c8db5 R14: 00000000004df630 R15: 00000000ffffffff Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline] kmsan_internal_poison_shadow+0x5c/0x110 mm/kmsan/kmsan.c:132 kmsan_slab_alloc+0x97/0x100 mm/kmsan/kmsan_hooks.c:86 slab_alloc_node mm/slub.c:2773 [inline] __kmalloc_node_track_caller+0xe27/0x11a0 mm/slub.c:4381 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0x306/0xa10 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1174 [inline] netlink_sendmsg+0x783/0x1330 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311 __sys_sendmsg net/socket.c:2356 [inline] __do_sys_sendmsg net/socket.c:2365 [inline] __se_sys_sendmsg+0x305/0x460 net/socket.c:2363 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2363 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 6f96c3c6904c ("net_sched: fix backward compatibility for TCA_KIND") Signed-off-by: Eric Dumazet Reported-by: syzbot Acked-by: Cong Wang Cc: Marcelo Ricardo Leitner Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: David S. Miller commit 00222d1394104f0fd6c01ca9f578afec9e0f148b Author: Heiner Kallweit Date: Fri Dec 6 23:27:15 2019 +0100 r8169: add missing RX enabling for WoL on RTL8125 RTL8125 also requires to enable RX for WoL. v2: add missing Fixes tag Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 8a3cc29c316c17de590e3ff8b59f3d6cbfd37b0a Author: Stefano Garzarella Date: Fri Dec 6 15:39:12 2019 +0100 vhost/vsock: accept only packets with the right dst_cid When we receive a new packet from the guest, we check if the src_cid is correct, but we forgot to check the dst_cid. The host should accept only packets where dst_cid is equal to the host CID. Signed-off-by: Stefano Garzarella Signed-off-by: David S. Miller commit fafc5db28a2ff39092bafe8ac9b8b19c4904f633 Author: Grygorii Strashko Date: Fri Dec 6 14:34:32 2019 +0200 net: phy: dp83867: fix hfs boot in rgmii mode The commit ef87f7da6b28 ("net: phy: dp83867: move dt parsing to probe") causes regression on TI dra71x-evm and dra72x-evm, where DP83867 PHY is used in "rgmii-id" mode - the networking stops working. Unfortunately, it's not enough to just move DT parsing code to .probe() as it depends on phydev->interface value, which is set to correct value abter the .probe() is completed and before calling .config_init(). So, RGMII configuration can't be loaded from DT. To fix and issue - move RGMII validation code to .config_init() - parse RGMII parameters in dp83867_of_init(), but consider them as optional. Fixes: ef87f7da6b28 ("net: phy: dp83867: move dt parsing to probe") Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 51302f77bedab8768b761ed1899c08f89af9e4e2 Author: Grygorii Strashko Date: Fri Dec 6 14:28:20 2019 +0200 net: ethernet: ti: cpsw: fix extra rx interrupt Now RX interrupt is triggered twice every time, because in cpsw_rx_interrupt() it is asked first and then disabled. So there will be pending interrupt always, when RX interrupt is enabled again in NAPI handler. Fix it by first disabling IRQ and then do ask. Fixes: 870915feabdc ("drivers: net: cpsw: remove disable_irq/enable_irq as irq can be masked from cpsw itself") Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 501a90c945103e8627406763dac418f20f3837b2 Author: Eric Dumazet Date: Thu Dec 5 20:43:46 2019 -0800 inet: protect against too small mtu values. syzbot was once again able to crash a host by setting a very small mtu on loopback device. Let's make inetdev_valid_mtu() available in include/net/ip.h, and use it in ip_setup_cork(), so that we protect both ip_append_page() and __ip_append_data() Also add a READ_ONCE() when the device mtu is read. Pairs this lockless read with one WRITE_ONCE() in __dev_set_mtu(), even if other code paths might write over this field. Add a big comment in include/linux/netdevice.h about dev->mtu needing READ_ONCE()/WRITE_ONCE() annotations. Hopefully we will add the missing ones in followup patches. [1] refcount_t: saturated; leaking memory. WARNING: CPU: 0 PID: 9464 at lib/refcount.c:22 refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 9464 Comm: syz-executor850 Not tainted 5.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x3e kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22 Code: 06 31 ff 89 de e8 c8 f5 e6 fd 84 db 0f 85 6f ff ff ff e8 7b f4 e6 fd 48 c7 c7 e0 71 4f 88 c6 05 56 a6 a4 06 01 e8 c7 a8 b7 fd <0f> 0b e9 50 ff ff ff e8 5c f4 e6 fd 0f b6 1d 3d a6 a4 06 31 ff 89 RSP: 0018:ffff88809689f550 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815e4336 RDI: ffffed1012d13e9c RBP: ffff88809689f560 R08: ffff88809c50a3c0 R09: fffffbfff15d31b1 R10: fffffbfff15d31b0 R11: ffffffff8ae98d87 R12: 0000000000000001 R13: 0000000000040100 R14: ffff888099041104 R15: ffff888218d96e40 refcount_add include/linux/refcount.h:193 [inline] skb_set_owner_w+0x2b6/0x410 net/core/sock.c:1999 sock_wmalloc+0xf1/0x120 net/core/sock.c:2096 ip_append_page+0x7ef/0x1190 net/ipv4/ip_output.c:1383 udp_sendpage+0x1c7/0x480 net/ipv4/udp.c:1276 inet_sendpage+0xdb/0x150 net/ipv4/af_inet.c:821 kernel_sendpage+0x92/0xf0 net/socket.c:3794 sock_sendpage+0x8b/0xc0 net/socket.c:936 pipe_to_sendpage+0x2da/0x3c0 fs/splice.c:458 splice_from_pipe_feed fs/splice.c:512 [inline] __splice_from_pipe+0x3ee/0x7c0 fs/splice.c:636 splice_from_pipe+0x108/0x170 fs/splice.c:671 generic_splice_sendpage+0x3c/0x50 fs/splice.c:842 do_splice_from fs/splice.c:861 [inline] direct_splice_actor+0x123/0x190 fs/splice.c:1035 splice_direct_to_actor+0x3b4/0xa30 fs/splice.c:990 do_splice_direct+0x1da/0x2a0 fs/splice.c:1078 do_sendfile+0x597/0xd00 fs/read_write.c:1464 __do_sys_sendfile64 fs/read_write.c:1525 [inline] __se_sys_sendfile64 fs/read_write.c:1511 [inline] __x64_sys_sendfile64+0x1dd/0x220 fs/read_write.c:1511 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x441409 Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fffb64c4f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441409 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 RBP: 0000000000073b8a R08: 0000000000000010 R09: 0000000000000010 R10: 0000000000010001 R11: 0000000000000246 R12: 0000000000402180 R13: 0000000000402210 R14: 0000000000000000 R15: 0000000000000000 Kernel Offset: disabled Rebooting in 86400 seconds.. Fixes: 1470ddf7f8ce ("inet: Remove explicit write references to sk/inet in ip_append_data") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit 0e4940928c26527ce8f97237fef4c8a91cd34207 Author: Cong Wang Date: Thu Dec 5 19:39:02 2019 -0800 gre: refetch erspan header from skb->data after pskb_may_pull() After pskb_may_pull() we should always refetch the header pointers from the skb->data in case it got reallocated. In gre_parse_header(), the erspan header is still fetched from the 'options' pointer which is fetched before pskb_may_pull(). Found this during code review of a KMSAN bug report. Fixes: cb73ee40b1b3 ("net: ip_gre: use erspan key field for tunnel lookup") Cc: Lorenzo Bianconi Signed-off-by: Cong Wang Acked-by: Lorenzo Bianconi Acked-by: William Tu Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 02a896ca84874bbfcedc006303f2951dda89b298 Author: Aditya Pakki Date: Thu Dec 5 17:04:49 2019 -0600 pppoe: remove redundant BUG_ON() check in pppoe_pernet Passing NULL to pppoe_pernet causes a crash via BUG_ON. Dereferencing net in net_generici() also has the same effect. This patch removes the redundant BUG_ON check on the same parameter. Signed-off-by: Aditya Pakki Signed-off-by: David S. Miller commit 68d4b3dfcaf2462203ba1597e70db6e3b4c4e64f Author: Krzysztof Kozlowski Date: Fri Dec 6 17:04:08 2019 -0800 lib/: fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ / /' -i */Kconfig Link: http://lkml.kernel.org/r/20191120140140.19148-1-krzk@kernel.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ec29a5c197e6ef88fd94a2f3ea087037ae8acc21 Author: Changbin Du Date: Fri Dec 6 17:04:06 2019 -0800 kernel-hacking: move DEBUG_FS to 'Generic Kernel Debugging Instruments' DEBUG_FS does not belong to 'Compile-time checks and compiler options'. Link: http://lkml.kernel.org/r/20190909144453.3520-10-changbin.du@gmail.com Cc: Randy Dunlap Signed-off-by: Changbin Du Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2b05bb75d1745f5aadcf3b915267ec5ec8dc12b1 Author: Changbin Du Date: Fri Dec 6 17:04:03 2019 -0800 kernel-hacking: move DEBUG_BUGVERBOSE to 'printk and dmesg options' I think DEBUG_BUGVERBOSE is a dmesg option which gives more debug info to dmesg. Link: http://lkml.kernel.org/r/20190909144453.3520-9-changbin.du@gmail.com Signed-off-by: Changbin Du Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ebebdd095d7b73b395bd180e61e1e9939264fdcd Author: Changbin Du Date: Fri Dec 6 17:04:00 2019 -0800 kernel-hacking: create a submenu for scheduler debugging options Create a submenu 'Scheduler Debugging' for scheduler debugging options. Link: http://lkml.kernel.org/r/20190909144453.3520-8-changbin.du@gmail.com Signed-off-by: Changbin Du Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dc9b96387ec9b6d770dec6fcb3017afebc9e49d6 Author: Changbin Du Date: Fri Dec 6 17:03:57 2019 -0800 kernel-hacking: move SCHED_STACK_END_CHECK after DEBUG_STACK_USAGE They are both memory debug options to debug kernel stack issues. Link: http://lkml.kernel.org/r/20190909144453.3520-7-changbin.du@gmail.com Signed-off-by: Changbin Du Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f43a289df67153a169776f8ea0445bc3a57e7a83 Author: Changbin Du Date: Fri Dec 6 17:03:54 2019 -0800 kernel-hacking: move Oops into 'Lockups and Hangs' They are similar options so place them together. Link: http://lkml.kernel.org/r/20190909144453.3520-6-changbin.du@gmail.com Signed-off-by: Changbin Du Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 09a7495258b56dcfb0a9c0049e142d4bd98b3dde Author: Changbin Du Date: Fri Dec 6 17:03:51 2019 -0800 kernel-hacking: move kernel testing and coverage options to same submenu Move error injection, coverage, testing options to a new top level submenu 'Kernel Testing and Coverage'. They are all for test purpose. Link: http://lkml.kernel.org/r/20190909144453.3520-5-changbin.du@gmail.com Signed-off-by: Changbin Du Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3be5cbcde916de526bb3f5ef93f3197e976d3245 Author: Changbin Du Date: Fri Dec 6 17:03:48 2019 -0800 kernel-hacking: group kernel data structures debugging together Group these similar runtime data structures verification options together. Link: http://lkml.kernel.org/r/20190909144453.3520-4-changbin.du@gmail.com Signed-off-by: Changbin Du Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ff600a9a69be3733718dd9a126437631b7d31252 Author: Changbin Du Date: Fri Dec 6 17:03:45 2019 -0800 kernel-hacking: create submenu for arch special debugging options The arch special options are a little long, so create a submenu for them. Link: http://lkml.kernel.org/r/20190909144453.3520-3-changbin.du@gmail.com Signed-off-by: Changbin Du Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6210b6402f582b06c47991d02fe161f38b86a723 Author: Changbin Du Date: Fri Dec 6 17:03:42 2019 -0800 kernel-hacking: group sysrq/kgdb/ubsan into 'Generic Kernel Debugging Instruments' Patch series "hacking: make 'kernel hacking' menu better structurized", v3. This series is a trivial improvment for the layout of 'kernel hacking' configuration menu. Now we have many items in it which makes takes a little time to look up them since they are not well structurized yet. Early discussion is here: https://lkml.org/lkml/2019/9/1/39 This patch (of 9): Group generic kernel debugging instruments sysrq/kgdb/ubsan together into a new submenu. Link: http://lkml.kernel.org/r/20190909144453.3520-2-changbin.du@gmail.com Signed-off-by: Changbin Du Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0b9173f4688dfa7c5d723426be1d979c24ce3d51 Author: Marco Oliverio Date: Mon Dec 2 19:54:30 2019 +0100 netfilter: nf_queue: enqueue skbs with NULL dst Bridge packets that are forwarded have skb->dst == NULL and get dropped by the check introduced by b60a77386b1d4868f72f6353d35dabe5fbe981f2 (net: make skb_dst_force return true when dst is refcounted). To fix this we check skb_dst() before skb_dst_force(), so we don't drop skb packet with dst == NULL. This holds also for skb at the PRE_ROUTING hook so we remove the second check. Fixes: b60a77386b1d ("net: make skb_dst_force return true when dst is refcounted") Signed-off-by: Marco Oliverio Signed-off-by: Rocco Folino Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 5a2e6af81807d4616f9839ad0ae7d1313b45c64d Author: Florian Westphal Date: Mon Dec 2 18:35:40 2019 +0100 selftests: netfilter: use randomized netns names Using ns0, ns1, etc. isn't a good idea, they might exist already. Use a random suffix. Also, older nft versions don't support "-" as alias for stdin, so use /dev/stdin instead. Signed-off-by: Florian Westphal Acked-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit ad910e36da4ca3a1bd436989f632d062dda0c921 Author: Linus Torvalds Date: Sat Dec 7 10:41:17 2019 -0800 pipe: fix poll/select race introduced by the pipe rework The kernel wait queues have a basic rule to them: you add yourself to the wait-queue first, and then you check the things that you're going to wait on. That avoids the races with the event you're waiting for. The same goes for poll/select logic: the "poll_wait()" goes first, and then you check the things you're polling for. Of course, if you use locking, the ordering doesn't matter since the lock will serialize with anything that changes the state you're looking at. That's not the case here, though. So move the poll_wait() first in pipe_poll(), before you start looking at the pipe state. Fixes: 8cefc107ca54 ("pipe: Use head and tail pointers for the ring, not cursor and length") Cc: David Howells Signed-off-by: Linus Torvalds commit 38a2204f5298620e8a1c3b1dc7b831425106dbc0 Author: Patrick Steinhardt Date: Wed Dec 4 07:13:22 2019 +0100 nfsd: depend on CRYPTO_MD5 for legacy client tracking The legacy client tracking infrastructure of nfsd makes use of MD5 to derive a client's recovery directory name. As the nfsd module doesn't declare any dependency on CRYPTO_MD5, though, it may fail to allocate the hash if the kernel was compiled without it. As a result, generation of client recovery directories will fail with the following error: NFSD: unable to generate recoverydir name The explicit dependency on CRYPTO_MD5 was removed as redundant back in 6aaa67b5f3b9 (NFSD: Remove redundant "select" clauses in fs/Kconfig 2008-02-11) as it was already implicitly selected via RPCSEC_GSS_KRB5. This broke when RPCSEC_GSS_KRB5 was made optional for NFSv4 in commit df486a25900f (NFS: Fix the selection of security flavours in Kconfig) at a later point. Fix the issue by adding back an explicit dependency on CRYPTO_MD5. Fixes: df486a25900f (NFS: Fix the selection of security flavours in Kconfig) Signed-off-by: Patrick Steinhardt Signed-off-by: J. Bruce Fields commit 18f428d4e2f7eff162d80b2b21689496c4e82afd Author: Olga Kornievskaia Date: Wed Dec 4 15:13:54 2019 -0500 NFSD fixing possible null pointer derefering in copy offload Static checker revealed possible error path leading to possible NULL pointer dereferencing. Reported-by: Dan Carpenter Fixes: e0639dc5805a: ("NFSD introduce async copy feature") Signed-off-by: Olga Kornievskaia Signed-off-by: J. Bruce Fields commit 6e456dca47c5e3b8d8c6bbc4edd1377985d793b5 Author: Daniel Lezcano Date: Thu Dec 5 13:12:27 2019 +0100 MAINTAINERS: thermal: Change the git tree location The thermal trees were merged into a single one shared with the maintainer of the subsystem. Update the location of this group git tree. Signed-off-by: Daniel Lezcano Signed-off-by: Zhang Rui Link: https://lore.kernel.org/r/20191205121227.19203-1-daniel.lezcano@linaro.org commit 9f1fb8046bba73f4a3574286da69814e493c2b94 Author: Zhang Rui Date: Thu Dec 5 19:51:50 2019 +0800 MAINTAINERS: thermal: Add Daniel Lezcano as the thermal maintainer Add Daniel Lezcano as the co-maintainer of thermal subsystem. Signed-off-by: Zhang Rui Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191205115150.18836-1-rui.zhang@intel.com commit 87587a57b33342fe3c3f9f4a01a1118f9a5bb75e Author: Florian Fainelli Date: Sat Nov 23 07:43:03 2019 -0800 MAINTAINERS: thermal: Eduardo's email is bouncing The last two emails to Eduardo were returned with: 452 4.2.2 The email account that you tried to reach is over quota. Please direct the recipient to https://support.google.com/mail/?p=OverQuotaTemp j17sor626162wrq.49 - gsmtp Signed-off-by: Florian Fainelli Signed-off-by: Zhang Rui Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20191123154303.2202-1-f.fainelli@gmail.com commit 50260614245b09887c197c58732298f02052d61b Author: YueHaibing Date: Wed Nov 13 18:53:13 2019 +0800 thermal: power_allocator: Fix Kconfig warning When do randbuiding, we got this: WARNING: unmet direct dependencies detected for THERMAL_GOV_POWER_ALLOCATOR Depends on [n]: THERMAL [=y] && ENERGY_MODEL [=n] Selected by [y]: - THERMAL_DEFAULT_GOV_POWER_ALLOCATOR [=y] && The Kconfig option THERMAL_DEFAULT_GOV_POWER_ALLOCATOR selects the THERMAL_GOV_POWER_ALLOCATOR but this one depends on the ENERGY_MODEL which is not enabled. Make THERMAL_DEFAULT_GOV_POWER_ALLOCATOR depend on THERMAL_GOV_POWER_ALLOCATOR to fix this warning. Suggested-by: Quentin Perret Fixes: a4e893e802e6 ("thermal: cpu_cooling: Migrate to using the EM framework") Signed-off-by: YueHaibing Signed-off-by: Daniel Lezcano Signed-off-by: Zhang Rui Link: https://lore.kernel.org/r/20191113105313.41616-1-yuehaibing@huawei.com commit 5532946e339576097d7a0f5facc828e4d53d901b Merge: 537d0779a199 721c8dafad26 Author: David S. Miller Date: Fri Dec 6 21:05:14 2019 -0800 Merge branch 'tcp-fix-handling-of-stale-syncookies-timestamps' Guillaume Nault says: ==================== tcp: fix handling of stale syncookies timestamps The synflood timestamps (->ts_recent_stamp and ->synq_overflow_ts) are only refreshed when the syncookie protection triggers. Therefore, their value can become very far apart from jiffies if no synflood happens for a long time. If jiffies grows too much and wraps while the synflood timestamp isn't refreshed, then time_after32() might consider the later to be in the future. This can trick tcp_synq_no_recent_overflow() into returning erroneous values and rejecting valid ACKs. Patch 1 handles the case of ACKs using legitimate syncookies. Patch 2 handles the case of stray ACKs. Patch 3 annotates lockless timestamp operations with READ_ONCE() and WRITE_ONCE(). Changes from v3: - Fix description of time_between32() (found by Eric Dumazet). - Use more accurate Fixes tag in patch 3 (suggested by Eric Dumazet). Changes from v2: - Define and use time_between32() instead of a pair of time_before32/time_after32 (suggested by Eric Dumazet). - Use 'last_overflow - HZ' as lower bound in tcp_synq_no_recent_overflow(), to accommodate for concurrent timestamp updates (found by Eric Dumazet). - Add a third patch to annotate lockless accesses to .ts_recent_stamp. Changes from v1: - Initialising timestamps at socket creation time is not enough because jiffies wraps in 24 days with HZ=1000 (Eric Dumazet). Handle stale timestamps in tcp_synq_overflow() and tcp_synq_no_recent_overflow() instead. - Rework commit description. - Add a second patch to handle the case of stray ACKs. ==================== Signed-off-by: David S. Miller commit 721c8dafad26ccfa90ff659ee19755e3377b829d Author: Guillaume Nault Date: Fri Dec 6 12:38:49 2019 +0100 tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() Syncookies borrow the ->rx_opt.ts_recent_stamp field to store the timestamp of the last synflood. Protect them with READ_ONCE() and WRITE_ONCE() since reads and writes aren't serialised. Use of .rx_opt.ts_recent_stamp for storing the synflood timestamp was introduced by a0f82f64e269 ("syncookies: remove last_synq_overflow from struct tcp_sock"). But unprotected accesses were already there when timestamp was stored in .last_synq_overflow. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Guillaume Nault Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit cb44a08f8647fd2e8db5cc9ac27cd8355fa392d8 Author: Guillaume Nault Date: Fri Dec 6 12:38:43 2019 +0100 tcp: tighten acceptance of ACKs not matching a child socket When no synflood occurs, the synflood timestamp isn't updated. Therefore it can be so old that time_after32() can consider it to be in the future. That's a problem for tcp_synq_no_recent_overflow() as it may report that a recent overflow occurred while, in fact, it's just that jiffies has grown past 'last_overflow' + TCP_SYNCOOKIE_VALID + 2^31. Spurious detection of recent overflows lead to extra syncookie verification in cookie_v[46]_check(). At that point, the verification should fail and the packet dropped. But we should have dropped the packet earlier as we didn't even send a syncookie. Let's refine tcp_synq_no_recent_overflow() to report a recent overflow only if jiffies is within the [last_overflow, last_overflow + TCP_SYNCOOKIE_VALID] interval. This way, no spurious recent overflow is reported when jiffies wraps and 'last_overflow' becomes in the future from the point of view of time_after32(). However, if jiffies wraps and enters the [last_overflow, last_overflow + TCP_SYNCOOKIE_VALID] interval (with 'last_overflow' being a stale synflood timestamp), then tcp_synq_no_recent_overflow() still erroneously reports an overflow. In such cases, we have to rely on syncookie verification to drop the packet. We unfortunately have no way to differentiate between a fresh and a stale syncookie timestamp. In practice, using last_overflow as lower bound is problematic. If the synflood timestamp is concurrently updated between the time we read jiffies and the moment we store the timestamp in 'last_overflow', then 'now' becomes smaller than 'last_overflow' and tcp_synq_no_recent_overflow() returns true, potentially dropping a valid syncookie. Reading jiffies after loading the timestamp could fix the problem, but that'd require a memory barrier. Let's just accommodate for potential timestamp growth instead and extend the interval using 'last_overflow - HZ' as lower bound. Signed-off-by: Guillaume Nault Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 04d26e7b159a396372646a480f4caa166d1b6720 Author: Guillaume Nault Date: Fri Dec 6 12:38:36 2019 +0100 tcp: fix rejected syncookies due to stale timestamps If no synflood happens for a long enough period of time, then the synflood timestamp isn't refreshed and jiffies can advance so much that time_after32() can't accurately compare them any more. Therefore, we can end up in a situation where time_after32(now, last_overflow + HZ) returns false, just because these two values are too far apart. In that case, the synflood timestamp isn't updated as it should be, which can trick tcp_synq_no_recent_overflow() into rejecting valid syncookies. For example, let's consider the following scenario on a system with HZ=1000: * The synflood timestamp is 0, either because that's the timestamp of the last synflood or, more commonly, because we're working with a freshly created socket. * We receive a new SYN, which triggers synflood protection. Let's say that this happens when jiffies == 2147484649 (that is, 'synflood timestamp' + HZ + 2^31 + 1). * Then tcp_synq_overflow() doesn't update the synflood timestamp, because time_after32(2147484649, 1000) returns false. With: - 2147484649: the value of jiffies, aka. 'now'. - 1000: the value of 'last_overflow' + HZ. * A bit later, we receive the ACK completing the 3WHS. But cookie_v[46]_check() rejects it because tcp_synq_no_recent_overflow() says that we're not under synflood. That's because time_after32(2147484649, 120000) returns false. With: - 2147484649: the value of jiffies, aka. 'now'. - 120000: the value of 'last_overflow' + TCP_SYNCOOKIE_VALID. Of course, in reality jiffies would have increased a bit, but this condition will last for the next 119 seconds, which is far enough to accommodate for jiffie's growth. Fix this by updating the overflow timestamp whenever jiffies isn't within the [last_overflow, last_overflow + HZ] range. That shouldn't have any performance impact since the update still happens at most once per second. Now we're guaranteed to have fresh timestamps while under synflood, so tcp_synq_no_recent_overflow() can safely use it with time_after32() in such situations. Stale timestamps can still make tcp_synq_no_recent_overflow() return the wrong verdict when not under synflood. This will be handled in the next patch. For 64 bits architectures, the problem was introduced with the conversion of ->tw_ts_recent_stamp to 32 bits integer by commit cca9bab1b72c ("tcp: use monotonic timestamps for PAWS"). The problem has always been there on 32 bits architectures. Fixes: cca9bab1b72c ("tcp: use monotonic timestamps for PAWS") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Guillaume Nault Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 537d0779a19941efe9044e7e259743d5b054bf7b Merge: 04aa1bc42e4d b7826076d7ae Author: David S. Miller Date: Fri Dec 6 20:52:16 2019 -0800 Merge tag 'mlx5-fixes-2019-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2019-12-05 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. For -stable v4.19: ('net/mlx5e: Query global pause state before setting prio2buffer') For -stable v5.3 ('net/mlx5e: Fix SFF 8472 eeprom length') ('net/mlx5e: Fix translation of link mode into speed') ('net/mlx5e: Fix freeing flow with kfree() and not kvfree()') ('net/mlx5e: ethtool, Fix analysis of speed setting') ('net/mlx5e: Fix TXQ indices to be sequential') ==================== Signed-off-by: David S. Miller commit 04aa1bc42e4d31a7c58f38eefc323ac395517635 Author: Bruno Carneiro da Cunha Date: Thu Dec 5 17:16:26 2019 -0300 lpc_eth: kernel BUG on remove We may have found a bug in the nxp/lpc_eth.c driver. The function platform_set_drvdata() is called twice, the second time it is called, in lpc_mii_init(), it overwrites the struct net_device which should be at pdev->dev->driver_data with pldat->mii_bus. When trying to remove the driver, in lpc_eth_drv_remove(), platform_get_drvdata() will return the pldat->mii_bus pointer and try to use it as a struct net_device pointer. This causes unregister_netdev to segfault and generate a kernel BUG. Is this reproducible? Signed-off-by: Daniel Martinez Signed-off-by: Bruno Carneiro da Cunha Signed-off-by: David S. Miller commit 9424e2e7ad93ffffa88f882c9bc5023570904b55 Author: Eric Dumazet Date: Thu Dec 5 10:10:15 2019 -0800 tcp: md5: fix potential overestimation of TCP option space Back in 2008, Adam Langley fixed the corner case of packets for flows having all of the following options : MD5 TS SACK Since MD5 needs 20 bytes, and TS needs 12 bytes, no sack block can be cooked from the remaining 8 bytes. tcp_established_options() correctly sets opts->num_sack_blocks to zero, but returns 36 instead of 32. This means TCP cooks packets with 4 extra bytes at the end of options, containing unitialized bytes. Fixes: 33ad798c924b ("tcp: options clean up") Signed-off-by: Eric Dumazet Reported-by: syzbot Acked-by: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller commit 9a74542eee86313ab7b31ae28b45c59d244e3a85 Merge: e0b60903b434 25a443f74bcf Author: David S. Miller Date: Fri Dec 6 20:45:09 2019 -0800 Merge branch 'net-tc-indirect-block-relay' John Hurley says: ==================== Ensure egress un/bind are relayed with indirect blocks On register and unregister for indirect blocks, a command is called that sends a bind/unbind event to the registering driver. This command assumes that the bind to indirect block will be on ingress. However, drivers such as NFP have allowed binding to clsact qdiscs as well as ingress qdiscs from mainline Linux 5.2. A clsact qdisc binds to an ingress and an egress block. Rather than assuming that an indirect bind is always ingress, modify the function names to remove the ingress tag (patch 1). In cls_api, which is used by NFP to offload TC flower, generate bind/unbind message for both ingress and egress blocks on the event of indirectly registering/unregistering from that block. Doing so mimics the behaviour of both ingress and clsact qdiscs on initialise and destroy. This now ensures that drivers such as NFP receive the correct binder type for the indirect block registration. ==================== Signed-off-by: David S. Miller commit 25a443f74bcff2c4d506a39eae62fc15ad7c618a Author: John Hurley Date: Thu Dec 5 17:03:35 2019 +0000 net: sched: allow indirect blocks to bind to clsact in TC When a device is bound to a clsact qdisc, bind events are triggered to registered drivers for both ingress and egress. However, if a driver registers to such a device using the indirect block routines then it is assumed that it is only interested in ingress offload and so only replays ingress bind/unbind messages. The NFP driver supports the offload of some egress filters when registering to a block with qdisc of type clsact. However, on unregister, if the block is still active, it will not receive an unbind egress notification which can prevent proper cleanup of other registered callbacks. Modify the indirect block callback command in TC to send messages of ingress and/or egress bind depending on the qdisc in use. NFP currently supports egress offload for TC flower offload so the changes are only added to TC. Fixes: 4d12ba42787b ("nfp: flower: allow offloading of matches on 'internal' ports") Signed-off-by: John Hurley Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit dbad3408896c3c5722ec9cda065468b3df16c5bf Author: John Hurley Date: Thu Dec 5 17:03:34 2019 +0000 net: core: rename indirect block ingress cb function With indirect blocks, a driver can register for callbacks from a device that is does not 'own', for example, a tunnel device. When registering to or unregistering from a new device, a callback is triggered to generate a bind/unbind event. This, in turn, allows the driver to receive any existing rules or to properly clean up installed rules. When first added, it was assumed that all indirect block registrations would be for ingress offloads. However, the NFP driver can, in some instances, support clsact qdisc binds for egress offload. Change the name of the indirect block callback command in flow_offload to remove the 'ingress' identifier from it. While this does not change functionality, a follow up patch will implement a more more generic callback than just those currently just supporting ingress offload. Fixes: 4d12ba42787b ("nfp: flower: allow offloading of matches on 'internal' ports") Signed-off-by: John Hurley Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit e0b60903b434a7ee21ba8d8659f207ed84101e89 Author: Jouni Hogander Date: Thu Dec 5 15:57:07 2019 +0200 net-sysfs: Call dev_hold always in netdev_queue_add_kobject Dev_hold has to be called always in netdev_queue_add_kobject. Otherwise usage count drops below 0 in case of failure in kobject_init_and_add. Fixes: b8eb718348b8 ("net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject") Reported-by: Hulk Robot Cc: Tetsuo Handa Cc: David Miller Cc: Lukas Bulwahn Signed-off-by: David S. Miller commit 8bef0af09a5415df761b04fa487a6c34acae74bc Author: Alexander Lobakin Date: Thu Dec 5 13:02:35 2019 +0300 net: dsa: fix flow dissection on Tx path Commit 43e665287f93 ("net-next: dsa: fix flow dissection") added an ability to override protocol and network offset during flow dissection for DSA-enabled devices (i.e. controllers shipped as switch CPU ports) in order to fix skb hashing for RPS on Rx path. However, skb_hash() and added part of code can be invoked not only on Rx, but also on Tx path if we have a multi-queued device and: - kernel is running on UP system or - XPS is not configured. The call stack in this two cases will be like: dev_queue_xmit() -> __dev_queue_xmit() -> netdev_core_pick_tx() -> netdev_pick_tx() -> skb_tx_hash() -> skb_get_hash(). The problem is that skbs queued for Tx have both network offset and correct protocol already set up even after inserting a CPU tag by DSA tagger, so calling tag_ops->flow_dissect() on this path actually only breaks flow dissection and hashing. This can be observed by adding debug prints just before and right after tag_ops->flow_dissect() call to the related block of code: Before the patch: Rx path (RPS): [ 19.240001] Rx: proto: 0x00f8, nhoff: 0 /* ETH_P_XDSA */ [ 19.244271] tag_ops->flow_dissect() [ 19.247811] Rx: proto: 0x0800, nhoff: 8 /* ETH_P_IP */ [ 19.215435] Rx: proto: 0x00f8, nhoff: 0 /* ETH_P_XDSA */ [ 19.219746] tag_ops->flow_dissect() [ 19.223241] Rx: proto: 0x0806, nhoff: 8 /* ETH_P_ARP */ [ 18.654057] Rx: proto: 0x00f8, nhoff: 0 /* ETH_P_XDSA */ [ 18.658332] tag_ops->flow_dissect() [ 18.661826] Rx: proto: 0x8100, nhoff: 8 /* ETH_P_8021Q */ Tx path (UP system): [ 18.759560] Tx: proto: 0x0800, nhoff: 26 /* ETH_P_IP */ [ 18.763933] tag_ops->flow_dissect() [ 18.767485] Tx: proto: 0x920b, nhoff: 34 /* junk */ [ 22.800020] Tx: proto: 0x0806, nhoff: 26 /* ETH_P_ARP */ [ 22.804392] tag_ops->flow_dissect() [ 22.807921] Tx: proto: 0x920b, nhoff: 34 /* junk */ [ 16.898342] Tx: proto: 0x86dd, nhoff: 26 /* ETH_P_IPV6 */ [ 16.902705] tag_ops->flow_dissect() [ 16.906227] Tx: proto: 0x920b, nhoff: 34 /* junk */ After: Rx path (RPS): [ 16.520993] Rx: proto: 0x00f8, nhoff: 0 /* ETH_P_XDSA */ [ 16.525260] tag_ops->flow_dissect() [ 16.528808] Rx: proto: 0x0800, nhoff: 8 /* ETH_P_IP */ [ 15.484807] Rx: proto: 0x00f8, nhoff: 0 /* ETH_P_XDSA */ [ 15.490417] tag_ops->flow_dissect() [ 15.495223] Rx: proto: 0x0806, nhoff: 8 /* ETH_P_ARP */ [ 17.134621] Rx: proto: 0x00f8, nhoff: 0 /* ETH_P_XDSA */ [ 17.138895] tag_ops->flow_dissect() [ 17.142388] Rx: proto: 0x8100, nhoff: 8 /* ETH_P_8021Q */ Tx path (UP system): [ 15.499558] Tx: proto: 0x0800, nhoff: 26 /* ETH_P_IP */ [ 20.664689] Tx: proto: 0x0806, nhoff: 26 /* ETH_P_ARP */ [ 18.565782] Tx: proto: 0x86dd, nhoff: 26 /* ETH_P_IPV6 */ In order to fix that we can add the check 'proto == htons(ETH_P_XDSA)' to prevent code from calling tag_ops->flow_dissect() on Tx. I also decided to initialize 'offset' variable so tagger callbacks can now safely leave it untouched without provoking a chaos. Fixes: 43e665287f93 ("net-next: dsa: fix flow dissection") Signed-off-by: Alexander Lobakin Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 4a5cdc604b9cf645e6fa24d8d9f055955c3c8516 Author: Valentin Vidic Date: Thu Dec 5 07:41:18 2019 +0100 net/tls: Fix return values to avoid ENOTSUPP ENOTSUPP is not available in userspace, for example: setsockopt failed, 524, Unknown error 524 Signed-off-by: Valentin Vidic Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit dc3ecfc9819a96b2a6700b01443347b01e07a13b Merge: 8539429917c4 7e4c6b9a5d22 Author: Jens Axboe Date: Fri Dec 6 17:27:56 2019 -0700 Merge branch 'nvme/for-5.5' of git://git.infradead.org/nvme into for-linus Pull NVMe fixes from Keith * 'nvme/for-5.5' of git://git.infradead.org/nvme: nvme/pci: Fix read queue count nvme/pci Limit write queue sizes to possible cpus nvme/pci: Fix write and poll queue types nvme/pci: Remove last_cq_head nvme: Namepace identification descriptor list is optional nvme-fc: fix double-free scenarios on hw queues nvme: else following return is not needed nvme: add error message on mismatching controller ids nvme_fc: add module to ops template to allow module references nvmet-loop: Avoid preallocating big SGL for data nvme-fc: Avoid preallocating big SGL for data nvme-rdma: Avoid preallocating big SGL for data commit eea2d5da29e396b6cc1fb35e36bcbf5f57731015 Merge: 347f56fb3890 04bb96427d4e Author: Linus Torvalds Date: Fri Dec 6 16:12:39 2019 -0800 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: - fix CPU topology setup for SCHED_MC case - fix VDSO regression * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8947/1: Fix __arch_get_hw_counter() access to CNTVCT ARM: 8943/1: Fix topology setup in case of CPU hotplug for CONFIG_SCHED_MC commit 347f56fb389012e8ba7b391d35d109eb16773e3b Merge: 98884281027d 30f55eae47e4 Author: Linus Torvalds Date: Fri Dec 6 14:19:37 2019 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Olof Johansson: "A set of fixes that we've merged late, but for the most part that have been sitting in -next for a while through platform maintainer trees: - Fixes to suspend/resume on Tegra, caused by the added features this merge window - Cleanups and minor fixes to TI additions this merge window - Tee fixes queued up late before the merge window, included here. - A handful of other fixlets There's also a refresh of the shareed config files (multi_v* on 32-bit, and defconfig on 64-bit), to avoid conflicts when we get new contributions" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (32 commits) ARM: multi_v7_defconfig: Restore debugfs support ARM: defconfig: re-run savedefconfig on multi_v* configs arm64: defconfig: re-run savedefconfig ARM: pxa: Fix resource properties soc: mediatek: cmdq: fixup wrong input order of write api soc: aspeed: Fix snoop_file_poll()'s return type MAINTAINERS: Switch to Marvell addresses MAINTAINERS: update Cavium ThunderX drivers Revert "arm64: dts: juno: add dma-ranges property" MAINTAINERS: Make Nicolas Saenz Julienne the new bcm2835 maintainer firmware: arm_scmi: Avoid double free in error flow arm64: dts: juno: Fix UART frequency ARM: dts: Fix sgx sysconfig register for omap4 arm: socfpga: execute cold reboot by default ARM: dts: Fix vcsi regulator to be always-on for droid4 to prevent hangs ARM: dts: dra7: fix cpsw mdio fck clock ARM: dts: am57xx-beagle-x15: Update pinmux name to ddr_3_3v ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity soc/tegra: pmc: Add reset sources and levels on Tegra194 soc/tegra: pmc: Add missing IRQ callbacks on Tegra194 ... commit 98884281027d07b93f062b7c5e7aa01e76ba12c6 Merge: 76f6777c9cc0 de858040ee80 Author: Linus Torvalds Date: Fri Dec 6 14:18:01 2019 -0800 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - ZONE_DMA32 initialisation fix when memblocks fall entirely within the first GB (used by ZONE_DMA in 5.5 for Raspberry Pi 4). - Couple of ftrace fixes following the FTRACE_WITH_REGS patchset. - access_ok() fix for the Tagged Address ABI when called from from a kernel thread (asynchronous I/O): the kthread does not have the TIF flags of the mm owner, so untag the user address unconditionally. - KVM compute_layout() called before the alternatives code patching. - Minor clean-ups. * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: entry: refine comment of stack overflow check arm64: ftrace: fix ifdeffery arm64: KVM: Invoke compute_layout() before alternatives are applied arm64: Validate tagged addresses in access_ok() called from kernel threads arm64: mm: Fix column alignment for UXN in kernel_page_tables arm64: insn: consistently handle exit text arm64: mm: Fix initialisation of DMA zones on non-NUMA systems commit 76f6777c9cc04efe8036b1d2aa76e618c1631cc6 Author: David Howells Date: Fri Dec 6 21:34:51 2019 +0000 pipe: Fix iteration end check in fuse_dev_splice_write() Fix the iteration end check in fuse_dev_splice_write(). The iterator position can only be compared with == or != since wrappage may be involved. Fixes: 8cefc107ca54 ("pipe: Use head and tail pointers for the ring, not cursor and length") Reported-by: Linus Torvalds Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 43a2898631a8beee66c1d64c1e860f43d96b2e91 Merge: f89d416a8676 4f4afc2c9599 Author: Linus Torvalds Date: Fri Dec 6 13:36:31 2019 -0800 Merge tag 'powerpc-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull more powerpc updates from Michael Ellerman: "A few commits splitting the KASAN instrumented bitops header in three, to match the split of the asm-generic bitops headers. This is needed on powerpc because we use the generic bitops for the non-atomic case only, whereas the existing KASAN instrumented bitops assume all the underlying operations are provided by the arch as arch_foo() versions. Thanks to: Daniel Axtens & Christophe Leroy" * tag 'powerpc-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: docs/core-api: Remove possibly confusing sub-headings from Bit Operations powerpc: support KASAN instrumentation of bitops kasan: support instrumented bitops combined with generic bitops commit f89d416a8676fe36de8be0f7c2e1ac6cd51410a8 Merge: 3cf2890f29ab 249fad734a25 Author: Linus Torvalds Date: Fri Dec 6 13:34:31 2019 -0800 Merge tag 'powerpc-5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "One fix for a regression introduced by our recent rework of cache flushing on memory hotunplug. Like several other arches, our VDSO clock_getres() needed a fix to match the semantics of posix_get_hrtimer_res(). A fix for a boot crash on Power9 LPARs using PCI LSI interrupts. A commit disabling use of the trace_imc PMU (not the core PMU) on Power9 systems, because it can lead to checkstops, until a workaround is developed. A handful of other minor fixes. Thanks to: Aneesh Kumar K.V, Anju T Sudhakar, Ard Biesheuvel, Christophe Leroy, Cédric Le Goater, Madhavan Srinivasan, Vincenzo Frascino" * tag 'powerpc-5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/perf: Disable trace_imc pmu powerpc/powernv: Avoid re-registration of imc debugfs directory powerpc/pmem: Convert to EXPORT_SYMBOL_GPL powerpc/archrandom: fix arch_get_random_seed_int() powerpc: Fix vDSO clock_getres() powerpc/pmem: Fix kernel crash due to wrong range value usage in flush_dcache_range powerpc/xive: Skip ioremap() of ESB pages for LSI interrupts powerpc/kasan: Fix boot failure with RELOCATABLE && FSL_BOOKE commit 3cf2890f29ab6fe491361761df558ef9191cb468 Merge: ec057595cb3f 4cc8d6505ab8 Author: Linus Torvalds Date: Fri Dec 6 13:06:14 2019 -0800 Merge tag 'sound-fix-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull more sound updates from Takashi Iwai: "A few last-minute updates, most of them are the regression fixes: - AMD HD-audio HDMI runtime PM improvements - Fixes for HD-audio HDMI regressions wrt DP-MST - A regression fix for the previous aloop enhancement - A fix for a long-time problem in PCM OSS layer that was spotted by fuzzer now - A few HD-audio quirks" * tag 'sound-fix-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: pcm: oss: Avoid potential buffer overflows ALSA: hda: hdmi - Keep old slot assignment behavior for Intel platforms ALSA: hda: Modify stream stripe mask only when needed ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen ALSA: hda: hdmi - preserve non-MST PCM routing for Intel platforms ALSA: hda: hdmi - fix kernel oops caused by invalid PCM idx ALSA: hda/realtek - Fix inverted bass GPIO pin on Acer 8951G ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 ALSA: hda: hdmi - fix regression in connect list handling ALSA: aloop: Avoid pointer dereference before null-check ALSA: hda/hdmi - enable automatic runtime pm for AMD HDMI codecs by default ALSA: hda/hdmi - enable runtime pm for newer AMD display audio ALSA: hda/hdmi - Add new pci ids for AMD GPU display audio ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD commit ec057595cb3fb339e692898bedccd566160ba086 Author: Linus Torvalds Date: Fri Dec 6 12:40:35 2019 -0800 pipe: fix incorrect caching of pipe state over pipe_wait() Similarly to commit 8f868d68d335 ("pipe: Fix missing mask update after pipe_wait()") this fixes a case where the pipe rewrite ended up caching the pipe state incorrectly over a pipe lock drop event. It wasn't quite as obvious, because you needed to splice data from a pipe to a file, which is a fairly unusual operation, but it's completely wrong. Make sure we load the pipe head/tail/size information only after we've waited for there to be data in the pipe. While in that file, also make one of the splice helper functions use the canonical arghument order for pipe_empty(). That's syntactic - pipe emptiness is just that head and tail are equal, and thus mixing up head and tail doesn't really matter. It's still wrong, though. Reported-by: David Sterba Cc: David Howells Signed-off-by: Linus Torvalds commit fdef665ba44ad5ed154af2acfb19ae2ee3bf5dcc Author: Steve French Date: Fri Dec 6 02:02:38 2019 -0600 smb3: fix mode passed in on create for modetosid mount option When using the special SID to store the mode bits in an ACE (See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx) which is enabled with mount parm "modefromsid" we were not passing in the mode via SMB3 create (although chmod was enabled). SMB3 create allows a security descriptor context to be passed in (which is more atomic and thus preferable to setting the mode bits after create via a setinfo). This patch enables setting the mode bits on create when using modefromsid mount option. In addition it fixes an endian error in the definition of the Control field flags in the SMB3 security descriptor. It also makes the ACE type of the special SID better match the documentation (and behavior of servers which use this to store mode bits in SMB3 ACLs). Signed-off-by: Steve French Acked-by: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky commit 1af66221a66de080274540a5c481ddacbe3574d2 Author: Eric Dumazet Date: Fri Dec 6 09:38:36 2019 -0800 net: avoid an indirect call in ____sys_recvmsg() CONFIG_RETPOLINE=y made indirect calls expensive. gcc seems to add an indirect call in ____sys_recvmsg(). Rewriting the code slightly makes sure to avoid this indirection. Alternative would be to not call sock_recvmsg() and instead use security_socket_recvmsg() and sock_recvmsg_nosec(), but this is less readable IMO. Signed-off-by: Eric Dumazet Cc: Paolo Abeni Cc: David Laight Acked-by: Paolo Abeni Signed-off-by: David S. Miller commit 462f8554a89643dcd0981790101a31a01aa812fe Author: Chuhong Yuan Date: Fri Dec 6 15:54:46 2019 +0800 phy: mdio-thunder: add missed pci_release_regions in remove The driver forgets to call pci_release_regions() in remove like that in probe failure. Add the missed call to fix it. Signed-off-by: Chuhong Yuan Signed-off-by: David S. Miller commit 9cf1cd8ee3ee09ef2859017df2058e2f53c5347f Author: Taehee Yoo Date: Fri Dec 6 05:25:48 2019 +0000 tipc: fix ordering of tipc module init and exit routine In order to set/get/dump, the tipc uses the generic netlink infrastructure. So, when tipc module is inserted, init function calls genl_register_family(). After genl_register_family(), set/get/dump commands are immediately allowed and these callbacks internally use the net_generic. net_generic is allocated by register_pernet_device() but this is called after genl_register_family() in the __init function. So, these callbacks would use un-initialized net_generic. Test commands: #SHELL1 while : do modprobe tipc modprobe -rv tipc done #SHELL2 while : do tipc link list done Splat looks like: [ 59.616322][ T2788] kasan: CONFIG_KASAN_INLINE enabled [ 59.617234][ T2788] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 59.618398][ T2788] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 59.619389][ T2788] CPU: 3 PID: 2788 Comm: tipc Not tainted 5.4.0+ #194 [ 59.620231][ T2788] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 59.621428][ T2788] RIP: 0010:tipc_bcast_get_broadcast_mode+0x131/0x310 [tipc] [ 59.622379][ T2788] Code: c7 c6 ef 8b 38 c0 65 ff 0d 84 83 c9 3f e8 d7 a5 f2 e3 48 8d bb 38 11 00 00 48 b8 00 00 00 00 [ 59.622550][ T2780] NET: Registered protocol family 30 [ 59.624627][ T2788] RSP: 0018:ffff88804b09f578 EFLAGS: 00010202 [ 59.624630][ T2788] RAX: dffffc0000000000 RBX: 0000000000000011 RCX: 000000008bc66907 [ 59.624631][ T2788] RDX: 0000000000000229 RSI: 000000004b3cf4cc RDI: 0000000000001149 [ 59.624633][ T2788] RBP: ffff88804b09f588 R08: 0000000000000003 R09: fffffbfff4fb3df1 [ 59.624635][ T2788] R10: fffffbfff50318f8 R11: ffff888066cadc18 R12: ffffffffa6cc2f40 [ 59.624637][ T2788] R13: 1ffff11009613eba R14: ffff8880662e9328 R15: ffff8880662e9328 [ 59.624639][ T2788] FS: 00007f57d8f7b740(0000) GS:ffff88806cc00000(0000) knlGS:0000000000000000 [ 59.624645][ T2788] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.625875][ T2780] tipc: Started in single node mode [ 59.626128][ T2788] CR2: 00007f57d887a8c0 CR3: 000000004b140002 CR4: 00000000000606e0 [ 59.633991][ T2788] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 59.635195][ T2788] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 59.636478][ T2788] Call Trace: [ 59.637025][ T2788] tipc_nl_add_bc_link+0x179/0x1470 [tipc] [ 59.638219][ T2788] ? lock_downgrade+0x6e0/0x6e0 [ 59.638923][ T2788] ? __tipc_nl_add_link+0xf90/0xf90 [tipc] [ 59.639533][ T2788] ? tipc_nl_node_dump_link+0x318/0xa50 [tipc] [ 59.640160][ T2788] ? mutex_lock_io_nested+0x1380/0x1380 [ 59.640746][ T2788] tipc_nl_node_dump_link+0x4fd/0xa50 [tipc] [ 59.641356][ T2788] ? tipc_nl_node_reset_link_stats+0x340/0x340 [tipc] [ 59.642088][ T2788] ? __skb_ext_del+0x270/0x270 [ 59.642594][ T2788] genl_lock_dumpit+0x85/0xb0 [ 59.643050][ T2788] netlink_dump+0x49c/0xed0 [ 59.643529][ T2788] ? __netlink_sendskb+0xc0/0xc0 [ 59.644044][ T2788] ? __netlink_dump_start+0x190/0x800 [ 59.644617][ T2788] ? __mutex_unlock_slowpath+0xd0/0x670 [ 59.645177][ T2788] __netlink_dump_start+0x5a0/0x800 [ 59.645692][ T2788] genl_rcv_msg+0xa75/0xe90 [ 59.646144][ T2788] ? __lock_acquire+0xdfe/0x3de0 [ 59.646692][ T2788] ? genl_family_rcv_msg_attrs_parse+0x320/0x320 [ 59.647340][ T2788] ? genl_lock_dumpit+0xb0/0xb0 [ 59.647821][ T2788] ? genl_unlock+0x20/0x20 [ 59.648290][ T2788] ? genl_parallel_done+0xe0/0xe0 [ 59.648787][ T2788] ? find_held_lock+0x39/0x1d0 [ 59.649276][ T2788] ? genl_rcv+0x15/0x40 [ 59.649722][ T2788] ? lock_contended+0xcd0/0xcd0 [ 59.650296][ T2788] netlink_rcv_skb+0x121/0x350 [ 59.650828][ T2788] ? genl_family_rcv_msg_attrs_parse+0x320/0x320 [ 59.651491][ T2788] ? netlink_ack+0x940/0x940 [ 59.651953][ T2788] ? lock_acquire+0x164/0x3b0 [ 59.652449][ T2788] genl_rcv+0x24/0x40 [ 59.652841][ T2788] netlink_unicast+0x421/0x600 [ ... ] Fixes: 7e4369057806 ("tipc: fix a slab object leak") Fixes: a62fbccecd62 ("tipc: make subscriber server support net namespace") Signed-off-by: Taehee Yoo Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 9f104c7736904ac72385bbb48669e0c923ca879b Author: Vladyslav Tarasiuk Date: Fri Dec 6 13:51:05 2019 +0000 mqprio: Fix out-of-bounds access in mqprio_dump When user runs a command like tc qdisc add dev eth1 root mqprio KASAN stack-out-of-bounds warning is emitted. Currently, NLA_ALIGN macro used in mqprio_dump provides too large buffer size as argument for nla_put and memcpy down the call stack. The flow looks like this: 1. nla_put expects exact object size as an argument; 2. Later it provides this size to memcpy; 3. To calculate correct padding for SKB, nla_put applies NLA_ALIGN macro itself. Therefore, NLA_ALIGN should not be applied to the nla_put parameter. Otherwise it will lead to out-of-bounds memory access in memcpy. Fixes: 4e8b86c06269 ("mqprio: Introduce new hardware offload mode and shaper in mqprio") Signed-off-by: Vladyslav Tarasiuk Signed-off-by: David S. Miller commit f421031e3ff0dd288a6e1bbde9aa41a25bb814e6 Author: Jongsung Kim Date: Fri Dec 6 20:40:00 2019 +0900 net: stmmac: reset Tx desc base address before restarting Tx Refer to the databook of DesignWare Cores Ethernet MAC Universal: 6.2.1.5 Register 4 (Transmit Descriptor List Address Register If this register is not changed when the ST bit is set to 0, then the DMA takes the descriptor address where it was stopped earlier. The stmmac_tx_err() does zero indices to Tx descriptors, but does not reset HW current Tx descriptor address. To fix inconsistency, the base address of the Tx descriptors should be rewritten before restarting Tx. Signed-off-by: Jongsung Kim Signed-off-by: David S. Miller commit a6a10d45d1eaf3fe20dd73ff4ef07e6dc40ec6d9 Author: Yangbo Lu Date: Fri Dec 6 17:53:35 2019 +0800 enetc: disable EEE autoneg by default The EEE support has not been enabled on ENETC, but it may connect to a PHY which supports EEE and advertises EEE by default, while its link partner also advertises EEE. If this happens, the PHY enters low power mode when the traffic rate is low and causes packet loss. This patch disables EEE advertisement by default for any PHY that ENETC connects to, to prevent the above unwanted outcome. Signed-off-by: Yangbo Lu Reviewed-by: Claudiu Manoil Signed-off-by: David S. Miller commit 97418e968b01ba8e3ad41c38b42106c48bc19544 Author: Jia He Date: Fri Dec 6 10:08:02 2019 +0800 KVM: arm/arm64: Remove excessive permission check in kvm_arch_prepare_memory_region In kvm_arch_prepare_memory_region, arm kvm regards the memory region as writable if the flag has no KVM_MEM_READONLY, and the vm is readonly if !VM_WRITE. But there is common usage for setting kvm memory region as follows: e.g. qemu side (see the PROT_NONE flag) 1. mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); memory_region_init_ram_ptr() 2. re mmap the above area with read/write authority. Such example is used in virtio-fs qemu codes which hasn't been upstreamed [1]. But seems we can't forbid this example. Without this patch, it will cause an EPERM during kvm_set_memory_region() and cause qemu boot crash. As told by Ard, "the underlying assumption is incorrect, i.e., that the value of vm_flags at this point in time defines how the VMA is used during its lifetime. There may be other cases where a VMA is created with VM_READ vm_flags that are changed to VM_READ|VM_WRITE later, and we are currently rejecting this use case as well." [1] https://gitlab.com/virtio-fs/qemu/blob/5a356e/hw/virtio/vhost-user-fs.c#L488 Suggested-by: Ard Biesheuvel Signed-off-by: Jia He Signed-off-by: Marc Zyngier Reviewed-by: Christoffer Dall Link: https://lore.kernel.org/r/20191206020802.196108-1-justin.he@arm.com commit 54ad68b7776043a77c9bf0a67d49cd9cb261a8e7 Author: Mark Rutland Date: Thu Dec 5 18:06:52 2019 +0000 KVM: arm64: Don't log IMP DEF sysreg traps We don't intend to support IMPLEMENATION DEFINED system registers, but have to trap them (and emulate them as UNDEFINED). These traps aren't interesting to the system administrator or to the KVM developers, so let's not bother logging when we do so. Signed-off-by: Mark Rutland Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20191205180652.18671-3-mark.rutland@arm.com commit afbd65f5e71a37fc9f46cb3e867e141a65d6ec25 Merge: 976e3645923b a284e11c371e Author: Dmitry Torokhov Date: Fri Dec 6 11:14:23 2019 -0800 Merge branch 'next' into for-linus Prepare second round of updates for 5.5 merge window. commit 7ada90eb9c7ae4a8eb066f8e9b4d80122f0363db Merge: 9feb1af97e73 9c1867d730a6 Author: Linus Torvalds Date: Fri Dec 6 10:28:09 2019 -0800 Merge tag 'drm-next-2019-12-06' of git://anongit.freedesktop.org/drm/drm Pull more drm updates from Dave Airlie: "Rob pointed out I missed his pull request for msm-next, it's been in next for a while outside of my tree so shouldn't cause any unexpected issues, it has some OCMEM support in drivers/soc that is acked by other maintainers as it's outside my tree. Otherwise it's a usual fixes pull, i915, amdgpu, the main ones, with some tegra, omap, mgag200 and one core fix. Summary: msm-next: - OCMEM support for a3xx and a4xx GPUs. - a510 support + display support core: - mst payload deletion fix i915: - uapi alignment fix - fix for power usage regression due to security fixes - change default preemption timeout to 640ms from 100ms - EHL voltage level display fixes - TGL DGL PHY fix - gvt - MI_ATOMIC cmd parser fix, CFL non-priv warning - CI spotted deadlock fix - EHL port D programming fix amdgpu: - VRAM lost fixes on BACO for CI/VI - navi14 DC fixes - misc SR-IOV, gfx10 fixes - XGMI fixes for arcturus - SRIOV fixes amdkfd: - KFD on ppc64le enabled - page table optimisations radeon: - fix for r1xx/2xx register checker. tegra: - displayport regression fixes - DMA API regression fixes mgag200: - fix devices that can't scanout except at 0 addr omap: - fix dma_addr refcounting" * tag 'drm-next-2019-12-06' of git://anongit.freedesktop.org/drm/drm: (100 commits) drm/dp_mst: Correct the bug in drm_dp_update_payload_part1() drm/omap: fix dma_addr refcounting drm/tegra: Run hub cleanup on ->remove() drm/tegra: sor: Make the +5V HDMI supply optional drm/tegra: Silence expected errors on IOMMU attach drm/tegra: vic: Export module device table drm/tegra: sor: Implement system suspend/resume drm/tegra: Use proper IOVA address for cursor image drm/tegra: gem: Remove premature import restrictions drm/tegra: gem: Properly pin imported buffers drm/tegra: hub: Remove bogus connection mutex check ia64: agp: Replace empty define with do while agp: Add bridge parameter documentation agp: remove unused variable num_segments agp: move AGPGART_MINOR to include/linux/miscdevice.h agp: remove unused variable size in agp_generic_create_gatt_table drm/dp_mst: Fix build on systems with STACKTRACE_SUPPORT=n drm/radeon: fix r1xx/r2xx register checker for POT textures drm/amdgpu: fix GFX10 missing CSIB set(v3) drm/amdgpu: should stop GFX ring in hw_fini ... commit 9feb1af97e7366b512ecb9e4dd61d3252074cda3 Merge: 0aecba617321 8539429917c4 Author: Linus Torvalds Date: Fri Dec 6 10:08:59 2019 -0800 Merge tag 'for-linus-20191205' of git://git.kernel.dk/linux-block Pull more block and io_uring updates from Jens Axboe: "I wasn't expecting this to be so big, and if I was, I would have used separate branches for this. Going forward I'll be doing separate branches for the current tree, just like for the next kernel version tree. In any case, this contains: - Series from Christoph that fixes an inherent race condition with zoned devices and revalidation. - null_blk zone size fix (Damien) - Fix for a regression in this merge window that caused busy spins by sending empty disk uevents (Eric) - Fix for a regression in this merge window for bfq stats (Hou) - Fix for io_uring creds allocation failure handling (me) - io_uring -ERESTARTSYS send/recvmsg fix (me) - Series that fixes the need for applications to retain state across async request punts for io_uring. This one is a bit larger than I would have hoped, but I think it's important we get this fixed for 5.5. - connect(2) improvement for io_uring, handling EINPROGRESS instead of having applications needing to poll for it (me) - Have io_uring use a hash for poll requests instead of an rbtree. This turned out to work much better in practice, so I think we should make the switch now. For some workloads, even with a fair amount of cancellations, the insertion sort is just too expensive. (me) - Various little io_uring fixes (me, Jackie, Pavel, LimingWu) - Fix for brd unaligned IO, and a warning for the future (Ming) - Fix for a bio integrity data leak (Justin) - bvec_iter_advance() improvement (Pavel) - Xen blkback page unmap fix (SeongJae) The major items in here are all well tested, and on the liburing side we continue to add regression and feature test cases. We're up to 50 topic cases now, each with anywhere from 1 to more than 10 cases in each" * tag 'for-linus-20191205' of git://git.kernel.dk/linux-block: (33 commits) block: fix memleak of bio integrity data io_uring: fix a typo in a comment bfq-iosched: Ensure bio->bi_blkg is valid before using it io_uring: hook all linked requests via link_list io_uring: fix error handling in io_queue_link_head io_uring: use hash table for poll command lookups io-wq: clear node->next on list deletion io_uring: ensure deferred timeouts copy necessary data io_uring: allow IO_SQE_* flags on IORING_OP_TIMEOUT null_blk: remove unused variable warning on !CONFIG_BLK_DEV_ZONED brd: warn on un-aligned buffer brd: remove max_hw_sectors queue limit xen/blkback: Avoid unmapping unmapped grant pages io_uring: handle connect -EINPROGRESS like -EAGAIN block: set the zone size in blk_revalidate_disk_zones atomically block: don't handle bio based drivers in blk_revalidate_disk_zones block: allocate the zone bitmaps lazily block: replace seq_zones_bitmap with conv_zones_bitmap block: simplify blkdev_nr_zones block: remove the empty line at the end of blk-zoned.c ... commit 7e4c6b9a5d22485acf009b3c3510a370f096dd54 Author: Keith Busch Date: Fri Dec 6 08:11:17 2019 +0900 nvme/pci: Fix read queue count If nvme.write_queues equals the number of CPUs, the driver had decreased the number of interrupts available such that there could only be one read queue even if the controller could support more. Remove the interrupt count reduction in this case. The driver wouldn't request more IRQs than it wants queues anyway. Reviewed-by: Jens Axboe Signed-off-by: Keith Busch commit 17c3316734ae2e51f74078cd955ab855caea7d73 Author: Keith Busch Date: Sat Dec 7 01:16:59 2019 +0900 nvme/pci Limit write queue sizes to possible cpus The driver can never use more queues of any type than the number of possible CPUs, so a higher value causes the driver to allocate more memory for IO queues than it could ever use. Limit the parameter at module load time to the number of possible cpus. Reviewed-by: Jens Axboe Signed-off-by: Keith Busch commit 3f68baf706ec68c4120867c25bc439c845fe3e17 Author: Keith Busch Date: Sat Dec 7 01:51:54 2019 +0900 nvme/pci: Fix write and poll queue types The number of poll or write queues should never be negative. Use unsigned types so that it's not possible to break have the driver not allocate any queues. Reviewed-by: Jens Axboe Signed-off-by: Keith Busch commit 0aecba6173216931c436a03183f4759a4fd4c2f2 Merge: b0d4beaa5a4b 2fa6b1e01a9b Author: Linus Torvalds Date: Fri Dec 6 09:06:58 2019 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs d_inode/d_flags memory ordering fixes from Al Viro: "Fallout from tree-wide audit for ->d_inode/->d_flags barriers use. Basically, the problem is that negative pinned dentries require careful treatment - unless ->d_lock is locked or parent is held at least shared, another thread can make them positive right under us. Most of the uses turned out to be safe - the main surprises as far as filesystems are concerned were - race in dget_parent() fastpath, that might end up with the caller observing the returned dentry _negative_, due to insufficient barriers. It is positive in memory, but we could end up seeing the wrong value of ->d_inode in CPU cache. Fixed. - manual checks that result of lookup_one_len_unlocked() is positive (and rejection of negatives). Again, insufficient barriers (we might end up with inconsistent observed values of ->d_inode and ->d_flags). Fixed by switching to a new primitive that does the checks itself and returns ERR_PTR(-ENOENT) instead of a negative dentry. That way we get rid of boilerplate converting negatives into ERR_PTR(-ENOENT) in the callers and have a single place to deal with the barrier-related mess - inside fs/namei.c rather than in every caller out there. The guts of pathname resolution *do* need to be careful - the race found by Ritesh is real, as well as several similar races. Fortunately, it turns out that we can take care of that with fairly local changes in there. The tree-wide audit had not been fun, and I hate the idea of repeating it. I think the right approach would be to annotate the places where we are _not_ guaranteed ->d_inode/->d_flags stability and have sparse catch regressions. But I'm still not sure what would be the least invasive way of doing that and it's clearly the next cycle fodder" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs/namei.c: fix missing barriers when checking positivity fix dget_parent() fastpath race new helper: lookup_positive_unlocked() fs/namei.c: pull positivity check into follow_managed() commit 0a5239985a3bc084738851afdf3fceb7d5651b0c Author: Boris Brezillon Date: Fri Nov 29 14:59:05 2019 +0100 drm/panfrost: Open/close the perfcnt BO Commit a5efb4c9a562 ("drm/panfrost: Restructure the GEM object creation") moved the drm_mm_insert_node_generic() call to the gem->open() hook, but forgot to update perfcnt accordingly. Patch the perfcnt logic to call panfrost_gem_open/close() where appropriate. Fixes: a5efb4c9a562 ("drm/panfrost: Restructure the GEM object creation") Cc: Signed-off-by: Boris Brezillon Reviewed-by: Steven Price Acked-by: Alyssa Rosenzweig Signed-off-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20191129135908.2439529-6-boris.brezillon@collabora.com commit aed44cbeae2b7674cd155ba5cc6506aafe46a94e Author: Boris Brezillon Date: Fri Nov 29 14:59:04 2019 +0100 drm/panfrost: Fix a race in panfrost_gem_free_object() panfrost_gem_shrinker_scan() might purge a BO (release the sgt and kill the GPU mapping) that's being freed by panfrost_gem_free_object() if we don't remove the BO from the shrinker list at the beginning of panfrost_gem_free_object(). Fixes: 013b65101315 ("drm/panfrost: Add madvise and shrinker support") Cc: Signed-off-by: Boris Brezillon Reviewed-by: Steven Price Acked-by: Alyssa Rosenzweig Signed-off-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20191129135908.2439529-5-boris.brezillon@collabora.com commit 3bb69dbcb9e8430e0cc9990cff427ca3ae25ffdc Author: Boris Brezillon Date: Fri Nov 29 14:59:03 2019 +0100 drm/panfrost: Fix a BO leak in panfrost_ioctl_mmap_bo() We should release the reference we grabbed when an error occurs. Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") Cc: Signed-off-by: Boris Brezillon Reviewed-by: Steven Price Acked-by: Alyssa Rosenzweig Signed-off-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20191129135908.2439529-4-boris.brezillon@collabora.com commit 70cc77952efebf6722d483cb83cfb563ac9768db Author: Boris Brezillon Date: Fri Nov 29 14:59:02 2019 +0100 drm/panfrost: Fix a race in panfrost_ioctl_madvise() If 2 threads change the MADVISE property of the same BO in parallel we might end up with an shmem->madv value that's inconsistent with the presence of the BO in the shrinker list. The easiest solution to fix that is to protect the drm_gem_shmem_madvise() call with the shrinker lock. Fixes: 013b65101315 ("drm/panfrost: Add madvise and shrinker support") Cc: Signed-off-by: Boris Brezillon Reviewed-by: Steven Price Acked-by: Alyssa Rosenzweig Signed-off-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20191129135908.2439529-3-boris.brezillon@collabora.com commit 22bd4df9dadf46f56f2eb16859439a7a600d106a Author: Steven Price Date: Mon Nov 18 17:30:02 2019 +0000 drm/panfrost: devfreq: Round frequencies to OPPs Currently when setting a frequency in panfrost_devfreq_target the returned frequency is the actual frequency that the clock driver reports (the return of clk_get_rate()). However, where the provided OPPs don't precisely match the frequencies that the clock actually achieves devfreq will then complain (repeatedly): devfreq devfreq0: Couldn't update frequency transition information. To avoid this change panfrost_devfreq_target() to fetch the opp using devfreq_recommened_opp() and not actually query the clock for the frequency. A similar problem exists with panfrost_devfreq_get_cur_freq(), but in this case because the function is optional we can just remove it and devfreq will fall back to using the previously set frequency. Fixes: 221bc77914cb ("drm/panfrost: Use generic code for devfreq") Signed-off-by: Steven Price Reviewed-by: Alyssa Rosenzweig Signed-off-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20191118173002.32015-1-steven.price@arm.com commit 694cfe7f31db36912725e63a38a5179c8628a496 Author: Nikos Tsironis Date: Wed Dec 4 16:07:42 2019 +0200 dm thin: Flush data device before committing metadata The thin provisioning target maintains per thin device mappings that map virtual blocks to data blocks in the data device. When we write to a shared block, in case of internal snapshots, or provision a new block, in case of external snapshots, we copy the shared block to a new data block (COW), update the mapping for the relevant virtual block and then issue the write to the new data block. Suppose the data device has a volatile write-back cache and the following sequence of events occur: 1. We write to a shared block 2. A new data block is allocated 3. We copy the shared block to the new data block using kcopyd (COW) 4. We insert the new mapping for the virtual block in the btree for that thin device. 5. The commit timeout expires and we commit the metadata, that now includes the new mapping from step (4). 6. The system crashes and the data device's cache has not been flushed, meaning that the COWed data are lost. The next time we read that virtual block of the thin device we read it from the data block allocated in step (2), since the metadata have been successfully committed. The data are lost due to the crash, so we read garbage instead of the old, shared data. This has the following implications: 1. In case of writes to shared blocks, with size smaller than the pool's block size (which means we first copy the whole block and then issue the smaller write), we corrupt data that the user never touched. 2. In case of writes to shared blocks, with size equal to the device's logical block size, we fail to provide atomic sector writes. When the system recovers the user will read garbage from that sector instead of the old data or the new data. 3. Even for writes to shared blocks, with size equal to the pool's block size (overwrites), after the system recovers, the written sectors will contain garbage instead of a random mix of sectors containing either old data or new data, thus we fail again to provide atomic sectors writes. 4. Even when the user flushes the thin device, because we first commit the metadata and then pass down the flush, the same risk for corruption exists (if the system crashes after the metadata have been committed but before the flush is passed down to the data device.) The only case which is unaffected is that of writes with size equal to the pool's block size and with the FUA flag set. But, because FUA writes trigger metadata commits, this case can trigger the corruption indirectly. Moreover, apart from internal and external snapshots, the same issue exists for newly provisioned blocks, when block zeroing is enabled. After the system recovers the provisioned blocks might contain garbage instead of zeroes. To solve this and avoid the potential data corruption we flush the pool's data device **before** committing its metadata. This ensures that the data blocks of any newly inserted mappings are properly written to non-volatile storage and won't be lost in case of a crash. Cc: stable@vger.kernel.org Signed-off-by: Nikos Tsironis Acked-by: Joe Thornber Signed-off-by: Mike Snitzer commit 30f55eae47e4ad1b64d692865e6a4277447a33df Merge: 916a91406278 be8af7a9e3cc Author: Olof Johansson Date: Fri Dec 6 08:29:54 2019 -0800 Merge tag 'arm-soc/for-5.5/devicetree-part2' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains the second batch of changes for Broadcom ARM-based SoCs, please pull the following: - Nicolas declares a CMA area within the first 1GB of DRAM in order for it to be guaranteed to reside there, otherwise ARM64's memory initialization will pick up a CMA area within ZONE_DMA32 - Stefan adds the Device Tree node for the built-in Ethernet controller (GENET) on the Raspberry Pi 4 model B board * tag 'arm-soc/for-5.5/devicetree-part2' of https://github.com/Broadcom/stblinux: ARM: dts: bcm2711-rpi-4: Enable GENET support ARM: dts: bcm2711: force CMA into first GB of memory Link: https://lore.kernel.org/r/20191118182931.11884-1-f.fainelli@gmail.com Signed-off-by: Olof Johansson commit 916a9140627898f1f3feb220b8e77001c0d876bf Merge: 5af5b2ae1ccf 030d2829f4c2 Author: Olof Johansson Date: Fri Dec 6 08:28:49 2019 -0800 Merge tag 'tegra-for-5.5-memory-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes memory: tegra: Fixes for v5.5-rc1 This contains a fix for a kernel panic that can occur on suspend if EMC timings are not available in device tree. * tag 'tegra-for-5.5-memory-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: memory: tegra30-emc: Fix panic on suspend Link: https://lore.kernel.org/r/20191204130753.3614278-1-thierry.reding@gmail.com Signed-off-by: Olof Johansson commit 5af5b2ae1ccfb4638c885e16cb0dfe131cb4aa9b Merge: c25f318b1ff7 48914c4ecb0c Author: Olof Johansson Date: Fri Dec 6 08:28:36 2019 -0800 Merge tag 'tegra-for-5.5-soc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes soc/tegra: Fixes for v5.5-rc1 Fixes a regression for wake events on Tegra194 caused by the Tegra210 support that was added in v5.5-rc1 as well as wrong reset sources and levels on Tegra194. * tag 'tegra-for-5.5-soc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: pmc: Add reset sources and levels on Tegra194 soc/tegra: pmc: Add missing IRQ callbacks on Tegra194 soc/tegra: pmc: Use lower-case for hexadecimal literals Link: https://lore.kernel.org/r/20191204130753.3614278-2-thierry.reding@gmail.com Signed-off-by: Olof Johansson commit c25f318b1ff7f27ef25def34f3a8834ec6de5972 Merge: f7a1a1db9877 0fb438eed10c Author: Olof Johansson Date: Fri Dec 6 08:28:11 2019 -0800 Merge tag 'tegra-for-5.5-cpufreq' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes cpufreq: tegra: Changes for v5.5-rc1 Implements support for suspend/resume on Tegra124. * tag 'tegra-for-5.5-cpufreq' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: cpufreq: tegra124: Add suspend and resume support Link: https://lore.kernel.org/r/20191204130753.3614278-3-thierry.reding@gmail.com Signed-off-by: Olof Johansson commit f7a1a1db9877799e15aba047acd799c2df811f88 Merge: e89d108da909 716864586c62 Author: Olof Johansson Date: Fri Dec 6 08:27:32 2019 -0800 Merge tag 'socfpga_update_for_v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes SoCFPGA updates for v5.5 - Issue COLD reboot by default for SoCFPGA platforms * tag 'socfpga_update_for_v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm: socfpga: execute cold reboot by default Link: https://lore.kernel.org/r/20191122182106.822-1-dinguyen@kernel.org Signed-off-by: Olof Johansson commit e89d108da909a4a248ab27cddd68eebaed2850f3 Merge: 0f679edf5ae3 3e5c3c41ae92 Author: Olof Johansson Date: Fri Dec 6 08:27:15 2019 -0800 Merge tag 'omap-for-v5.5/dt-fixes-merge-window-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Device tree fixes for omap variants for for v5.5 merge window This series of changes contains fixes for few SoC and board specific issues that would be good to have merged for v5.5-rc1: - Fix incorrect MMC card detection polarity for omap3-tao3530 - Fix wrong am57xx-beagle-x15 pinmux named states for eMMC - Fix dra7 cpsw mdio clock that causes wrong speed - Fix vcsi for droid4 so it won't get turned off after init - Fix rev and sysconfig register offsets for omap4 sgx so it can idle Then there are also two minor late changes to logicpd-torpedo-baseboard to configure 1-wire HDQ for battery stats, and remove out of date workaround comments no longer needed. * tag 'omap-for-v5.5/dt-fixes-merge-window-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: Fix sgx sysconfig register for omap4 ARM: dts: Fix vcsi regulator to be always-on for droid4 to prevent hangs ARM: dts: dra7: fix cpsw mdio fck clock ARM: dts: am57xx-beagle-x15: Update pinmux name to ddr_3_3v ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity ARM: dts: logicpd-torpedo: Remove unnecessary notes/comments ARM: dts: logicpd-torpedo-baseboard: Enable HDQ Link: https://lore.kernel.org/r/pull-1574870758-237468@atomide.com Signed-off-by: Olof Johansson commit 0f679edf5ae392ad8aa20ac3f9f404bdc49291b3 Merge: 18977008f44c d7d8d62a3f3b Author: Olof Johansson Date: Fri Dec 6 08:26:47 2019 -0800 Merge tag 'omap-for-v5.5/ti-sysc-late-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Few ti-sysc related fixes for v5.5 merge window Just few minor changes that can be merged when suitable, but would be good to have these in v5.5-rc1 to remove dependencies between branches for more changes later on in v5.6: - Add quirk handling for AESS (Audio Engine Sub System) - We want to drop the useless gptimer option for omap4 as there are local timers - A minor error path handling improvment for sysc_child_add_named_clock() that will make further patching a bit easier * tag 'omap-for-v5.5/ti-sysc-late-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: bus: ti-sysc: Adjust exception handling in sysc_child_add_named_clock() ARM: OMAP2+: Drop useless gptimer option for omap4 bus: ti-sysc: Add module enable quirk for audio AESS Link: https://lore.kernel.org/r/pull-1574273726-31367@atomide.com Signed-off-by: Olof Johansson commit 18977008f44c66bdd6d20bb432adf71372589303 Author: Marek Szyprowski via Linux.Kernel.Org Date: Fri Dec 6 13:51:12 2019 +0100 ARM: multi_v7_defconfig: Restore debugfs support Commit fd7d58f0dbc3 ("ARM: multi_v7_defconfig: renormalize based on recent additions") removed explicit enable line for CONFIG_DEBUG_FS, because that feature has been selected by other enabled options: CONFIG_TRACING, which were enabled by CONFIG_PERF_EVENTS. In meantime, commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") removed the dependency between CONFIG_DEBUG_FS and CONFIG_TRACING, so CONFIG_DEBUG_FS is no longer enabled in default builds. Enable it again explicitly, as debugfs support is essential for various automated testing tools. Link: https://lore.kernel.org/r/20191206125112.11006-1-m.szyprowski@samsung.com Signed-off-by: Marek Szyprowski Signed-off-by: Olof Johansson commit 4adf0b49eea926a55fd956ef7d86750f771435ff Author: Thomas Zimmermann Date: Fri Dec 6 09:19:01 2019 +0100 drm/mgag200: Flag all G200 SE A machines as broken wrt Several MGA G200 SE machines don't respect the value of the startadd register field. After more feedback on affected machines, neither PCI subvendor ID nor the internal ID seem to hint towards the bug. All affected machines have a PCI ID of 0x0522 (i.e., G200 SE A). It was decided to flag all G200 SE A machines as broken. Signed-off-by: Thomas Zimmermann Acked-by: Gerd Hoffmann Fixes: 1591fadf857c ("drm/mgag200: Add workaround for HW that does not support 'startadd'") Cc: Thomas Zimmermann Cc: John Donnelly Cc: Daniel Vetter Cc: Gerd Hoffmann Cc: Dave Airlie Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Sam Ravnborg Cc: "Y.C. Chen" Cc: Neil Armstrong Cc: Thomas Gleixner Cc: "José Roberto de Souza" Cc: Andrzej Pietrasiewicz Cc: dri-devel@lists.freedesktop.org Cc: # v5.3+ Cc: Greg Kroah-Hartman Cc: Allison Randal Cc: Alex Deucher Cc: "Noralf Trønnes" Link: https://patchwork.freedesktop.org/patch/msgid/20191206081901.9938-1-tzimmermann@suse.de commit de858040ee80e6f41bf0b40090f1c71f966a61b3 Author: Heyi Guo Date: Mon Dec 2 19:37:02 2019 +0800 arm64: entry: refine comment of stack overflow check Stack overflow checking can be done by testing sp & (1 << THREAD_SHIFT) only for the stacks are aligned to (2 << THREAD_SHIFT) with size of (1 << THREAD_SIZE), and this is the case when CONFIG_VMAP_STACK is set. Fix the code comment to avoid confusion. Cc: Will Deacon Acked-by: Mark Rutland Signed-off-by: Heyi Guo [catalin.marinas@arm.com: Updated comment following Mark's suggestion] Signed-off-by: Catalin Marinas commit 70927d02d409b5a79c3ed040ace5017da8284ede Author: Mark Rutland Date: Fri Dec 6 13:01:29 2019 +0000 arm64: ftrace: fix ifdeffery When I tweaked the ftrace entry assembly in commit: 3b23e4991fb66f6d ("arm64: implement ftrace with regs") ... my ifdeffery tweaks left ftrace_graph_caller undefined for CONFIG_DYNAMIC_FTRACE && CONFIG_FUNCTION_GRAPH_TRACER when ftrace is based on mcount. The kbuild test robot reported that this issue is detected at link time: | arch/arm64/kernel/entry-ftrace.o: In function `skip_ftrace_call': | arch/arm64/kernel/entry-ftrace.S:238: undefined reference to `ftrace_graph_caller' | arch/arm64/kernel/entry-ftrace.S:238:(.text+0x3c): relocation truncated to fit: R_AARCH64_CONDBR19 against undefined symbol | `ftrace_graph_caller' | arch/arm64/kernel/entry-ftrace.S:243: undefined reference to `ftrace_graph_caller' | arch/arm64/kernel/entry-ftrace.S:243:(.text+0x54): relocation truncated to fit: R_AARCH64_CONDBR19 against undefined symbol | `ftrace_graph_caller' This patch fixes the ifdeffery so that the mcount version of ftrace_graph_caller doesn't depend on CONFIG_DYNAMIC_FTRACE. At the same time, a redundant #else is removed from the ifdeffery for the patchable-function-entry version of ftrace_graph_caller. Fixes: 3b23e4991fb66f6d ("arm64: implement ftrace with regs") Reported-by: kbuild test robot Signed-off-by: Mark Rutland Cc: Amit Daniel Kachhap Cc: Ard Biesheuvel Cc: Mark Rutland Cc: Torsten Duwe Cc: Will Deacon Signed-off-by: Catalin Marinas commit 0492747c72a3db0425a234abafb763c5b28c845d Author: Sebastian Andrzej Siewior Date: Thu Nov 28 20:58:05 2019 +0100 arm64: KVM: Invoke compute_layout() before alternatives are applied compute_layout() is invoked as part of an alternative fixup under stop_machine(). This function invokes get_random_long() which acquires a sleeping lock on -RT which can not be acquired in this context. Rename compute_layout() to kvm_compute_layout() and invoke it before stop_machine() applies the alternatives. Add a __init prefix to kvm_compute_layout() because the caller has it, too (and so the code can be discarded after boot). Reviewed-by: James Morse Acked-by: Marc Zyngier Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Catalin Marinas commit df325e05a682e9c624f471835c35bd3f870d5e8c Author: Catalin Marinas Date: Thu Dec 5 13:57:36 2019 +0000 arm64: Validate tagged addresses in access_ok() called from kernel threads __range_ok(), invoked from access_ok(), clears the tag of the user address only if CONFIG_ARM64_TAGGED_ADDR_ABI is enabled and the thread opted in to the relaxed ABI. The latter sets the TIF_TAGGED_ADDR thread flag. In the case of asynchronous I/O (e.g. io_submit()), the access_ok() may be called from a kernel thread. Since kernel threads don't have TIF_TAGGED_ADDR set, access_ok() will fail for valid tagged user addresses. Example from the ffs_user_copy_worker() thread: use_mm(io_data->mm); ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data); unuse_mm(io_data->mm); Relax the __range_ok() check to always untag the user address if called in the context of a kernel thread. The user pointers would have already been checked via aio_setup_rw() -> import_{single_range,iovec}() at the time of the asynchronous I/O request. Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI") Cc: # 5.4.x- Cc: Will Deacon Reported-by: Evgenii Stepanov Tested-by: Evgenii Stepanov Signed-off-by: Catalin Marinas commit 04bb96427d4ee33fbdf15648ddf578c6ba1aef54 Author: Vincenzo Frascino Date: Thu Dec 5 11:04:51 2019 +0100 ARM: 8947/1: Fix __arch_get_hw_counter() access to CNTVCT __arch_get_hw_counter() should check clock_mode to see if it can access CNTVCT. With the conversion to unified vDSO this check has been left out. This causes on imx v6 and v7 (imx_v6_v7_defconfig) and other platforms to hang at boot during the execution of the init process as per below: [ 19.976852] Run /sbin/init as init process [ 20.044931] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004 Fix the problem verifying that clock_mode is set coherently before accessing CNTVCT. Investigated-by: Arnd Bergmann Reported-by: Guenter Roeck Tested-by: Guenter Roeck Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Vincenzo Frascino Signed-off-by: Russell King commit ff98a5f624d2910de050f1fc7f2a32769da86b51 Author: Dietmar Eggemann Date: Fri Nov 29 16:23:02 2019 +0100 ARM: 8943/1: Fix topology setup in case of CPU hotplug for CONFIG_SCHED_MC Commit ca74b316df96 ("arm: Use common cpu_topology structure and functions.") changed cpu_coregroup_mask() from the ARM32 specific implementation in arch/arm/include/asm/topology.h to the one shared with ARM64 and RISCV in drivers/base/arch_topology.c. Currently on ARM32 (TC2 w/ CONFIG_SCHED_MC) the task scheduler setup code (w/ CONFIG_SCHED_DEBUG) shows this during CPU hotplug: ERROR: groups don't span domain->span It happens to CPUs of the cluster of the CPU which gets hot-plugged out on scheduler domain MC. Turns out that the shared cpu_coregroup_mask() requires that the hot-plugged CPU is removed from the core_sibling mask via remove_cpu_topology(). Otherwise the 'is core_sibling subset of cpumask_of_node()' doesn't work. In this case the task scheduler has to deal with cpumask_of_node instead of core_sibling which is wrong on scheduler domain MC. e.g. CPU3 hot-plugged out on TC2 [cluster0: 0,3-4 cluster1: 1-2]: cpu_coregroup_mask(): CPU3 cpumask_of_node=0-2,4 core_sibling=0,3-4 ^ should be: cpu_coregroup_mask(): CPU3 cpumask_of_node=0-2,4 core_sibling=0,4 Add remove_cpu_topology() to __cpu_disable() to remove the CPU from the topology masks in case of a CPU hotplug out operation. At the same time tweak store_cpu_topology() slightly so it will call update_siblings_masks() in case of CPU hotplug in operation via secondary_start_kernel()->smp_store_cpu_info(). This aligns the ARM32 implementation with the ARM64 one. Guarding remove_cpu_topology() with CONFIG_GENERIC_ARCH_TOPOLOGY is necessary since some Arm32 defconfigs (aspeed_g5_defconfig, milbeaut_m10v_defconfig, spear13xx_defconfig) specify an explicit # CONFIG_ARM_CPU_TOPOLOGY is not set w/ ./arch/arm/Kconfig: select GENERIC_ARCH_TOPOLOGY if ARM_CPU_TOPOLOGY Fixes: ca74b316df96 ("arm: Use common cpu_topology structure and functions") Reviewed-by: Sudeep Holla Reviewed-by: Lukasz Luba Tested-by: Lukasz Luba Tested-by: Ondrej Jirman Signed-off-by: Dietmar Eggemann Signed-off-by: Russell King commit bf4b96bb542ee3fe913d0b9eb4d9c1046c429ac6 Author: Mark Rutland Date: Thu Dec 5 18:06:51 2019 +0000 KVM: arm64: Sanely ratelimit sysreg messages Currently kvm_pr_unimpl() is ratelimited, so print_sys_reg_instr() won't spam the console. However, someof its callers try to print some contextual information with kvm_err(), which is not ratelimited. This means that in some cases the context may be printed without the sysreg encoding, which isn't all that useful. Let's ensure that both are consistently printed together and ratelimited, by refactoring print_sys_reg_instr() so that some callers can provide it with an arbitrary format string. Signed-off-by: Mark Rutland Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20191205180652.18671-2-mark.rutland@arm.com commit 72a610f32e1f1664803218ec654a8e3b8fb2081a Author: Miaohe Lin Date: Sat Nov 30 10:45:18 2019 +0800 KVM: arm/arm64: vgic: Use wrapper function to lock/unlock all vcpus in kvm_vgic_create() Use wrapper function lock_all_vcpus()/unlock_all_vcpus() in kvm_vgic_create() to remove duplicated code dealing with locking and unlocking all vcpus in a vm. Signed-off-by: Miaohe Lin Signed-off-by: Marc Zyngier Reviewed-by: Eric Auger Reviewed-by: Steven Price Link: https://lore.kernel.org/r/1575081918-11401-1-git-send-email-linmiaohe@huawei.com commit 0bda9498dd45280e334bfe88b815ebf519602cc3 Author: Miaohe Lin Date: Thu Nov 28 14:38:48 2019 +0800 KVM: arm/arm64: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy() In kvm_vgic_dist_init() called from kvm_vgic_map_resources(), if dist->vgic_model is invalid, dist->spis will be freed without set dist->spis = NULL. And in vgicv2 resources clean up path, __kvm_vgic_destroy() will be called to free allocated resources. And dist->spis will be freed again in clean up chain because we forget to set dist->spis = NULL in kvm_vgic_dist_init() failed path. So double free would happen. Signed-off-by: Miaohe Lin Signed-off-by: Marc Zyngier Reviewed-by: Eric Auger Link: https://lore.kernel.org/r/1574923128-19956-1-git-send-email-linmiaohe@huawei.com commit 7e0befd521b6d40af1d08fcdb29d4dbf30236624 Author: Miaohe Lin Date: Thu Nov 21 15:15:59 2019 +0800 KVM: arm/arm64: Get rid of unused arg in cpu_init_hyp_mode() As arg dummy is not really needed, there's no need to pass NULL when calling cpu_init_hyp_mode(). So clean it up. Fixes: 67f691976662 ("arm64: kvm: allows kvm cpu hotplug") Reviewed-by: Steven Price Signed-off-by: Miaohe Lin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/1574320559-5662-1-git-send-email-linmiaohe@huawei.com commit 969bea5e4d8b96d903637b100640acb92158c4e3 Author: Kefeng Wang Date: Thu Nov 28 08:47:52 2019 +0800 checkpatch: Drop pr_warning check All pr_warning are removed from kernel, let's cleanup pr_warning check in checkpatch. Link: http://lkml.kernel.org/r/20191128004752.35268-5-wangkefeng.wang@huawei.com To: linux-kernel@vger.kernel.org Cc: gregkh@linuxfoundation.org Cc: tj@kernel.org Cc: arnd@arndb.de Cc: sergey.senozhatsky@gmail.com Cc: rostedt@goodmis.org Cc: Andy Whitcroft Signed-off-by: Kefeng Wang Acked-by: Joe Perches Signed-off-by: Petr Mladek commit 61ff72f4016804b99d28988a57e65c217f01769d Author: Kefeng Wang Date: Thu Nov 28 08:47:51 2019 +0800 printk: Drop pr_warning definition With all pr_warning are removed, saftely drop pr_warning definition. Link: http://lkml.kernel.org/r/20191128004752.35268-4-wangkefeng.wang@huawei.com To: joe@perches.com To: linux-kernel@vger.kernel.org Cc: gregkh@linuxfoundation.org Cc: tj@kernel.org Cc: arnd@arndb.de Cc: sergey.senozhatsky@gmail.com Cc: rostedt@goodmis.org Signed-off-by: Kefeng Wang Signed-off-by: Petr Mladek commit ee19545220a8663f0ca58c3427bc08fd6a104a42 Author: Stephen Rothwell Date: Fri Dec 6 09:25:03 2019 +1100 Fix up for "printk: Drop pr_warning definition" Link: http://lkml.kernel.org/r/20191206092503.303d6a57@canb.auug.org.au Cc: Linux Next Mailing List Cc: Linux Kernel Mailing List Cc: "Steven Rostedt (VMware)" Cc: Kefeng Wang Cc: Linus Torvalds Signed-off-by: Stephen Rothwell Signed-off-by: Petr Mladek commit 1d9a6159bd04b676cb7d9b13245888fa450cec10 Author: Kefeng Wang Date: Thu Nov 28 08:47:49 2019 +0800 workqueue: Use pr_warn instead of pr_warning Use pr_warn() instead of the remaining pr_warning() calls. Link: http://lkml.kernel.org/r/20191128004752.35268-2-wangkefeng.wang@huawei.com To: joe@perches.com To: linux-kernel@vger.kernel.org Cc: gregkh@linuxfoundation.org Cc: tj@kernel.org Cc: arnd@arndb.de Cc: sergey.senozhatsky@gmail.com Cc: rostedt@goodmis.org Signed-off-by: Kefeng Wang Acked-by: Tejun Heo Signed-off-by: Petr Mladek commit ae72555b410410568b493f8735324f8e9bd7c051 Merge: 0033b34a03ec 8f9081c92523 Author: David S. Miller Date: Fri Dec 6 00:04:15 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2019-12-05 The following pull-request contains BPF updates for your *net* tree. We've added 6 non-merge commits during the last 1 day(s) which contain a total of 14 files changed, 116 insertions(+), 37 deletions(-). The main changes are: 1) three selftests fixes, from Stanislav. 2) one samples fix, from Jesper. 3) one verifier fix, from Yonghong. ==================== Signed-off-by: David S. Miller commit 0f60a0bcc1b96d531fa623ab520f863f1292c75b Merge: 9f58c93efdff fd9bee5e2414 Author: Ingo Molnar Date: Fri Dec 6 08:54:41 2019 +0100 Merge tag 'perf-urgent-for-mingo-5.5-20191205' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf fixes from Arnaldo Carvalho de Melo: perf inject: Adrian Hunter: - Fix processing of ID index for injected instruction tracing perf report: Ravi Bangoria: - Replace pr_err() with ui__error(), so that we can see the output in the TUI mode instead of showing and immediately restoring the screen to the state before perf was started. - Don't start --mem-mode/--branch-mode mode if required samples are not available. tools headers UAPI: Arnaldo Carvalho de Melo: - Sync drm/i915_drm.h with the kernel sources - Update tools's copy of drm.h headers. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 9c1867d730a6e1dc23dd633392d102860578c047 Merge: b53bd16fec3d 01bb63031933 Author: Dave Airlie Date: Fri Dec 6 13:10:51 2019 +1000 Merge tag 'drm-intel-next-fixes-2019-12-05' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Includes gvt-next-fixes-2019-12-02 pull - Fixes for CI spotted eadlock and a race condition in GEM contexts - Fix for EHL port D programming Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20191205092412.GA8089@jlahtine-desk.ger.corp.intel.com commit 8539429917c48c994d2e2cafa02ab06587b3b42c Merge: ece841abbed2 0b4295b5e2b9 Author: Jens Axboe Date: Thu Dec 5 19:09:26 2019 -0700 Merge branch 'io_uring-5.5' into for-linus * io_uring-5.5: io_uring: fix a typo in a comment io_uring: hook all linked requests via link_list io_uring: fix error handling in io_queue_link_head io_uring: use hash table for poll command lookups commit b0d4beaa5a4b7d31070c41c2e50740304a3f1138 Merge: da73fcd8cfdc 850d71acd52c Author: Linus Torvalds Date: Thu Dec 5 17:11:48 2019 -0800 Merge branch 'next.autofs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull autofs updates from Al Viro: "autofs misuses checks for ->d_subdirs emptiness; the cursors are in the same lists, resulting in false negatives. It's not needed anyway, since autofs maintains counter in struct autofs_info, containing 0 for removed ones, 1 for live symlinks and 1 + number of children for live directories, which is precisely what we need for those checks. This series switches to use of that counter and untangles the crap around its uses (it needs not be atomic and there's a bunch of completely pointless "defensive" checks). This fell out of dcache_readdir work; the main point is to get rid of ->d_subdirs abuses in there. I've more followup cleanups, but I hadn't run those by Ian yet, so they can go next cycle" * 'next.autofs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: autofs: don't bother with atomics for ino->count autofs_dir_rmdir(): check ino->count for deciding whether it's empty... autofs: get rid of pointless checks around ->count handling autofs_clear_leaf_automount_flags(): use ino->count instead of ->d_subdirs commit da73fcd8cfdc3d0ef49280fa0d511723a0220e03 Merge: 3f1266ec704d 8f868d68d335 Author: Linus Torvalds Date: Thu Dec 5 16:35:53 2019 -0800 Merge branch 'pipe-rework' (patches from David Howells) Merge two fixes for the pipe rework from David Howells: "Here are a couple of patches to fix bugs syzbot found in the pipe changes: - An assertion check will sometimes trip when polling a pipe because the ring size and indices used are approximate and may be being changed simultaneously. An equivalent approximate calculation was done previously, but without the assertion check, so I've just dropped the check. To make it accurate, the pipe mutex would need to be taken or the spin lock could be used - but usage of the spinlock would need to be rolled out into splice, iov_iter and other places for that. - The index mask and the max_usage values cannot be cached across pipe_wait() as F_SETPIPE_SZ could have been called during the wait. This can cause pipe_write() to break" * pipe-rework: pipe: Fix missing mask update after pipe_wait() pipe: Remove assertion from pipe_poll() commit 8f868d68d335a17923dffb6858f8e9b656424699 Author: David Howells Date: Thu Dec 5 22:30:37 2019 +0000 pipe: Fix missing mask update after pipe_wait() Fix pipe_write() to not cache the ring index mask and max_usage as their values are invalidated by calling pipe_wait() because the latter function drops the pipe lock, thereby allowing F_SETPIPE_SZ change them. Without this, pipe_write() may subsequently miscalculate the array indices and pipe fullness, leading to an oops like the following: BUG: KASAN: slab-out-of-bounds in pipe_write+0xc25/0xe10 fs/pipe.c:481 Write of size 8 at addr ffff8880771167a8 by task syz-executor.3/7987 ... CPU: 1 PID: 7987 Comm: syz-executor.3 Not tainted 5.4.0-rc2-syzkaller #0 ... Call Trace: pipe_write+0xc25/0xe10 fs/pipe.c:481 call_write_iter include/linux/fs.h:1895 [inline] new_sync_write+0x3fd/0x7e0 fs/read_write.c:483 __vfs_write+0x94/0x110 fs/read_write.c:496 vfs_write+0x18a/0x520 fs/read_write.c:558 ksys_write+0x105/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:620 do_syscall_64+0xca/0x5d0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe This is not a problem for pipe_read() as the mask is recalculated on each pass of the loop, after pipe_wait() has been called. Fixes: 8cefc107ca54 ("pipe: Use head and tail pointers for the ring, not cursor and length") Reported-by: syzbot+838eb0878ffd51f27c41@syzkaller.appspotmail.com Signed-off-by: David Howells Cc: Eric Biggers [ Changed it to use a temporary variable 'mask' to avoid long lines -Linus ] Signed-off-by: Linus Torvalds commit 8c7b8c34ae952cc062c12d7db9ee2f298c09dca4 Author: David Howells Date: Thu Dec 5 22:30:30 2019 +0000 pipe: Remove assertion from pipe_poll() An assertion check was added to pipe_poll() to make sure that the ring occupancy isn't seen to overflow the ring size. However, since no locks are held when the three values are read, it is possible for F_SETPIPE_SZ to intervene and muck up the calculation, thereby causing the oops. Fix this by simply removing the assertion and accepting that the calculation might be approximate. Note that the previous code also had a similar issue, though there was no assertion check, since the occupancy counter and the ring size were not read with a lock held, so it's possible that the poll check might have malfunctioned then too. Also wake up all the waiters so that they can reissue their checks if there was a competing read or write. Fixes: 8cefc107ca54 ("pipe: Use head and tail pointers for the ring, not cursor and length") Reported-by: syzbot+d37abaade33a934f16f2@syzkaller.appspotmail.com Signed-off-by: David Howells cc: Eric Biggers Signed-off-by: Linus Torvalds commit e62dbcdb8cbcdc476175dc5a43ea7285c488fbbe Author: Yongqiang Sun Date: Mon Nov 18 13:45:50 2019 -0500 drm/amd/display: Compare clock state member to determine optimization. [Why] It seems always request passive flip on RN due to incorrect compare clock state to determine optization. [How] Instead of calling memcmp, compare clock state member to determine the condition. Signed-off-by: Yongqiang Sun Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher commit 7a02d2985f41539ad2196775085d05f98f4a6040 Author: Alex Deucher Date: Thu Dec 5 16:38:01 2019 -0500 drm/amdgpu/display: add fallthrough comment To avoid a compiler warning. Reviewed-by: Zhan Liu Signed-off-by: Alex Deucher commit 0df62823630d03d58f6eedb99fab285f847e4a1b Author: George Shen Date: Fri Nov 15 18:56:57 2019 -0500 drm/amd/display: Increase the number of retries after AUX DEFER [Why] When a timeout occurs after a DEFER, some devices require more retries than in the case of a regular timeout. [How] In a timeout occurrence, check whether a DEFER has occurred before the timeout and retry MAX_DEFER_RETRIES retries times instead of MAX_TIMEOUT_RETRIES. Signed-off-by: George Shen Reviewed-by: Tony Cheng Acked-by: Abdoulaye Berthe Acked-by: Leo Li Signed-off-by: Alex Deucher commit 44ce6c3dc8479bb3ed68df13b502b0901675e7d6 Author: Eric Yang Date: Fri Nov 15 12:04:25 2019 -0500 drm/amd/display: update dispclk and dppclk vco frequency Value obtained from DV is not allowing 8k60 CTA mode with DSC to pass, after checking real value being used in hw, find out that correct value is 3600, which will allow that mode. Signed-off-by: Eric Yang Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher commit dd0b162fd00915728860a360c97752988782b8cc Author: Amanda Liu Date: Fri Nov 15 17:07:27 2019 -0500 drm/amd/display: Fix screen tearing on vrr tests [Why] Screen tearing is present in tests when setting the frame rate to certain fps [How] Revert previous optimizations for low frame rates. Signed-off-by: Amanda Liu Reviewed-by: Aric Cyr Acked-by: Leo Li Signed-off-by: Alex Deucher commit 87de6cb2f28153bc74d0a001ca099c29453e145f Author: Nikola Cornij Date: Mon Nov 11 18:03:59 2019 -0500 drm/amd/display: Reset steer fifo before unblanking the stream [why] During mode transition steer fifo could overflow. Quite often it recovers by itself, but sometimes it doesn't. [how] Add steer fifo reset before unblanking the stream. Also add a short delay when resetting dig resync fifo to make sure register writes don't end up back-to-back, in which case the HW might miss the reset request. Signed-off-by: Nikola Cornij Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher commit a2a1f1eb06d73a45a60970c77403687918966fc6 Author: Brandon Syu Date: Fri Nov 8 11:26:06 2019 +0800 drm/amd/display: fixed that I2C over AUX didn't read data issue [Why] The variable mismatch assignment error. [How] To use uint32_t replace it. Signed-off-by: Brandon Syu Reviewed-by: Charlene Liu Acked-by: Leo Li Signed-off-by: Alex Deucher commit 28fa24ad14e8f7d23c62283eaf9c79b4fd165c16 Author: Leo (Hanghong) Ma Date: Thu Nov 7 16:30:04 2019 -0500 drm/amd/display: Change the delay time before enabling FEC [why] DP spec requires 1000 symbols delay between the end of link training and enabling FEC in the stream. Currently we are using 1 miliseconds delay which is not accurate. [how] One lane RBR should have the maximum time for transmitting 1000 LL codes which is 6.173 us. So using 7 microseconds delay instead of 1 miliseconds. Signed-off-by: Leo (Hanghong) Ma Reviewed-by: Harry Wentland Reviewed-by: Nikola Cornij Acked-by: Leo Li Signed-off-by: Alex Deucher commit 10bce710fa6feb13ec270d5420aad3b81f6bf7ea Author: Joseph Gravenor Date: Fri Nov 8 14:30:34 2019 -0500 drm/amd/display: have two different sr and pstate latency tables for renoir [Why] new sr and pstate latencies are optimized for the case when we are not using lpddr4 memory [How] have two different wm tables, one for the lpddr case and one for non lpddr case Signed-off-by: Joseph Gravenor Reviewed-by: Eric Yang Acked-by: Leo Li Signed-off-by: Alex Deucher commit a51d9f8fe756beac51ce26ef54195da00a260d13 Author: David Galiffi Date: Thu Nov 7 17:18:20 2019 -0500 drm/amd/display: Fixed kernel panic when booting with DP-to-HDMI dongle [Why] In dc_link_is_dp_sink_present, if dal_ddc_open fails, then dal_gpio_destroy_ddc is called, destroying pin_data and pin_clock. They are created only on dc_construct, and next aux access will cause a panic. [How] Instead of calling dal_gpio_destroy_ddc, call dal_ddc_close. Signed-off-by: David Galiffi Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher commit 1653acd566a846647adc293209f823b3e552e974 Author: Joseph Gravenor Date: Thu Nov 7 19:20:00 2019 -0500 drm/amd/display: populate bios integrated info for renoir [Why] When video_memory_type bw_params->vram_type is assigned, wedistinguish between Ddr4MemType and LpDdr4MemType. Because of this we will never report that we are using LpDdr4MemType and never re-purpose WM set D [How] populate bios integrated info for renoir by adding the revision number for renoir and use that integrated info table instead of of asic_id to get the vram type Signed-off-by: Joseph Gravenor Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher commit aa4febf5098572649846b4f28a2609233388c412 Author: Joseph Gravenor Date: Mon Nov 4 16:39:35 2019 -0500 drm/amd/display: fix DalDramClockChangeLatencyNs override [why] pstate_latency_us never gets updated from the hard coded value in rn_clk_mgr.c [how] update the wm table's values before we do calculations with them Signed-off-by: Joseph Gravenor Reviewed-by: Eric Yang Acked-by: Leo Li Signed-off-by: Alex Deucher commit a1fc44b609b4e9c0941f0e4a1fc69d367af5ab69 Author: Nikola Cornij Date: Thu Nov 7 13:06:48 2019 -0500 drm/amd/display: Map DSC resources 1-to-1 if numbers of OPPs and DSCs are equal [why] On ASICs where number of DSCs is the same as OPPs there's no need for DSC resource management. Mappping 1-to-1 fixes mode-set- or S3- -related issues for such platforms. [how] Map DSC resources 1-to-1 to pipes only if number of OPPs is the same as number of DSCs. This will still keep other ASICs working. A follow-up patch to fix mode-set issues on those ASICs will be required if testing shows issues with mode set. Signed-off-by: Nikola Cornij Reviewed-by: Dmytro Laktyushkin Acked-by: Leo Li Signed-off-by: Alex Deucher commit 9d9de889ff8eb941e4daefff610e170386b61962 Author: Eric Yang Date: Tue Nov 5 11:59:38 2019 -0500 drm/amd/display: update sr and pstate latencies for Renoir [Why] DF team has produced more optimized latency numbers. [How] Add sr latencies to the wm table, use different latencies for different wm sets. Also fix bb override from registery key for these latencies. Signed-off-by: Eric Yang Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher commit bf26da927a1cd57c9deb2db29ae8cf276ba8b17b Author: Pierre-Eric Pelloux-Prayer Date: Thu Nov 28 12:08:58 2019 +0100 drm/amdgpu: add cache flush workaround to gfx8 emit_fence The same workaround is used for gfx7. Both PAL and Mesa use it for gfx8 too, so port this commit to gfx_v8_0_ring_emit_fence_gfx. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 14891c316ca7e15d81dba78f30fb630e3f9ee2c9 Author: Alex Deucher Date: Wed Dec 4 22:07:49 2019 -0500 drm/amdgpu: add header line for power profile on Arcturus So the output is consistent with other asics. Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 6e807535dae5dbbd53bcc5e81047a20bf5eb08ea Author: Guchun Chen Date: Wed Dec 4 15:51:16 2019 +0800 drm/amdgpu: add check before enabling/disabling broadcast mode When security violation from new vbios happens, data fabric is risky to stop working. So prevent the direct access to DF mmFabricConfigAccessControl from the new vbios and onwards. Signed-off-by: Guchun Chen Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 0033b34a03ec5cf747cdaf9b1f9dceb91c020f17 Author: Eric Biggers Date: Wed Dec 4 21:54:19 2019 -0800 ppp: fix out-of-bounds access in bpf_prog_create() sock_fprog_kern::len is in units of struct sock_filter, not bytes. Fixes: 3e859adf3643 ("compat_ioctl: unify copy-in of ppp filters") Reported-by: syzbot+eb853b51b10f1befa0b7@syzkaller.appspotmail.com Signed-off-by: Eric Biggers Reviewed-by: Arnd Bergmann Signed-off-by: David S. Miller commit a116f4e238cc20dfbac30c65949752798f5b6efa Merge: aacf6578ef77 1c9855085eba Author: David S. Miller Date: Thu Dec 5 14:42:43 2019 -0800 Merge branch 'hns3-fixes' Huazhong Tan says: ==================== net: hns3: fixes for -net This patchset includes misc fixes for the HNS3 ethernet driver. [patch 1/3] fixes a TX queue not restarted problem. [patch 2/3] fixes a use-after-free issue. [patch 3/3] fixes a VF ID issue for setting VF VLAN. change log: V1->V2: keeps 'ring' as parameter in hns3_nic_maybe_stop_tx() in [patch 1/3], suggestted by David. rewrites [patch 2/3]'s commit log to make it be easier to understand, suggestted by David. ==================== Signed-off-by: David S. Miller commit 1c9855085ebaaa2efcf368bee038e4811015abbd Author: Jian Shen Date: Thu Dec 5 10:12:29 2019 +0800 net: hns3: fix VF ID issue for setting VF VLAN Previously, when set VF VLAN with command "ip link set vf vlan ", the VF ID 0 is handled as PF incorrectly, which should be the first VF. This patch fixes it. Fixes: 21e043cd8124 ("net: hns3: fix set port based VLAN for PF") Signed-off-by: Jian Shen Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit d1a37dedcfcf2c01daff5281c3c378876a04e2f4 Author: Yunsheng Lin Date: Thu Dec 5 10:12:28 2019 +0800 net: hns3: fix a use after free problem in hns3_nic_maybe_stop_tx() Currently, hns3_nic_maybe_stop_tx() uses skb_copy() to linearize a SKB if the BD num required by the SKB does not meet the hardware limitation, and it linearizes the SKB by allocating a new linearized SKB and freeing the old SKB, if hns3_nic_maybe_stop_tx() returns -EBUSY because there are no enough space in the ring to send the linearized skb to hardware, the sch_direct_xmit() still hold reference to old SKB and try to retransmit the old SKB when dev_hard_start_xmit() return TX_BUSY, which may cause use after freed problem. This patch fixes it by using __skb_linearize() to linearize the SKB in hns3_nic_maybe_stop_tx(). Fixes: 51e8439f3496 ("net: hns3: add 8 BD limit for tx flow") Signed-off-by: Yunsheng Lin Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 2a597eff2437d21841a1e87ffa536ab69dbffdcf Author: Yunsheng Lin Date: Thu Dec 5 10:12:27 2019 +0800 net: hns3: fix for TX queue not restarted problem There is timing window between ring_space checking and netif_stop_subqueue when transmiting a SKB, and the TX BD cleaning may be executed during the time window, which may caused TX queue not restarted problem. This patch fixes it by rechecking the ring_space after netif_stop_subqueue to make sure TX queue is restarted. Also, the ring->next_to_clean is updated even when pkts is zero, because all the TX BD cleaned may be non-SKB, so it needs to check if TX queue need to be restarted. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Yunsheng Lin Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit aacf6578ef7704d8df252bbc146b1a35ca131248 Author: Grygorii Strashko Date: Wed Dec 4 19:45:32 2019 +0200 net: ethernet: ti: cpsw_switchdev: fix unmet direct dependencies detected for NET_SWITCHDEV Replace "select NET_SWITCHDEV" vs "depends on NET_SWITCHDEV" to fix Kconfig warning with CONFIG_COMPILE_TEST=y WARNING: unmet direct dependencies detected for NET_SWITCHDEV Depends on [n]: NET [=y] && INET [=n] Selected by [y]: - TI_CPSW_SWITCHDEV [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_TI [=y] && (ARCH_DAVINCI || ARCH_OMAP2PLUS || COMPILE_TEST [=y]) because TI_CPSW_SWITCHDEV blindly selects NET_SWITCHDEV even though INET is not set/enabled, while NET_SWITCHDEV depends on INET. Reported-by: Randy Dunlap Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac") Signed-off-by: Grygorii Strashko Acked-by: Randy Dunlap # build-tested Signed-off-by: David S. Miller commit ecda7c0280e6b3398459dc589b9a41c1adb45529 Author: Nikos Tsironis Date: Wed Dec 4 16:07:41 2019 +0200 dm thin metadata: Add support for a pre-commit callback Add support for one pre-commit callback which is run right before the metadata are committed. This allows the thin provisioning target to run a callback before the metadata are committed and is required by the next commit. Cc: stable@vger.kernel.org Signed-off-by: Nikos Tsironis Acked-by: Joe Thornber Signed-off-by: Mike Snitzer commit 8b3fd1f53af3591d5624ab9df718369b14d09ed1 Author: Nikos Tsironis Date: Wed Dec 4 16:06:54 2019 +0200 dm clone: Flush destination device before committing metadata dm-clone maintains an on-disk bitmap which records which regions are valid in the destination device, i.e., which regions have already been hydrated, or have been written to directly, via user I/O. Setting a bit in the on-disk bitmap meas the corresponding region is valid in the destination device and we redirect all I/O regarding it to the destination device. Suppose the destination device has a volatile write-back cache and the following sequence of events occur: 1. A region gets hydrated, either through the background hydration or because it was written to directly, via user I/O. 2. The commit timeout expires and we commit the metadata, marking that region as valid in the destination device. 3. The system crashes and the destination device's cache has not been flushed, meaning the region's data are lost. The next time we read that region we read it from the destination device, since the metadata have been successfully committed, but the data are lost due to the crash, so we read garbage instead of the old data. This has several implications: 1. In case of background hydration or of writes with size smaller than the region size (which means we first copy the whole region and then issue the smaller write), we corrupt data that the user never touched. 2. In case of writes with size equal to the device's logical block size, we fail to provide atomic sector writes. When the system recovers the user will read garbage from the sector instead of the old data or the new data. 3. In case of writes without the FUA flag set, after the system recovers, the written sectors will contain garbage instead of a random mix of sectors containing either old data or new data, thus we fail again to provide atomic sector writes. 4. Even when the user flushes the dm-clone device, because we first commit the metadata and then pass down the flush, the same risk for corruption exists (if the system crashes after the metadata have been committed but before the flush is passed down). The only case which is unaffected is that of writes with size equal to the region size and with the FUA flag set. But, because FUA writes trigger metadata commits, this case can trigger the corruption indirectly. To solve this and avoid the potential data corruption we flush the destination device **before** committing the metadata. This ensures that any freshly hydrated regions, for which we commit the metadata, are properly written to non-volatile storage and won't be lost in case of a crash. Fixes: 7431b7835f55 ("dm: add clone target") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Nikos Tsironis Signed-off-by: Mike Snitzer commit 30b10c77837ceec77bc7bc81e60db94e5b0ddbbc Author: Olof Johansson Date: Thu Dec 5 13:14:37 2019 -0800 ARM: defconfig: re-run savedefconfig on multi_v* configs This is mostly to reorder the entries as they've moved in the Kconfig hierarchies. Doing this periodically (but not very often) simplifies conflict resolution for new options, etc. Link: https://lore.kernel.org/r/20191205211438.27552-2-olof@lixom.net Signed-off-by: Olof Johansson commit f693ff65c36e07a63e31995448d3ce0579048fda Author: Olof Johansson Date: Thu Dec 5 13:14:38 2019 -0800 arm64: defconfig: re-run savedefconfig This is mostly to reorder the entries as they've moved in the Kconfig hierarchies. Doing this periodically (but not very often) simplifies conflict resolution for new options, etc. Link: https://lore.kernel.org/r/20191205211438.27552-3-olof@lixom.net Signed-off-by: Olof Johansson commit 3f1266ec704d3efcfc8179c71bed9a75963b6344 Merge: a231582359ec ade48088937f Author: Linus Torvalds Date: Thu Dec 5 13:20:11 2019 -0800 Merge tag 'gfs2-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull GFS2 updates from Andreas Gruenbacher: "Bob's extensive filesystem withdrawal and recovery testing: - don't write log headers after file system withdraw - clean up iopen glock mess in gfs2_create_inode - close timing window with GLF_INVALIDATE_IN_PROGRESS - abort gfs2_freeze if io error is seen - don't loop forever in gfs2_freeze if withdrawn - fix infinite loop in gfs2_ail1_flush on io error - introduce function gfs2_withdrawn - fix glock reference problem in gfs2_trans_remove_revoke Filesystems with a block size smaller than the page size: - fix end-of-file handling in gfs2_page_mkwrite - improve mmap write vs. punch_hole consistency Other: - remove active journal side effect from gfs2_write_log_header - multi-block allocations in gfs2_page_mkwrite Minor cleanups and coding style fixes: - remove duplicate call from gfs2_create_inode - make gfs2_log_shutdown static - make gfs2_fs_parameters static - some whitespace cleanups - removed unnecessary semicolon" * tag 'gfs2-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Don't write log headers after file system withdraw gfs2: Remove duplicate call from gfs2_create_inode gfs2: clean up iopen glock mess in gfs2_create_inode gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS gfs2: Abort gfs2_freeze if io error is seen gfs2: Don't loop forever in gfs2_freeze if withdrawn gfs2: fix infinite loop in gfs2_ail1_flush on io error gfs2: Introduce function gfs2_withdrawn gfs2: fix glock reference problem in gfs2_trans_remove_revoke gfs2: make gfs2_log_shutdown static gfs2: Remove active journal side effect from gfs2_write_log_header gfs2: Fix end-of-file handling in gfs2_page_mkwrite gfs2: Multi-block allocations in gfs2_page_mkwrite gfs2: Improve mmap write vs. punch_hole consistency gfs2: make gfs2_fs_parameters static gfs2: Some whitespace cleanups gfs2: removed unnecessary semicolon commit 942e6f8a8314e5550e254519dfba4ccd5170421d Merge: 336bab731be7 b08baef02b26 Author: Olof Johansson Date: Thu Dec 5 13:16:58 2019 -0800 Merge mainline/master into arm/fixes This brings in the mainline tree right after armsoc contents was merged this release cycle, so that we can re-run savedefconfig, etc. Signed-off-by: Olof Johansson commit a231582359ec27e121bf4bb0ab3df8355f919d1d Merge: 7ce4fab81913 82995cc6c5ae Author: Linus Torvalds Date: Thu Dec 5 13:06:51 2019 -0800 Merge tag 'ceph-for-5.5-rc1' of git://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "The two highlights are a set of improvements to how rbd read-only mappings are handled and a conversion to the new mount API (slightly complicated by the fact that we had a common option parsing framework that called out into rbd and the filesystem instead of them calling into it). Also included a few scattered fixes and a MAINTAINERS update for rbd, adding Dongsheng as a reviewer" * tag 'ceph-for-5.5-rc1' of git://github.com/ceph/ceph-client: libceph, rbd, ceph: convert to use the new mount API rbd: ask for a weaker incompat mask for read-only mappings rbd: don't query snapshot features rbd: remove snapshot existence validation code rbd: don't establish watch for read-only mappings rbd: don't acquire exclusive lock for read-only mappings rbd: disallow read-write partitions on images mapped read-only rbd: treat images mapped read-only seriously rbd: introduce RBD_DEV_FLAG_READONLY rbd: introduce rbd_is_snap() ceph: don't leave ino field in ceph_mds_request_head uninitialized ceph: tone down loglevel on ceph_mdsc_build_path warning rbd: update MAINTAINERS info ceph: fix geting random mds from mdsmap rbd: fix spelling mistake "requeueing" -> "requeuing" ceph: make several helper accessors take const pointers libceph: drop unnecessary check from dispatch() in mon_client.c commit b7826076d7ae5928fdd2972a6c3e180148fb74c1 Author: Parav Pandit Date: Tue Nov 12 17:06:00 2019 -0600 net/mlx5e: E-switch, Fix Ingress ACL groups in switchdev mode for prio tag In cited commit, when prio tag mode is enabled, FTE creation fails due to missing group with valid match criteria. Hence, (a) create prio tag group metadata_prio_tag_grp when prio tag is enabled with match criteria for vlan push FTE. (b) Rename metadata_grp to metadata_allmatch_grp to reflect its purpose. Also when priority tag is enabled, delete metadata settings after deleting ingress rules, which are using it. Tide up rest of the ingress config code for unnecessary labels. Fixes: 10652f39943e ("net/mlx5: Refactor ingress acl configuration") Signed-off-by: Parav Pandit Reviewed-by: Eli Britstein Signed-off-by: Saeed Mahameed commit 3d7cadae51f1b7f28358e36d0a1ce3f0ae2eee60 Author: Aya Levin Date: Sun Dec 1 16:33:55 2019 +0200 net/mlx5e: ethtool, Fix analysis of speed setting When setting speed to 100G via ethtool (AN is set to off), only 25G*4 is configured while the user, who has an advanced HW which supports extended PTYS, expects also 50G*2 to be configured. With this patch, when extended PTYS mode is available, configure PTYS via extended fields. Fixes: 4b95840a6ced ("net/mlx5e: Fix matching of speed to PRM link modes") Signed-off-by: Aya Levin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 6d485e5e555436d2c13accdb10807328c4158a17 Author: Aya Levin Date: Sun Dec 1 14:45:25 2019 +0200 net/mlx5e: Fix translation of link mode into speed Add a missing value in translation of PTYS ext_eth_proto_oper to its corresponding speed. When ext_eth_proto_oper bit 10 is set, ethtool shows unknown speed. With this fix, ethtool shows speed is 100G as expected. Fixes: a08b4ed1373d ("net/mlx5: Add support to ext_* fields introduced in Port Type and Speed register") Signed-off-by: Aya Levin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit eb252c3a24fc5856fa62140c2f8269ddce6ce4e5 Author: Roi Dayan Date: Mon Dec 2 19:19:47 2019 +0200 net/mlx5e: Fix free peer_flow when refcount is 0 It could be neigh update flow took a refcount on peer flow so sometimes we cannot release peer flow even if parent flow is being freed now. Fixes: 5a7e5bcb663d ("net/mlx5e: Extend tc flow struct with reference counter") Signed-off-by: Roi Dayan Reviewed-by: Eli Britstein Signed-off-by: Saeed Mahameed commit a23dae79fb6555c808528707c6389345d0b0c189 Author: Roi Dayan Date: Wed Dec 4 11:25:43 2019 +0200 net/mlx5e: Fix freeing flow with kfree() and not kvfree() Flows are allocated with kzalloc() so free with kfree(). Fixes: 04de7dda7394 ("net/mlx5e: Infrastructure for duplicated offloading of TC flows") Signed-off-by: Roi Dayan Reviewed-by: Eli Britstein Signed-off-by: Saeed Mahameed commit c431f8597863a91eea6024926e0c1b179cfa4852 Author: Eran Ben Elisha Date: Thu Dec 5 10:30:22 2019 +0200 net/mlx5e: Fix SFF 8472 eeprom length SFF 8472 eeprom length is 512 bytes. Fix module info return value to support 512 bytes read. Fixes: ace329f4ab3b ("net/mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query") Signed-off-by: Eran Ben Elisha Reviewed-by: Aya Levin Signed-off-by: Saeed Mahameed commit 73e6551699a32fac703ceea09214d6580edcf2d5 Author: Huy Nguyen Date: Fri Sep 6 09:28:46 2019 -0500 net/mlx5e: Query global pause state before setting prio2buffer When the user changes prio2buffer mapping while global pause is enabled, mlx5 driver incorrectly sets all active buffers (buffer that has at least one priority mapped) to lossy. Solution: If global pause is enabled, set all the active buffers to lossless in prio2buffer command. Also, add error message when buffer size is not enough to meet xoff threshold. Fixes: 0696d60853d5 ("net/mlx5e: Receive buffer configuration") Signed-off-by: Huy Nguyen Signed-off-by: Saeed Mahameed commit c55d8b108caa2ec1ae8dddd02cb9d3a740f7c838 Author: Eran Ben Elisha Date: Mon Nov 25 12:11:49 2019 +0200 net/mlx5e: Fix TXQ indices to be sequential Cited patch changed (channel index, tc) => (TXQ index) mapping to be a static one, in order to keep indices consistent when changing number of channels or TCs. For 32 channels (OOB) and 8 TCs, real num of TXQs is 256. When reducing the amount of channels to 8, the real num of TXQs will be changed to 64. This indices method is buggy: - Channel #0, TC 3, the TXQ index is 96. - Index 8 is not valid, as there is no such TXQ from driver perspective (As it represents channel #8, TC 0, which is not valid with the above configuration). As part of driver's select queue, it calls netdev_pick_tx which returns an index in the range of real number of TXQs. Depends on the return value, with the examples above, driver could have returned index larger than the real number of tx queues, or crash the kernel as it tries to read invalid address of SQ which was not allocated. Fix that by allocating sequential TXQ indices, and hold a new mapping between (channel index, tc) => (real TXQ index). This mapping will be updated as part of priv channels activation, and is used in mlx5e_select_queue to find the selected queue index. The existing indices mapping (channel_tc2txq) is no longer needed, as it is used only for statistics structures and can be calculated on run time. Delete its definintion and updates. Fixes: 8bfaf07f7806 ("net/mlx5e: Present SW stats when state is not opened") Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 7ce4fab8191396a1b8e4bc42d3b90029876b2bcd Merge: 0f137416247f 8d66fcb74884 Author: Linus Torvalds Date: Thu Dec 5 12:44:22 2019 -0800 Merge tag 'fuse-update-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse update from Miklos Szeredi: - Fix a regression introduced in the last release - Fix a number of issues with validating data coming from userspace - Some cleanups in virtiofs * tag 'fuse-update-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: fix Kconfig indentation fuse: fix leak of fuse_io_priv virtiofs: Use completions while waiting for queue to be drained virtiofs: Do not send forget request "struct list_head" element virtiofs: Use a common function to send forget virtiofs: Fix old-style declaration fuse: verify nlink fuse: verify write return fuse: verify attributes commit 8fdbfe8d1690e8a38d497d83a30607d0d90cc15a Author: Nikos Tsironis Date: Wed Dec 4 16:06:53 2019 +0200 dm clone metadata: Use a two phase commit Split the metadata commit in two parts: 1. dm_clone_metadata_pre_commit(): Prepare the current transaction for committing. After this is called, all subsequent metadata updates, done through either dm_clone_set_region_hydrated() or dm_clone_cond_set_range(), will be part of the next transaction. 2. dm_clone_metadata_commit(): Actually commit the current transaction to disk and start a new transaction. This is required by the following commit. It allows dm-clone to flush the destination device after step (1) to ensure that all freshly hydrated regions, for which we are updating the metadata, are properly written to non-volatile storage and won't be lost in case of a crash. Fixes: 7431b7835f55 ("dm: add clone target") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Nikos Tsironis Signed-off-by: Mike Snitzer commit e6a505f3f9fae572fb3ab3bc486e755ac9cef32c Author: Nikos Tsironis Date: Wed Dec 4 16:06:52 2019 +0200 dm clone metadata: Track exact changes per transaction Extend struct dirty_map with a second bitmap which tracks the exact regions that were hydrated during the current metadata transaction. Moreover, fix __flush_dmap() to only commit the metadata of the regions that were hydrated during the current transaction. This is required by the following commits to fix a data corruption bug. Fixes: 7431b7835f55 ("dm: add clone target") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Nikos Tsironis Signed-off-by: Mike Snitzer commit 474e559567fa631dea8fb8407ab1b6090c903755 Author: Hou Tao Date: Tue Dec 3 19:42:58 2019 +0800 dm btree: increase rebalance threshold in __rebalance2() We got the following warnings from thin_check during thin-pool setup: $ thin_check /dev/vdb examining superblock examining devices tree missing devices: [1, 84] too few entries in btree_node: 41, expected at least 42 (block 138, max_entries = 126) examining mapping tree The phenomenon is the number of entries in one node of details_info tree is less than (max_entries / 3). And it can be easily reproduced by the following procedures: $ new a thin pool $ presume the max entries of details_info tree is 126 $ new 127 thin devices (e.g. 1~127) to make the root node being full and then split $ remove the first 43 (e.g. 1~43) thin devices to make the children reblance repeatedly $ stop the thin pool $ thin_check The root cause is that the B-tree removal procedure in __rebalance2() doesn't guarantee the invariance: the minimal number of entries in non-root node should be >= (max_entries / 3). Simply fix the problem by increasing the rebalance threshold to make sure the number of entries in each child will be greater than or equal to (max_entries / 3 + 1), so no matter which child is used for removal, the number will still be valid. Cc: stable@vger.kernel.org Signed-off-by: Hou Tao Acked-by: Joe Thornber Signed-off-by: Mike Snitzer commit 0f137416247fe92c0779a9ab49e912a7006869e8 Merge: 25cfb0c7de3f 5d603311615f Author: Linus Torvalds Date: Thu Dec 5 12:27:16 2019 -0800 Merge tag 'modules-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull modules updates from Jessica Yu: "Summary of modules changes for the 5.5 merge window: - Refactor include/linux/export.h and remove code duplication between EXPORT_SYMBOL and EXPORT_SYMBOL_NS to make it more readable. The most notable change is that no namespace is represented by an empty string "" rather than NULL. - Fix a module load/unload race where waiter(s) trying to load the same module weren't being woken up when a module finally goes away" * tag 'modules-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: kernel/module.c: wakeup processes in module_wq on module unload moduleparam: fix parameter description mismatch export: avoid code duplication in include/linux/export.h commit b87440526324d253a9dc4c043d84d7c1b4df0614 Merge: a350d2e7adbb f9e50b02a99c Author: David S. Miller Date: Thu Dec 5 12:25:05 2019 -0800 Merge branch 's390-fixes' Julian Wiedmann says: ==================== s390/qeth: fixes 2019-12-05 please apply the following fixes to your net tree. The first two patches target the RX data path, the third fixes a memory leak when shutting down a qeth device. ==================== Signed-off-by: David S. Miller commit f9e50b02a99c3ebbaa30690e8d5be28a5c2624eb Author: Julian Wiedmann Date: Thu Dec 5 14:33:04 2019 +0100 s390/qeth: fix dangling IO buffers after halt/clear The cio layer's intparm logic does not align itself well with how qeth manages cmd IOs. When an active IO gets terminated via halt/clear, the corresponding IRQ's intparm does not reflect the cmd buffer but rather the intparm that was passed to ccw_device_halt() / ccw_device_clear(). This behaviour was recently clarified in commit b91d9e67e50b ("s390/cio: fix intparm documentation"). As a result, qeth_irq() currently doesn't cancel a cmd that was terminated via halt/clear. This primarily causes us to leak card->read_cmd after the qeth device is removed, since our IO path still holds a refcount for this cmd. For qeth this means that we need to keep track of which IO is pending on a device ('active_cmd'), and use this as the intparm when calling halt/clear. Otherwise qeth_irq() can't match the subsequent IRQ to its cmd buffer. Since we now keep track of the _expected_ intparm, we can also detect any mismatch; this would constitute a bug somewhere in the lower layers. In this case cancel the active cmd - we effectively "lost" the IRQ and should not expect any further notification for this IO. Fixes: 405548959cc7 ("s390/qeth: add support for dynamically allocated cmds") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit f677fcb9aeb60c523ee36c1061ef2249b558d1b5 Author: Julian Wiedmann Date: Thu Dec 5 14:33:03 2019 +0100 s390/qeth: ensure linear access to packet headers When the RX path builds non-linear skbs, the packet headers can currently spill over into page fragments. Depending on the packet type and what fields we need to access in the headers, this could cause us to go past the end of skb->data. So for non-linear packets, copy precisely the length of the necessary headers ('linear_len') into skb->data. And don't copy more, upper-level protocols will peel whatever additional packet headers they need. Fixes: 4a71df50047f ("qeth: new qeth device driver") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 5b55633f20ee1bb253dc7d915ec2fd35fd865d5a Author: Julian Wiedmann Date: Thu Dec 5 14:33:02 2019 +0100 s390/qeth: guard against runt packets Depending on a packet's type, the RX path needs to access fields in the packet headers and thus requires a minimum packet length. Enforce this length when building the skb. On the other hand a single runt packet is no reason to drop the whole RX buffer. So just skip it, and continue processing on the next packet. Fixes: 4a71df50047f ("qeth: new qeth device driver") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 25cfb0c7de3f14e283a43dcd6de903657f9f98c7 Merge: b08baef02b26 3ad3cbe305b5 Author: Linus Torvalds Date: Thu Dec 5 12:20:42 2019 -0800 Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu update from Greg Ungerer: "Only a single change, to enable coldfire preemption entry code for all preemption types" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k/coldfire: Use CONFIG_PREEMPTION commit b08baef02b26cf7c2123e4a24a2fa1fb7a593ffb Merge: eb275167d186 a235f803dbc8 Author: Linus Torvalds Date: Thu Dec 5 12:14:19 2019 -0800 Merge tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC defconfig updates from Olof Johansson: "We keep this in a separate branch to avoid cross-branch conflicts, but most of the material here is fairly boring -- some new drivers turned on for hardware since they were merged, and some refreshed files due to time having moved a lot of entries around" * tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (36 commits) ARM: config: multi_v5: ASPEED SDHCI, SGPIO ARM: configs: multi_v7: ASPEED network, gpio, FSI ARM: config: aspeed-g4: Add MMC, and cleanup ARM: config: aspeed-g5: Add SGPIO and FSI drivers ARM: config: aspeed-g5: Enable 8250_DW quirks arm64: defconfig: Change CONFIG_AT803X_PHY from m to y ARM: shmobile: defconfig: Refresh for v5.4-rc1 arm64: defconfig: Enable R8A77961 SoC ARM: configs: sunxi: Enable MICREL_PHY arm64: defconfig: add new Allwinner crypto options ARM: configs: sunxi: add new Allwinner crypto options ARM: tegra: Enable Tegra VDE driver in tegra_defconfig ARM: imx_v6_v7_defconfig: Enable CONFIG_TOUCHSCREEN_DA9052 arm64: defconfig: Enable configs for S32V234 arm64: defconfig: Enable CONFIG_KEYBOARD_IMX_SC_KEY as module arm64: defconfig: Enable SMMU v3 PMCG arm64: defconfig: Enable HiSilicon ZIP controller arm64: defconfig: enable Altera GPIO controller ARM: multi_v7_defconfig: Enable audio support for stm32mp157 arm64: defconfig: enable rsu driver ... commit a350d2e7adbb57181d33e3aa6f0565632747feaa Author: Mian Yousaf Kaukab Date: Thu Dec 5 10:41:16 2019 +0100 net: thunderx: start phy before starting autonegotiation Since commit 2b3e88ea6528 ("net: phy: improve phy state checking") phy_start_aneg() expects phy state to be >= PHY_UP. Call phy_start() before calling phy_start_aneg() during probe so that autonegotiation is initiated. As phy_start() takes care of calling phy_start_aneg(), drop the explicit call to phy_start_aneg(). Network fails without this patch on Octeon TX. Fixes: 2b3e88ea6528 ("net: phy: improve phy state checking") Signed-off-by: Mian Yousaf Kaukab Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit eb275167d18684e07ee43bdc0e09a18326540461 Merge: ec939e4c94bd 5f1f15283419 Author: Linus Torvalds Date: Thu Dec 5 12:09:47 2019 -0800 Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM Device-tree updates from Olof Johansson: "As always, the bulk of updates. Some of the news this cycle: New SoC descriptions: - Broadcom BCM2711 - Amlogic Meson A1 and G12 - Freescale S32V234 - Marvell Armada AP807/AP807-quad and CP115 - Realtek RTD1293 and RTD1296 - Rockchip RK3308 New boards and platforms: - Allwinner: NanoPi Duo2 - Amlogic: Ugoos am6 - Atmel at91: Overkiz Kizbox2/4 - Broadcom: RPi4, Luxul XWC-2000 - Marvell: New Espressobin flavor - NXP: i.MX8MN LPDDR4 EVK, i.MX8QXP Colibri, S32V234 EVB, Netronix E60K02 and Kobo Clara HD, Kontron N6311 and N6411, OPOS6UL and OPOS6ULDev - Renesas: Salvator-XS - Rockchip: Beelink A1 (rk3308), rk3308 eval boards, rk3399-roc-pc" * tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (653 commits) ARM: dts: logicpd-torpedo: Disable USB Host arm: dts: mt6323: add keys, power-controller, rtc and codec arm64: dts: mt8183: add systimer0 device node dt-bindings: mediatek: update bindings for MT8183 systimer arm64: dts: rockchip: fix sdmmc detection on boot on rk3328-roc-cc arm64: dts: rockchip: Split rk3399-roc-pc for with and without mezzanine board. arm64: dts: rockchip: Add Beelink A1 dt-bindings: ARM: rockchip: Add Beelink A1 arm64: dts: rockchip: Add RK3328 audio pipelines arm64: dts: ti: k3-j721e-common-proc-board: Add USB ports arm64: dts: ti: k3-j721e-main: add USB controller nodes ARM: dts: aspeed-g6: Add timer description ARM: dts: aspeed: ast2600evb: Enable i2c buses ARM: dts: at91: add a dts and dtsi file for kizbox2 based boards dt-bindings: arm: at91: Document Kizbox2-2 board binding arm64: dts: meson-gx: fix i2c compatible arm64: dts: meson-gx: cec node should be disabled by default arm64: dts: meson-g12b-odroid-n2: add missing amlogic, s922x compatible arm64: dts: meson-gxm: fix gpu irq order arm64: dts: meson-g12a: fix gpu irq order ... commit df95467b6d2bfce49667ee4b71c67249b01957f7 Author: Taehee Yoo Date: Thu Dec 5 07:23:39 2019 +0000 hsr: fix a NULL pointer dereference in hsr_dev_xmit() hsr_dev_xmit() calls hsr_port_get_hsr() to find master node and that would return NULL if master node is not existing in the list. But hsr_dev_xmit() doesn't check return pointer so a NULL dereference could occur. Test commands: ip netns add nst ip link add veth0 type veth peer name veth1 ip link add veth2 type veth peer name veth3 ip link set veth1 netns nst ip link set veth3 netns nst ip link set veth0 up ip link set veth2 up ip link add hsr0 type hsr slave1 veth0 slave2 veth2 ip a a 192.168.100.1/24 dev hsr0 ip link set hsr0 up ip netns exec nst ip link set veth1 up ip netns exec nst ip link set veth3 up ip netns exec nst ip link add hsr1 type hsr slave1 veth1 slave2 veth3 ip netns exec nst ip a a 192.168.100.2/24 dev hsr1 ip netns exec nst ip link set hsr1 up hping3 192.168.100.2 -2 --flood & modprobe -rv hsr Splat looks like: [ 217.351122][ T1635] kasan: CONFIG_KASAN_INLINE enabled [ 217.352969][ T1635] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 217.354297][ T1635] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 217.355507][ T1635] CPU: 1 PID: 1635 Comm: hping3 Not tainted 5.4.0+ #192 [ 217.356472][ T1635] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 217.357804][ T1635] RIP: 0010:hsr_dev_xmit+0x34/0x90 [hsr] [ 217.373010][ T1635] Code: 48 8d be 00 0c 00 00 be 04 00 00 00 48 83 ec 08 e8 21 be ff ff 48 8d 78 10 48 ba 00 b [ 217.376919][ T1635] RSP: 0018:ffff8880cd8af058 EFLAGS: 00010202 [ 217.377571][ T1635] RAX: 0000000000000000 RBX: ffff8880acde6840 RCX: 0000000000000002 [ 217.379465][ T1635] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000010 [ 217.380274][ T1635] RBP: ffff8880acde6840 R08: ffffed101b440d5d R09: 0000000000000001 [ 217.381078][ T1635] R10: 0000000000000001 R11: ffffed101b440d5c R12: ffff8880bffcc000 [ 217.382023][ T1635] R13: ffff8880bffcc088 R14: 0000000000000000 R15: ffff8880ca675c00 [ 217.383094][ T1635] FS: 00007f060d9d1740(0000) GS:ffff8880da000000(0000) knlGS:0000000000000000 [ 217.384289][ T1635] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 217.385009][ T1635] CR2: 00007faf15381dd0 CR3: 00000000d523c001 CR4: 00000000000606e0 [ 217.385940][ T1635] Call Trace: [ 217.386544][ T1635] dev_hard_start_xmit+0x160/0x740 [ 217.387114][ T1635] __dev_queue_xmit+0x1961/0x2e10 [ 217.388118][ T1635] ? check_object+0xaf/0x260 [ 217.391466][ T1635] ? __alloc_skb+0xb9/0x500 [ 217.392017][ T1635] ? init_object+0x6b/0x80 [ 217.392629][ T1635] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 217.393175][ T1635] ? __alloc_skb+0xb9/0x500 [ 217.393727][ T1635] ? rcu_read_lock_sched_held+0x90/0xc0 [ 217.394331][ T1635] ? rcu_read_lock_bh_held+0xa0/0xa0 [ 217.395013][ T1635] ? kasan_unpoison_shadow+0x30/0x40 [ 217.395668][ T1635] ? __kasan_kmalloc.constprop.4+0xa0/0xd0 [ 217.396280][ T1635] ? __kmalloc_node_track_caller+0x3a8/0x3f0 [ 217.399007][ T1635] ? __kasan_kmalloc.constprop.4+0xa0/0xd0 [ 217.400093][ T1635] ? __kmalloc_reserve.isra.46+0x2e/0xb0 [ 217.401118][ T1635] ? memset+0x1f/0x40 [ 217.402529][ T1635] ? __alloc_skb+0x317/0x500 [ 217.404915][ T1635] ? arp_xmit+0xca/0x2c0 [ ... ] Fixes: 311633b60406 ("hsr: switch ->dellink() to ->ndo_uninit()") Acked-by: Cong Wang Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit ec939e4c94bd3ef2fd4f34c15f8aaf79bd0c5ee1 Merge: 38206c24ab09 3f6939aec712 Author: Linus Torvalds Date: Thu Dec 5 11:43:31 2019 -0800 Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC driver updates from Olof Johansson: "Various driver updates for platforms: - A larger set of work on Tegra 2/3 around memory controller and regulator features, some fuse cleanups, etc.. - MMP platform drivers, in particular for USB PHY, and other smaller additions. - Samsung Exynos 5422 driver for DMC (dynamic memory configuration), and ASV (adaptive voltage), allowing the platform to run at more optimal operating points. - Misc refactorings and support for RZ/G2N and R8A774B1 from Renesas - Clock/reset control driver for TI/OMAP - Meson-A1 reset controller support - Qualcomm sdm845 and sda845 SoC IDs for socinfo" * tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (150 commits) firmware: arm_scmi: Fix doorbell ring logic for !CONFIG_64BIT soc: fsl: add RCPM driver dt-bindings: fsl: rcpm: Add 'little-endian' and update Chassis definition memory: tegra: Consolidate registers definition into common header memory: tegra: Ensure timing control debug features are disabled memory: tegra: Introduce Tegra30 EMC driver memory: tegra: Do not handle error from wait_for_completion_timeout() memory: tegra: Increase handshake timeout on Tegra20 memory: tegra: Print a brief info message about EMC timings memory: tegra: Pre-configure debug register on Tegra20 memory: tegra: Include io.h instead of iopoll.h memory: tegra: Adapt for Tegra20 clock driver changes memory: tegra: Don't set EMC rate to maximum on probe for Tegra20 memory: tegra: Add gr2d and gr3d to DRM IOMMU group memory: tegra: Set DMA mask based on supported address bits soc: at91: Add Atmel SFR SN (Serial Number) support memory: atmel-ebi: switch to SPDX license identifiers memory: atmel-ebi: move NUM_CS definition inside EBI driver soc: mediatek: Refactor bus protection control soc: mediatek: Refactor sram control ... commit 38206c24ab09b4f4c2a57de5c1af0bb2e69cf5b6 Merge: d9e48dc2a71a ab818f0999dc Author: Linus Torvalds Date: Thu Dec 5 11:38:40 2019 -0800 Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC platform updates from Olof Johansson: "Most of these are for MMP (seeing a bunch of cleanups and refactorings for the first time in a while), and for OMAP (a bunch of cleanups and added support for voltage controller on OMAP4430)" * tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (51 commits) ARM: OMAP2+: Add missing put_device() call in omapdss_init_of() OMAP2: fixup doc comments in omap_device ARM: OMAP1: drop duplicated dependency on ARCH_OMAP1 ARM: ASPEED: update default ARCH_NR_GPIO for ARCH_ASPEED ARM: imx: use generic function to exit coherency ARM: tegra: Use WFE for power-gating on Tegra30 ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume() ARM: exynos: Enable exynos-asv driver for ARCH_EXYNOS ARM: s3c: Rename s5p_usb_phy functions ARM: s3c: Rename s3c64xx_spi_setname() function ARM: imx: Add serial number support for i.MX6/7 SoCs ARM: imx: Drop imx_anatop_usb_chrg_detect_disable() arm64: Introduce config for S32 ARM: hisi: drop useless depend on ARCH_MULTI_V7 arm64: realtek: Select reset controller ARM: shmobile: rcar-gen2: Drop legacy DT clock support ARM: OMAP2+: Remove duplicated include from pmic-cpcap.c ARM: OMAP1: ams-delta FIQ: Fix a typo ("Initiaize") MAINTAINERS: Add logicpd-som-lv and logicpd-torpedo to OMAP TREE ARM: OMAP2+: pdata-quirks: drop TI_ST/KIM support ... commit d9e48dc2a71a836f17d1febbedb31470f957edb4 Merge: fb3da48a8640 9e1b4999a169 Author: Linus Torvalds Date: Thu Dec 5 11:28:14 2019 -0800 Merge tag 'pwm/for-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "Various changes and minor fixes across a couple of drivers" * tag 'pwm/for-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: stm32: Pass breakinput instead of its values pwm: stm32: Remove clutter from ternary operator pwm: stm32: Validate breakinput data from DT pwm: Update comment on struct pwm_ops::apply pwm: sun4i: Fix incorrect calculation of duty_cycle/period pwm: stm32: Add power management support pwm: stm32: Split breakinput apply routine to ease PM support dt-bindings: pwm-stm32: Document pinctrl sleep state pwm: sun4i: Drop redundant assignment to variable pval dt-bindings: pwm: mediatek: Remove gratuitous compatible string for MT7629 commit fb3da48a8640f634242a0c61b78c3a5c724c5004 Merge: 5ecc9d15f73b 163b00cde7cf Author: Linus Torvalds Date: Thu Dec 5 11:21:24 2019 -0800 Merge branch 'thermal/next' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal management updates from Zhang Rui: - Fix a deadlock regression in thermal core framework, which was introduced in 5.3 (Wei Wang) - Initialize thermal control framework earlier to enable thermal mitigation during boot (Amit Kucheria) - Convert the Intelligent Power Allocator (IPA) thermal governor to follow the generic PM_EM instead of its own Energy Model (Quentin Perret) - Introduce a new Amlogic soc thermal driver (Guillaume La Roque) - Add interrupt support for tsens thermal driver (Amit Kucheria) - Add support for MSM8956/8976 in tsens thermal driver (AngeloGioacchino Del Regno) - Add support for r8a774b1 in rcar thermal driver (Biju Das) - Add support for Thermal Monitor Unit v2 in qoriq thermal driver (Yuantian Tang) - Some other fixes/cleanups on thermal core framework and soc thermal drivers (Colin Ian King, Daniel Lezcano, Hsin-Yi Wang, Tian Tao) * 'thermal/next' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (32 commits) thermal: Fix deadlock in thermal thermal_zone_device_check thermal: cpu_cooling: Migrate to using the EM framework thermal: cpu_cooling: Make the power-related code depend on IPA PM / EM: Declare EM data types unconditionally arm64: defconfig: Enable CONFIG_ENERGY_MODEL drivers: thermal: tsens: fix potential integer overflow on multiply thermal: cpu_cooling: Reorder the header file thermal: cpu_cooling: Remove pointless dependency on CONFIG_OF thermal: no need to set .owner when using module_platform_driver thermal: qcom: tsens-v1: Fix kfree of a non-pointer value cpufreq: qcom-hw: Move driver initialization earlier clk: qcom: Initialize clock drivers earlier cpufreq: Initialize cpufreq-dt driver earlier cpufreq: Initialize the governors in core_initcall thermal: Initialize thermal subsystem earlier thermal: Remove netlink support dt: thermal: tsens: Document compatible for MSM8976/56 thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976 MAINTAINERS: add entry for Amlogic Thermal driver thermal: amlogic: Add thermal driver to support G12 SoCs ... commit ece841abbed2da71fa10710c687c9ce9efb6bf69 Author: Justin Tee Date: Thu Dec 5 10:09:01 2019 +0800 block: fix memleak of bio integrity data 7c20f11680a4 ("bio-integrity: stop abusing bi_end_io") moves bio_integrity_free from bio_uninit() to bio_integrity_verify_fn() and bio_endio(). This way looks wrong because bio may be freed without calling bio_endio(), for example, blk_rq_unprep_clone() is called from dm_mq_queue_rq() when the underlying queue of dm-mpath is busy. So memory leak of bio integrity data is caused by commit 7c20f11680a4. Fixes this issue by re-adding bio_integrity_free() to bio_uninit(). Fixes: 7c20f11680a4 ("bio-integrity: stop abusing bi_end_io") Reviewed-by: Christoph Hellwig Signed-off-by Justin Tee Add commit log, and simplify/fix the original patch wroten by Justin. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 336bab731be76a90291697e51d2aed0ad67d7cb5 Author: Linus Walleij Date: Tue Dec 3 11:41:17 2019 +0100 ARM: pxa: Fix resource properties The conversion to properties changed one assignment and missed three other assignments in the same file, fix it up so the platform compiles. The bug was reported by a few build bots but noone noticed. I noticed it when making other changes to the PXA platforms. Link: https://lore.kernel.org/r/20191203104117.85517-1-linus.walleij@linaro.org Cc: Andy Shevchenko Fixes: 50ec88120ea1 ("can: mcp251x: get rid of legacy platform data") Signed-off-by: Linus Walleij Reviewed-by: Andy Shevchenko Signed-off-by: Olof Johansson commit 3c25ce694a1fbdb5b498fc8a6491074f48b47328 Merge: 563b75d74993 8305e90a894f Author: Olof Johansson Date: Thu Dec 5 10:11:49 2019 -0800 Merge tag 'scmi-fix-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes ARM SCMI fix for v5.5 Yet another single fix to avoid double freeing in scmi_device_create error path * tag 'scmi-fix-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Avoid double free in error flow firmware: arm_scmi: Fix doorbell ring logic for !CONFIG_64BIT Link: https://lore.kernel.org/r/20191202114559.GB20965@bogus Signed-off-by: Olof Johansson commit 563b75d7499308bfb44eaca64fd9ddcc073adb75 Merge: 680fb08720df 54fb3fe0f211 Author: Olof Johansson Date: Thu Dec 5 10:11:37 2019 -0800 Merge tag 'juno-fixes-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes ARMv8 Juno fixes for v5.5 Couple of fixes: 1. Fix for UART clock frequency on all Juno variants that exist since the platform was added. This is mainly due to incorrect Juno SoC TRM that was referred during initial development days 2. Drop "dma-ranges" property for now as they are triggering loads of warning on boot * tag 'juno-fixes-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: Revert "arm64: dts: juno: add dma-ranges property" arm64: dts: juno: Fix UART frequency arm64: dts: juno: add GPU subsystem Link: https://lore.kernel.org/r/20191202114338.GA20965@bogus Signed-off-by: Olof Johansson commit 680fb08720dfd1750ba5c7b76f1e3129c99af8e5 Merge: 47b6b604b2bf 6859ad379439 Author: Olof Johansson Date: Thu Dec 5 10:11:15 2019 -0800 Merge tag 'arm-soc/for-5.5/maintainers-part2' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains MAINTAINERS file updates for Broadcom SoCs, please pull the following: - Stefan and Eric step down from doing BCM283x maintenance and Nicolas replaces them both moving forward * tag 'arm-soc/for-5.5/maintainers-part2' of https://github.com/Broadcom/stblinux: MAINTAINERS: Make Nicolas Saenz Julienne the new bcm2835 maintainer Link: https://lore.kernel.org/r/20191127191932.9711-1-f.fainelli@gmail.com Signed-off-by: Olof Johansson commit 47b6b604b2bf396e110e7c2e074fef459bf07b4f Author: Bibby Hsieh Date: Wed Nov 27 17:54:28 2019 +0100 soc: mediatek: cmdq: fixup wrong input order of write api Fixup a issue was caused by the previous fixup patch. Fixes: 1a92f989126e ("soc: mediatek: cmdq: reorder the parameter") Link: https://lore.kernel.org/r/20191127165428.19662-1-matthias.bgg@gmail.com Cc: Signed-off-by: Bibby Hsieh Reviewed-by: CK Hu Signed-off-by: Matthias Brugger Signed-off-by: Olof Johansson commit a4e55ccd4392e70f296d12e81b93c6ca96ee21d5 Author: Luc Van Oostenryck Date: Thu Nov 21 15:48:51 2019 +1030 soc: aspeed: Fix snoop_file_poll()'s return type snoop_file_poll() is defined as returning 'unsigned int' but the .poll method is declared as returning '__poll_t', a bitwise type. Fix this by using the proper return type and using the EPOLL constants instead of the POLL ones, as required for __poll_t. Link: https://lore.kernel.org/r/20191121051851.268726-1-joel@jms.id.au Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev") Signed-off-by: Luc Van Oostenryck Reviewed-by: Joel Stanley Reviewed-by: Andrew Jeffery Signed-off-by: Joel Stanley Signed-off-by: Olof Johansson commit 17746b7af95ead9c4718eda4a441955a92eae97e Author: Robert Richter Date: Tue Nov 19 19:05:01 2019 +0000 MAINTAINERS: Switch to Marvell addresses Switch all addresses from @cavium.com to @marvell.com. On that occasion, switch also to my Marvell address for all my Cavium/Marvell entries. Link: https://lore.kernel.org/r/20191119190436.17875-3-rrichter@marvell.com Cc: Sunil Goutham Cc: George Cherian Cc: soc@kernel.org Signed-off-by: Robert Richter Signed-off-by: Olof Johansson commit c3c60656b0a39535d75f81275f3b8eb5436bdd95 Author: Jan Glauber Date: Tue Nov 19 19:04:59 2019 +0000 MAINTAINERS: update Cavium ThunderX drivers Remove my maintainer entries for ThunderX drivers as I'm moving on and won't have access to ThunderX hardware anymore and add Robert. Also remove the obsolete addresses of David Daney and Steven Hill. Add an entry to .mailmap for my various email addresses. Link: https://lore.kernel.org/r/20191119190436.17875-2-rrichter@marvell.com Cc: Ganapatrao Prabhakerrao Kulkarni Cc: soc@kernel.org Signed-off-by: Jan Glauber Signed-off-by: Robert Richter Signed-off-by: Olof Johansson commit 5ecc9d15f73b82c748526350d5602c94fdd65cac Merge: 2f13437b8917 f949286c668a Author: Linus Torvalds Date: Thu Dec 5 09:46:26 2019 -0800 Merge branch 'akpm' (patches from Andrew) Merge more updates from Andrew Morton: "Most of the rest of MM and various other things. Some Kconfig rework still awaits merges of dependent trees from linux-next. Subsystems affected by this patch series: mm/hotfixes, mm/memcg, mm/vmstat, mm/thp, procfs, sysctl, misc, notifiers, core-kernel, bitops, lib, checkpatch, epoll, binfmt, init, rapidio, uaccess, kcov, ubsan, ipc, bitmap, mm/pagemap" * akpm: (86 commits) mm: remove __ARCH_HAS_4LEVEL_HACK and include/asm-generic/4level-fixup.h um: add support for folded p4d page tables um: remove unused pxx_offset_proc() and addr_pte() functions sparc32: use pgtable-nopud instead of 4level-fixup parisc/hugetlb: use pgtable-nopXd instead of 4level-fixup parisc: use pgtable-nopXd instead of 4level-fixup nds32: use pgtable-nopmd instead of 4level-fixup microblaze: use pgtable-nopmd instead of 4level-fixup m68k: mm: use pgtable-nopXd instead of 4level-fixup m68k: nommu: use pgtable-nopud instead of 4level-fixup c6x: use pgtable-nopud instead of 4level-fixup arm: nommu: use pgtable-nopud instead of 4level-fixup alpha: use pgtable-nopud instead of 4level-fixup gpio: pca953x: tighten up indentation gpio: pca953x: convert to use bitmap API gpio: pca953x: use input from regs structure in pca953x_irq_pending() gpio: pca953x: remove redundant variable and check in IRQ handler lib/bitmap: introduce bitmap_replace() helper lib/test_bitmap: fix comment about this file lib/test_bitmap: move exp1 and exp2 upper for others to use ... commit c275779ff2dd51c96eaae04fac5d766421d6c596 Author: Zorro Lang Date: Wed Dec 4 22:59:02 2019 -0800 iomap: stop using ioend after it's been freed in iomap_finish_ioend() This patch fixes the following KASAN report. The @ioend has been freed by dio_put(), but the iomap_finish_ioend() still trys to access its data. [20563.631624] BUG: KASAN: use-after-free in iomap_finish_ioend+0x58c/0x5c0 [20563.638319] Read of size 8 at addr fffffc0c54a36928 by task kworker/123:2/22184 [20563.647107] CPU: 123 PID: 22184 Comm: kworker/123:2 Not tainted 5.4.0+ #1 [20563.653887] Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS L50_5.13_1.11 06/18/2019 [20563.664499] Workqueue: xfs-conv/sda5 xfs_end_io [xfs] [20563.669547] Call trace: [20563.671993] dump_backtrace+0x0/0x370 [20563.675648] show_stack+0x1c/0x28 [20563.678958] dump_stack+0x138/0x1b0 [20563.682455] print_address_description.isra.9+0x60/0x378 [20563.687759] __kasan_report+0x1a4/0x2a8 [20563.691587] kasan_report+0xc/0x18 [20563.694985] __asan_report_load8_noabort+0x18/0x20 [20563.699769] iomap_finish_ioend+0x58c/0x5c0 [20563.703944] iomap_finish_ioends+0x110/0x270 [20563.708396] xfs_end_ioend+0x168/0x598 [xfs] [20563.712823] xfs_end_io+0x1e0/0x2d0 [xfs] [20563.716834] process_one_work+0x7f0/0x1ac8 [20563.720922] worker_thread+0x334/0xae0 [20563.724664] kthread+0x2c4/0x348 [20563.727889] ret_from_fork+0x10/0x18 [20563.732941] Allocated by task 83403: [20563.736512] save_stack+0x24/0xb0 [20563.739820] __kasan_kmalloc.isra.9+0xc4/0xe0 [20563.744169] kasan_slab_alloc+0x14/0x20 [20563.747998] slab_post_alloc_hook+0x50/0xa8 [20563.752173] kmem_cache_alloc+0x154/0x330 [20563.756185] mempool_alloc_slab+0x20/0x28 [20563.760186] mempool_alloc+0xf4/0x2a8 [20563.763845] bio_alloc_bioset+0x2d0/0x448 [20563.767849] iomap_writepage_map+0x4b8/0x1740 [20563.772198] iomap_do_writepage+0x200/0x8d0 [20563.776380] write_cache_pages+0x8a4/0xed8 [20563.780469] iomap_writepages+0x4c/0xb0 [20563.784463] xfs_vm_writepages+0xf8/0x148 [xfs] [20563.788989] do_writepages+0xc8/0x218 [20563.792658] __writeback_single_inode+0x168/0x18f8 [20563.797441] writeback_sb_inodes+0x370/0xd30 [20563.801703] wb_writeback+0x2d4/0x1270 [20563.805446] wb_workfn+0x344/0x1178 [20563.808928] process_one_work+0x7f0/0x1ac8 [20563.813016] worker_thread+0x334/0xae0 [20563.816757] kthread+0x2c4/0x348 [20563.819979] ret_from_fork+0x10/0x18 [20563.825028] Freed by task 22184: [20563.828251] save_stack+0x24/0xb0 [20563.831559] __kasan_slab_free+0x10c/0x180 [20563.835648] kasan_slab_free+0x10/0x18 [20563.839389] slab_free_freelist_hook+0xb4/0x1c0 [20563.843912] kmem_cache_free+0x8c/0x3e8 [20563.847745] mempool_free_slab+0x20/0x28 [20563.851660] mempool_free+0xd4/0x2f8 [20563.855231] bio_free+0x33c/0x518 [20563.858537] bio_put+0xb8/0x100 [20563.861672] iomap_finish_ioend+0x168/0x5c0 [20563.865847] iomap_finish_ioends+0x110/0x270 [20563.870328] xfs_end_ioend+0x168/0x598 [xfs] [20563.874751] xfs_end_io+0x1e0/0x2d0 [xfs] [20563.878755] process_one_work+0x7f0/0x1ac8 [20563.882844] worker_thread+0x334/0xae0 [20563.886584] kthread+0x2c4/0x348 [20563.889804] ret_from_fork+0x10/0x18 [20563.894855] The buggy address belongs to the object at fffffc0c54a36900 which belongs to the cache bio-1 of size 248 [20563.906844] The buggy address is located 40 bytes inside of 248-byte region [fffffc0c54a36900, fffffc0c54a369f8) [20563.918485] The buggy address belongs to the page: [20563.923269] page:ffffffff82f528c0 refcount:1 mapcount:0 mapping:fffffc8e4ba31900 index:0xfffffc0c54a33300 [20563.932832] raw: 17ffff8000000200 ffffffffa3060100 0000000700000007 fffffc8e4ba31900 [20563.940567] raw: fffffc0c54a33300 0000000080aa0042 00000001ffffffff 0000000000000000 [20563.948300] page dumped because: kasan: bad access detected [20563.955345] Memory state around the buggy address: [20563.960129] fffffc0c54a36800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [20563.967342] fffffc0c54a36880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [20563.974554] >fffffc0c54a36900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [20563.981766] ^ [20563.986288] fffffc0c54a36980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [20563.993501] fffffc0c54a36a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [20564.000713] ================================================================== Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=205703 Signed-off-by: Zorro Lang Fixes: 9cd0ed63ca514 ("iomap: enhance writeback error message") Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit 0b4295b5e2b9b42f3f3096496fe4775b656c9ba6 Author: LimingWu <19092205@suning.com> Date: Thu Dec 5 20:18:18 2019 +0800 io_uring: fix a typo in a comment thatn -> than. Signed-off-by: Liming Wu <19092205@suning.com> Signed-off-by: Jens Axboe commit 08802ed665e47243393f43501bdafa032112eb1c Author: Hou Tao Date: Thu Dec 5 20:53:11 2019 +0800 bfq-iosched: Ensure bio->bi_blkg is valid before using it bio->bi_blkg will be NULL when the issue of the request has bypassed the block layer as shown in the following oops: Internal error: Oops: 96000005 [#1] SMP CPU: 17 PID: 2996 Comm: scsi_id Not tainted 5.4.0 #4 Call trace: percpu_counter_add_batch+0x38/0x4c8 bfqg_stats_update_legacy_io+0x9c/0x280 bfq_insert_requests+0xbac/0x2190 blk_mq_sched_insert_request+0x288/0x670 blk_execute_rq_nowait+0x140/0x178 blk_execute_rq+0x8c/0x140 sg_io+0x604/0x9c0 scsi_cmd_ioctl+0xe38/0x10a8 scsi_cmd_blk_ioctl+0xac/0xe8 sd_ioctl+0xe4/0x238 blkdev_ioctl+0x590/0x20e0 block_ioctl+0x60/0x98 do_vfs_ioctl+0xe0/0x1b58 ksys_ioctl+0x80/0xd8 __arm64_sys_ioctl+0x40/0x78 el0_svc_handler+0xc4/0x270 so ensure its validity before using it. Fixes: fd41e60331b1 ("bfq-iosched: stop using blkg->stat_bytes and ->stat_ios") Signed-off-by: Hou Tao Signed-off-by: Jens Axboe commit 4493233edcfc0ad0a7f76f1c83f95b1bcf280547 Author: Pavel Begunkov Date: Thu Dec 5 16:16:35 2019 +0300 io_uring: hook all linked requests via link_list Links are created by chaining requests through req->list with an exception that head uses req->link_list. (e.g. link_list->list->list) Because of that, io_req_link_next() needs complex splicing to advance. Link them all through list_list. Also, it seems to be simpler and more consistent IMHO. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 2e6e1fde32d7d41cf076c21060c329d3fdbce25c Author: Pavel Begunkov Date: Thu Dec 5 16:15:45 2019 +0300 io_uring: fix error handling in io_queue_link_head In case of an error io_submit_sqe() drops a request and continues without it, even if the request was a part of a link. Not only it doesn't cancel links, but also may execute wrong sequence of actions. Stop consuming sqes, and let the user handle errors. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 249fad734a25889a4f23ed014d43634af6798063 Author: Madhavan Srinivasan Date: Mon Nov 18 09:14:52 2019 +0530 powerpc/perf: Disable trace_imc pmu When a root user or a user with CAP_SYS_ADMIN privilege uses any trace_imc performance monitoring unit events, to monitor application or KVM threads, it may result in a checkstop (System crash). The cause is frequent switching of the "trace/accumulation" mode of the In-Memory Collection hardware (LDBAR). This patch disables the trace_imc PMU unit entirely to avoid triggering the checkstop. A future patch will reenable it at a later stage once a workaround has been developed. Fixes: 012ae244845f ("powerpc/perf: Trace imc PMU functions") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Madhavan Srinivasan Tested-by: Hariharan T.S. [mpe: Add pr_info_once() so dmesg shows the PMU has been disabled] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191118034452.9939-1-maddy@linux.vnet.ibm.com commit 48e626ac85b43cc589dd1b3b8004f7f85f03544d Author: Anju T Sudhakar Date: Wed Nov 27 12:50:35 2019 +0530 powerpc/powernv: Avoid re-registration of imc debugfs directory export_imc_mode_and_cmd() function which creates the debugfs interface for imc-mode and imc-command, is invoked when each nest pmu units is registered. When the first nest pmu unit is registered, export_imc_mode_and_cmd() creates 'imc' directory under `/debug/powerpc/`. In the subsequent invocations debugfs_create_dir() function returns, since the directory already exists. The recent commit (debugfs: make error message a bit more verbose), throws a warning if we try to invoke `debugfs_create_dir()` with an already existing directory name. Address this warning by making the debugfs directory registration in the opal_imc_counters_probe() function, i.e invoke export_imc_mode_and_cmd() function from the probe function. Signed-off-by: Anju T Sudhakar Tested-by: Nageswara R Sastry Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191127072035.4283-1-anju@linux.vnet.ibm.com commit 8f9081c92523328aa569d09051add79a6c0ae9ff Author: Yonghong Song Date: Wed Dec 4 17:06:07 2019 -0800 selftests/bpf: Add a fexit/bpf2bpf test with target bpf prog no callees The existing fexit_bpf2bpf test covers the target progrm with callees. This patch added a test for the target program without callees. Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191205010607.177904-1-yhs@fb.com commit e9eeec58c992c47b394e4f829e4f81b923b0a322 Author: Yonghong Song Date: Wed Dec 4 17:06:06 2019 -0800 bpf: Fix a bug when getting subprog 0 jited image in check_attach_btf_id For jited bpf program, if the subprogram count is 1, i.e., there is no callees in the program, prog->aux->func will be NULL and prog->bpf_func points to image address of the program. If there is more than one subprogram, prog->aux->func is populated, and subprogram 0 can be accessed through either prog->bpf_func or prog->aux->func[0]. Other subprograms should be accessed through prog->aux->func[subprog_id]. This patch fixed a bug in check_attach_btf_id(), where prog->aux->func[subprog_id] is used to access any subprogram which caused a segfault like below: [79162.619208] BUG: kernel NULL pointer dereference, address: 0000000000000000 ...... [79162.634255] Call Trace: [79162.634974] ? _cond_resched+0x15/0x30 [79162.635686] ? kmem_cache_alloc_trace+0x162/0x220 [79162.636398] ? selinux_bpf_prog_alloc+0x1f/0x60 [79162.637111] bpf_prog_load+0x3de/0x690 [79162.637809] __do_sys_bpf+0x105/0x1740 [79162.638488] do_syscall_64+0x5b/0x180 [79162.639147] entry_SYSCALL_64_after_hwframe+0x44/0xa9 ...... Fixes: 5b92a28aae4d ("bpf: Support attaching tracing BPF program to other BPF programs") Reported-by: Eelco Chaudron Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191205010606.177774-1-yhs@fb.com commit f949286c668aed5aa24acdb5838be9cfd9513bd3 Author: Mike Rapoport Date: Wed Dec 4 16:54:32 2019 -0800 mm: remove __ARCH_HAS_4LEVEL_HACK and include/asm-generic/4level-fixup.h There are no architectures that use include/asm-generic/4level-fixup.h therefore it can be removed along with __ARCH_HAS_4LEVEL_HACK define. Link: http://lkml.kernel.org/r/1572938135-31886-14-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e19f97ed67d8f9b60e4ce14a7551d3dd45825570 Author: Mike Rapoport Date: Wed Dec 4 16:54:28 2019 -0800 um: add support for folded p4d page tables The UML port uses 4 and 5 level fixups to support higher level page table directories in the generic VM code. Implement primitives necessary for the 4th level folding, add walks of p4d level where appropriate and drop usage of __ARCH_USE_5LEVEL_HACK. Link: http://lkml.kernel.org/r/1572938135-31886-13-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4e65e76f1e588e6f5d263652179d51b31a2be855 Author: Mike Rapoport Date: Wed Dec 4 16:54:24 2019 -0800 um: remove unused pxx_offset_proc() and addr_pte() functions The pxx_offset_proc() and addr_pte() functions are never used. Remove them. Link: http://lkml.kernel.org/r/1572938135-31886-12-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Acked-by: Richard Weinberger Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7235db268a2777bc380b99b7db49ff7b19c8fb76 Author: Mike Rapoport Date: Wed Dec 4 16:54:20 2019 -0800 sparc32: use pgtable-nopud instead of 4level-fixup 32-bit version of sparc has three-level page tables and can use pgtable-nopud and folding of the upper layers. Replace usage of include/asm-generic/4level-fixup.h with include/asm-generic/pgtable-nopud.h and adjust page table manipulation macros and functions accordingly. Link: http://lkml.kernel.org/r/1572938135-31886-11-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Acked-by: David S. Miller Tested-by: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2fa245c1f8c9f68e26174fade45ccae5b060751d Author: Helge Deller Date: Wed Dec 4 16:54:16 2019 -0800 parisc/hugetlb: use pgtable-nopXd instead of 4level-fixup Link: http://lkml.kernel.org/r/1572938135-31886-10-git-send-email-rppt@kernel.org Signed-off-by: Helge Deller Signed-off-by: Mike Rapoport Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d96885e277b5edcd1e474e8b1579005163f23dbe Author: Mike Rapoport Date: Wed Dec 4 16:54:12 2019 -0800 parisc: use pgtable-nopXd instead of 4level-fixup parisc has two or three levels of page tables and can use appropriate pgtable-nopXd and folding of the upper layers. Replace usage of include/asm-generic/4level-fixup.h and explicit definitions of __PAGETABLE_PxD_FOLDED in parisc with include/asm-generic/pgtable-nopmd.h for two-level configurations and with include/asm-generic/pgtable-nopud.h for three-lelve configurations and adjust page table manipulation macros and functions accordingly. Link: http://lkml.kernel.org/r/1572938135-31886-9-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Acked-by: Helge Deller Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7c2763c42326a071220077513a9cae90db46b818 Author: Mike Rapoport Date: Wed Dec 4 16:54:08 2019 -0800 nds32: use pgtable-nopmd instead of 4level-fixup nds32 has only two-level page tables and can use pgtable-nopmd and folding of the upper layers. Replace usage of include/asm-generic/4level-fixup.h and explicit definition of __PAGETABLE_PMD_FOLDED in nds32 with include/asm-generic/pgtable-nopmd.h and adjust page table manipulation macros and functions accordingly. Link: http://lkml.kernel.org/r/1572938135-31886-8-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ed48e1f812b585e2af5dee6e08712c64d75978e2 Author: Mike Rapoport Date: Wed Dec 4 16:54:03 2019 -0800 microblaze: use pgtable-nopmd instead of 4level-fixup microblaze has only two-level page tables and can use pgtable-nopmd and folding of the upper layers. Replace usage of include/asm-generic/4level-fixup.h and explicit definition of __PAGETABLE_PMD_FOLDED in microblaze with include/asm-generic/pgtable-nopmd.h and adjust page table manipulation macros and functions accordingly. Link: http://lkml.kernel.org/r/1572938135-31886-7-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 60e50f34b13e9e40763be12aa55f2144d8da514c Author: Mike Rapoport Date: Wed Dec 4 16:53:59 2019 -0800 m68k: mm: use pgtable-nopXd instead of 4level-fixup m68k has two or three levels of page tables and can use appropriate pgtable-nopXd and folding of the upper layers. Replace usage of include/asm-generic/4level-fixup.h and explicit definitions of __PAGETABLE_PxD_FOLDED in m68k with include/asm-generic/pgtable-nopmd.h for two-level configurations and with include/asm-generic/pgtable-nopud.h for three-lelve configurations and adjust page table manipulation macros and functions accordingly. [akpm@linux-foundation.org: fix merge glitch] [geert@linux-m68k.org: more merge glitch fixes] [akpm@linux-foundation.org: s/bad_pgd/bad_pud/, per Mike] Link: http://lkml.kernel.org/r/1572938135-31886-6-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Acked-by: Greg Ungerer Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f6f7caeb58532db2e46c40eee2d7e8969d5c707e Author: Mike Rapoport Date: Wed Dec 4 16:53:55 2019 -0800 m68k: nommu: use pgtable-nopud instead of 4level-fixup The generic nommu implementation of page table manipulation takes care of folding of the upper levels and does not require fixups. Simply replace of include/asm-generic/4level-fixup.h with include/asm-generic/pgtable-nopud.h. Link: http://lkml.kernel.org/r/1572938135-31886-5-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Acked-by: Greg Ungerer Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d13252ea800e1f2a39e40c2b8a4397b21a80555d Author: Mike Rapoport Date: Wed Dec 4 16:53:52 2019 -0800 c6x: use pgtable-nopud instead of 4level-fixup c6x is a nommu architecture and does not require fixup for upper layers of the page tables because it is already handled by the generic nommu implementation. Replace usage of include/asm-generic/4level-fixup.h with include/asm-generic/pgtable-nopud.h Link: http://lkml.kernel.org/r/1572938135-31886-4-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa6628230deb3a0d871dc51923531b41dfbef352 Author: Mike Rapoport Date: Wed Dec 4 16:53:48 2019 -0800 arm: nommu: use pgtable-nopud instead of 4level-fixup The generic nommu implementation of page table manipulation takes care of folding of the upper levels and does not require fixups. Simply replace of include/asm-generic/4level-fixup.h with include/asm-generic/pgtable-nopud.h. Link: http://lkml.kernel.org/r/1572938135-31886-3-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Acked-by: Russell King Cc: Anatoly Pugachev Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a73c948952ccd663b47f6cf59ac0fcae5bf0512c Author: Mike Rapoport Date: Wed Dec 4 16:53:44 2019 -0800 alpha: use pgtable-nopud instead of 4level-fixup Patch series "mm: remove __ARCH_HAS_4LEVEL_HACK", v13. These patches convert several architectures to use page table folding and remove __ARCH_HAS_4LEVEL_HACK along with include/asm-generic/4level-fixup.h. For the nommu configurations the folding is already implemented by the generic code so the only change was to use the appropriate header file. As for the rest, the changes are mostly about mechanical replacement of pgd accessors with pud/pmd ones and the addition of higher levels to page table traversals. With Vineet's patches from "elide extraneous generated code for folded p4d/pud/pmd" series [1] there is a small shrink of the kernel size of about -0.01% for the defconfig builds. This patch (of 13): It is not likely alpha will have 5-level page tables. Replace usage of include/asm-generic/4level-fixup.h and implied __ARCH_HAS_4LEVEL_HACK with include/asm-generic/pgtable-nopud.h and adjust page table manipulation macros and functions accordingly. Link: http://lkml.kernel.org/r/1572938135-31886-2-git-send-email-rppt@kernel.org Signed-off-by: Mike Rapoport Cc: Anton Ivanov Cc: Arnd Bergmann Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Ungerer Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Jeff Dike Cc: "Kirill A. Shutemov" Cc: Mark Salter Cc: Matt Turner Cc: Michal Simek Cc: Peter Rosin Cc: Richard Weinberger Cc: Rolf Eike Beer Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Cc: Vineet Gupta Cc: Anatoly Pugachev Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b27d8517365eeac907de1cc1e91053ccf18179c3 Author: Andy Shevchenko Date: Wed Dec 4 16:53:40 2019 -0800 gpio: pca953x: tighten up indentation There is no need to split some of the lines. However, improve the style of multi-line comment. On top of this there is no need to have double space. Correct above indentation issues without altering the functionality. Link: http://lkml.kernel.org/r/20191022172922.61232-12-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Marek Vasut Cc: Rasmus Villemoes Cc: Thomas Petazzoni Cc: William Breathitt Gray Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 35d13d94893fbdb6bbcbd01aa703296e91c7f851 Author: Andy Shevchenko Date: Wed Dec 4 16:53:37 2019 -0800 gpio: pca953x: convert to use bitmap API Instead of customized approach convert the driver to use bitmap API. [andriy.shevchenko@linux.intel.com: reduce stack usage in couple of functions] Link: http://lkml.kernel.org/r/20191023153056.64262-1-andriy.shevchenko@linux.intel.com Link: http://lkml.kernel.org/r/20191022172922.61232-11-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: William Breathitt Gray Cc: Thomas Petazzoni Cc: Marek Vasut Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Rasmus Villemoes Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0a0a0219d6c85e6dd3dd5487caa3fb7b540f45f1 Author: Andy Shevchenko Date: Wed Dec 4 16:53:33 2019 -0800 gpio: pca953x: use input from regs structure in pca953x_irq_pending() While PCA_PCAL is defined for PCA953X type only, we still may use an offset of the input from regs structure for sake of consistency. Link: http://lkml.kernel.org/r/20191022172922.61232-10-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Marek Vasut Cc: Rasmus Villemoes Cc: Thomas Petazzoni Cc: William Breathitt Gray Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a97832f224893d6155aa785773df70263cfe94ef Author: Andy Shevchenko Date: Wed Dec 4 16:53:30 2019 -0800 gpio: pca953x: remove redundant variable and check in IRQ handler We always will have at least one iteration of the loop due to pending being guaranteed to be non-zero. That is, we may remove extra variable and check in the IRQ handler. Link: http://lkml.kernel.org/r/20191022172922.61232-9-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Marek Vasut Cc: Rasmus Villemoes Cc: Thomas Petazzoni Cc: William Breathitt Gray Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 30544ed5de431fe25d3793e4dd5a058d877c4d77 Author: Andy Shevchenko Date: Wed Dec 4 16:53:26 2019 -0800 lib/bitmap: introduce bitmap_replace() helper In some drivers we want to have a single operation over bitmap which is an equivalent to: *dst = (*old & ~(*mask)) | (*new & *mask) Introduce bitmap_replace() helper for this. Link: http://lkml.kernel.org/r/20191022172922.61232-8-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Rasmus Villemoes Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Marek Vasut Cc: Thomas Petazzoni Cc: William Breathitt Gray Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 780ff33b8bfac4f44fcc399a870d50ff2e74b33d Author: Andy Shevchenko Date: Wed Dec 4 16:53:23 2019 -0800 lib/test_bitmap: fix comment about this file This test case file is about bitmap API, and not printf() facility. Link: http://lkml.kernel.org/r/20191022172922.61232-7-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Marek Vasut Cc: Rasmus Villemoes Cc: Thomas Petazzoni Cc: William Breathitt Gray Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c21dd8a7bb4b8b9cab5dc335a5fa3afa2df1a831 Author: Andy Shevchenko Date: Wed Dec 4 16:53:20 2019 -0800 lib/test_bitmap: move exp1 and exp2 upper for others to use Some test cases may re-use predefined exp1 and exp2 bitmaps. Move them upper in the file. Link: http://lkml.kernel.org/r/20191022172922.61232-6-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Marek Vasut Cc: Rasmus Villemoes Cc: Thomas Petazzoni Cc: William Breathitt Gray Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0ee312e38042c868be9eb973d6e639e6d67b84e2 Author: Andy Shevchenko Date: Wed Dec 4 16:53:17 2019 -0800 lib/test_bitmap: rename exp to exp1 to avoid ambiguous name One function is using exp as local variable. Avoid ambiguous naming by rename global one to exp1. Link: http://lkml.kernel.org/r/20191022172922.61232-5-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Marek Vasut Cc: Rasmus Villemoes Cc: Thomas Petazzoni Cc: William Breathitt Gray Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a4881d1cbc6c36424bf11dec9d484b9d19b927ab Author: Andy Shevchenko Date: Wed Dec 4 16:53:13 2019 -0800 lib/test_bitmap: name EXP_BYTES properly EXP_BYTES has been wrongly named. It's a size of the exp array in bits. While here, go ahead and rename to EXP1_IN_BITS to avoid double renaming when exp will be renamed to exp1 in the next patch Link: http://lkml.kernel.org/r/20191022172922.61232-4-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Marek Vasut Cc: Rasmus Villemoes Cc: Thomas Petazzoni Cc: William Breathitt Gray Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 54224044096e02d6df361333f5528940e3cd3f89 Author: Andy Shevchenko Date: Wed Dec 4 16:53:09 2019 -0800 lib/test_bitmap: undefine macros after use There is no need to keep step and ptest macros defined in entire file. Link: http://lkml.kernel.org/r/20191022172922.61232-3-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Marek Vasut Cc: Rasmus Villemoes Cc: Thomas Petazzoni Cc: William Breathitt Gray Cc: Yury Norov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 17b6753ff08bc47f50da09f5185849172c598315 Author: Andy Shevchenko Date: Wed Dec 4 16:53:06 2019 -0800 lib/test_bitmap: force argument of bitmap_parselist_user() to proper address space Patch series "gpio: pca953x: Convert to bitmap (extended) API", v2. While converting gpio-pca953x driver to bitmap API, I noticed that we have no function to replace bits. So, that's how patch 7 appears. First 6 patches are preparatory of the test suite (including some warning fixes, etc). Patches 8-9 are preparatory for the GPIO driver to be easier converted to bitmap API, conversion to which happens in patch 10. Patch 11 contains simple indentation fixes. This patch (of 11): Sparse complains: lib/test_bitmap.c:345:58: warning: incorrect type in argument 1 (different address spaces) lib/test_bitmap.c:345:58: expected char const [noderef] *ubuf lib/test_bitmap.c:345:58: got char const *const in Force argument of bitmap_parselist_user() to proper address space. Link: http://lkml.kernel.org/r/20191022172922.61232-2-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Cc: Bartosz Golaszewski Cc: Rasmus Villemoes Cc: Yury Norov Cc: William Breathitt Gray Cc: Geert Uytterhoeven Cc: Thomas Petazzoni Cc: Marek Vasut Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0fb9dc28679a627f84974165c8011e0630529ece Author: Masahiro Yamada Date: Wed Dec 4 16:53:03 2019 -0800 arch: sembuf.h: make uapi asm/sembuf.h self-contained Userspace cannot compile due to some missing type definitions. For example, building it for x86 fails as follows: CC usr/include/asm/sembuf.h.s In file included from :32:0: usr/include/asm/sembuf.h:17:20: error: field `sem_perm' has incomplete type struct ipc64_perm sem_perm; /* permissions .. see ipc.h */ ^~~~~~~~ usr/include/asm/sembuf.h:24:2: error: unknown type name `__kernel_time_t' __kernel_time_t sem_otime; /* last semop time */ ^~~~~~~~~~~~~~~ usr/include/asm/sembuf.h:25:2: error: unknown type name `__kernel_ulong_t' __kernel_ulong_t __unused1; ^~~~~~~~~~~~~~~~ usr/include/asm/sembuf.h:26:2: error: unknown type name `__kernel_time_t' __kernel_time_t sem_ctime; /* last change time */ ^~~~~~~~~~~~~~~ usr/include/asm/sembuf.h:27:2: error: unknown type name `__kernel_ulong_t' __kernel_ulong_t __unused2; ^~~~~~~~~~~~~~~~ usr/include/asm/sembuf.h:29:2: error: unknown type name `__kernel_ulong_t' __kernel_ulong_t sem_nsems; /* no. of semaphores in array */ ^~~~~~~~~~~~~~~~ usr/include/asm/sembuf.h:30:2: error: unknown type name `__kernel_ulong_t' __kernel_ulong_t __unused3; ^~~~~~~~~~~~~~~~ usr/include/asm/sembuf.h:31:2: error: unknown type name `__kernel_ulong_t' __kernel_ulong_t __unused4; ^~~~~~~~~~~~~~~~ It is just a matter of missing include directive. Include to make it self-contained, and add it to the compile-test coverage. Link: http://lkml.kernel.org/r/20191030063855.9989-3-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9ef0e004181956e158fb7ceb9b43810a193f80cd Author: Masahiro Yamada Date: Wed Dec 4 16:53:00 2019 -0800 arch: msgbuf.h: make uapi asm/msgbuf.h self-contained Userspace cannot compile due to some missing type definitions. For example, building it for x86 fails as follows: CC usr/include/asm/msgbuf.h.s In file included from usr/include/asm/msgbuf.h:6:0, from :32: usr/include/asm-generic/msgbuf.h:25:20: error: field `msg_perm' has incomplete type struct ipc64_perm msg_perm; ^~~~~~~~ usr/include/asm-generic/msgbuf.h:27:2: error: unknown type name `__kernel_time_t' __kernel_time_t msg_stime; /* last msgsnd time */ ^~~~~~~~~~~~~~~ usr/include/asm-generic/msgbuf.h:28:2: error: unknown type name `__kernel_time_t' __kernel_time_t msg_rtime; /* last msgrcv time */ ^~~~~~~~~~~~~~~ usr/include/asm-generic/msgbuf.h:29:2: error: unknown type name `__kernel_time_t' __kernel_time_t msg_ctime; /* last change time */ ^~~~~~~~~~~~~~~ usr/include/asm-generic/msgbuf.h:41:2: error: unknown type name `__kernel_pid_t' __kernel_pid_t msg_lspid; /* pid of last msgsnd */ ^~~~~~~~~~~~~~ usr/include/asm-generic/msgbuf.h:42:2: error: unknown type name `__kernel_pid_t' __kernel_pid_t msg_lrpid; /* last receive pid */ ^~~~~~~~~~~~~~ It is just a matter of missing include directive. Include to make it self-contained, and add it to the compile-test coverage. Link: http://lkml.kernel.org/r/20191030063855.9989-2-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b009673594d569674a9e0e60109f6a1723075b0 Author: Masahiro Yamada Date: Wed Dec 4 16:52:57 2019 -0800 arch: ipcbuf.h: make uapi asm/ipcbuf.h self-contained Userspace cannot compile due to some missing type definitions. For example, building it for x86 fails as follows: CC usr/include/asm/ipcbuf.h.s In file included from usr/include/asm/ipcbuf.h:1:0, from :32: usr/include/asm-generic/ipcbuf.h:21:2: error: unknown type name `__kernel_key_t' __kernel_key_t key; ^~~~~~~~~~~~~~ usr/include/asm-generic/ipcbuf.h:22:2: error: unknown type name `__kernel_uid32_t' __kernel_uid32_t uid; ^~~~~~~~~~~~~~~~ usr/include/asm-generic/ipcbuf.h:23:2: error: unknown type name `__kernel_gid32_t' __kernel_gid32_t gid; ^~~~~~~~~~~~~~~~ usr/include/asm-generic/ipcbuf.h:24:2: error: unknown type name `__kernel_uid32_t' __kernel_uid32_t cuid; ^~~~~~~~~~~~~~~~ usr/include/asm-generic/ipcbuf.h:25:2: error: unknown type name `__kernel_gid32_t' __kernel_gid32_t cgid; ^~~~~~~~~~~~~~~~ usr/include/asm-generic/ipcbuf.h:26:2: error: unknown type name `__kernel_mode_t' __kernel_mode_t mode; ^~~~~~~~~~~~~~~ usr/include/asm-generic/ipcbuf.h:28:35: error: `__kernel_mode_t' undeclared here (not in a function) unsigned char __pad1[4 - sizeof(__kernel_mode_t)]; ^~~~~~~~~~~~~~~ usr/include/asm-generic/ipcbuf.h:31:2: error: unknown type name `__kernel_ulong_t' __kernel_ulong_t __unused1; ^~~~~~~~~~~~~~~~ usr/include/asm-generic/ipcbuf.h:32:2: error: unknown type name `__kernel_ulong_t' __kernel_ulong_t __unused2; ^~~~~~~~~~~~~~~~ It is just a matter of missing include directive. Include to make it self-contained, and add it to the compile-test coverage. Link: http://lkml.kernel.org/r/20191030063855.9989-1-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ce5c31db3645b649a31044a4d8b6057f6c723702 Author: Julien Grall Date: Wed Dec 4 16:52:53 2019 -0800 lib/ubsan: don't serialize UBSAN report At the moment, UBSAN report will be serialized using a spin_lock(). On RT-systems, spinlocks are turned to rt_spin_lock and may sleep. This will result to the following splat if the undefined behavior is in a context that can sleep: BUG: sleeping function called from invalid context at /src/linux/kernel/locking/rtmutex.c:968 in_atomic(): 1, irqs_disabled(): 128, pid: 3447, name: make 1 lock held by make/3447: #0: 000000009a966332 (&mm->mmap_sem){++++}, at: do_page_fault+0x140/0x4f8 irq event stamp: 6284 hardirqs last enabled at (6283): [] _raw_spin_unlock_irqrestore+0x90/0xa0 hardirqs last disabled at (6284): [] _raw_spin_lock_irqsave+0x30/0x78 softirqs last enabled at (2430): [] fpsimd_restore_current_state+0x60/0xe8 softirqs last disabled at (2427): [] fpsimd_restore_current_state+0x28/0xe8 Preemption disabled at: [] rt_mutex_futex_unlock+0x4c/0xb0 CPU: 3 PID: 3447 Comm: make Tainted: G W 5.2.14-rt7-01890-ge6e057589653 #911 Call trace: dump_backtrace+0x0/0x148 show_stack+0x14/0x20 dump_stack+0xbc/0x104 ___might_sleep+0x154/0x210 rt_spin_lock+0x68/0xa0 ubsan_prologue+0x30/0x68 handle_overflow+0x64/0xe0 __ubsan_handle_add_overflow+0x10/0x18 __lock_acquire+0x1c28/0x2a28 lock_acquire+0xf0/0x370 _raw_spin_lock_irqsave+0x58/0x78 rt_mutex_futex_unlock+0x4c/0xb0 rt_spin_unlock+0x28/0x70 get_page_from_freelist+0x428/0x2b60 __alloc_pages_nodemask+0x174/0x1708 alloc_pages_vma+0x1ac/0x238 __handle_mm_fault+0x4ac/0x10b0 handle_mm_fault+0x1d8/0x3b0 do_page_fault+0x1c8/0x4f8 do_translation_fault+0xb8/0xe0 do_mem_abort+0x3c/0x98 el0_da+0x20/0x24 The spin_lock() will protect against multiple CPUs to output a report together, I guess to prevent them from being interleaved. However, they can still interleave with other messages (and even splat from __might_sleep). So the lock usefulness seems pretty limited. Rather than trying to accomodate RT-system by switching to a raw_spin_lock(), the lock is now completely dropped. Link: http://lkml.kernel.org/r/20190920100835.14999-1-julien.grall@arm.com Signed-off-by: Julien Grall Reported-by: Andre Przywara Acked-by: Andrey Ryabinin Cc: Thomas Gleixner Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8f6a7f96dc29cefe16ab60f06f9c3a43510b96fd Author: Andrey Konovalov Date: Wed Dec 4 16:52:50 2019 -0800 vhost, kcov: collect coverage from vhost_worker Add kcov_remote_start()/kcov_remote_stop() annotations to the vhost_worker() function, which is responsible for processing vhost works. Since vhost_worker() threads are spawned per vhost device instance the common kcov handle is used for kcov_remote_start()/stop() annotations (see Documentation/dev-tools/kcov.rst for details). As the result kcov can now be used to collect coverage from vhost worker threads. Link: http://lkml.kernel.org/r/e49d5d154e5da6c9ada521d2b7ce10a49ce9f98b.1572366574.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Alan Stern Cc: Alexander Potapenko Cc: Anders Roxell Cc: Arnd Bergmann Cc: David Windsor Cc: Dmitry Vyukov Cc: Elena Reshetova Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Marco Elver Cc: "Michael S. Tsirkin" Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 95d23dc27bde0ab4b25f7ade5e2fddc08dd97d9b Author: Andrey Konovalov Date: Wed Dec 4 16:52:47 2019 -0800 usb, kcov: collect coverage from hub_event Add kcov_remote_start()/kcov_remote_stop() annotations to the hub_event() function, which is responsible for processing events on USB buses, in particular events that happen during USB device enumeration. Since hub_event() is run in a global background kernel thread (see Documentation/dev-tools/kcov.rst for details), each USB bus gets a unique global handle from the USB subsystem kcov handle range. As the result kcov can now be used to collect coverage from events that happen on a particular USB bus. [akpm@linux-foundation.org: avoid patch conflicts to make life easier for Andrew] Link: http://lkml.kernel.org/r/de4fe1c219db2d002d905dc1736e2a3bfa1db997.1572366574.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Greg Kroah-Hartman Cc: Alan Stern Cc: Alexander Potapenko Cc: Anders Roxell Cc: Arnd Bergmann Cc: David Windsor Cc: Dmitry Vyukov Cc: Elena Reshetova Cc: Jason Wang Cc: Marco Elver Cc: "Michael S. Tsirkin" Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eec028c9386ed1a692aa01a85b55952202b41619 Author: Andrey Konovalov Date: Wed Dec 4 16:52:43 2019 -0800 kcov: remote coverage support Patch series " kcov: collect coverage from usb and vhost", v3. This patchset extends kcov to allow collecting coverage from backgound kernel threads. This extension requires custom annotations for each of the places where coverage collection is desired. This patchset implements this for hub events in the USB subsystem and for vhost workers. See the first patch description for details about the kcov extension. The other two patches apply this kcov extension to USB and vhost. Examples of other subsystems that might potentially benefit from this when custom annotations are added (the list is based on process_one_work() callers for bugs recently reported by syzbot): 1. fs: writeback wb_workfn() worker, 2. net: addrconf_dad_work()/addrconf_verify_work() workers, 3. net: neigh_periodic_work() worker, 4. net/p9: p9_write_work()/p9_read_work() workers, 5. block: blk_mq_run_work_fn() worker. These patches have been used to enable coverage-guided USB fuzzing with syzkaller for the last few years, see the details here: https://github.com/google/syzkaller/blob/master/docs/linux/external_fuzzing_usb.md This patchset has been pushed to the public Linux kernel Gerrit instance: https://linux-review.googlesource.com/c/linux/kernel/git/torvalds/linux/+/1524 This patch (of 3): Add background thread coverage collection ability to kcov. With KCOV_ENABLE coverage is collected only for syscalls that are issued from the current process. With KCOV_REMOTE_ENABLE it's possible to collect coverage for arbitrary parts of the kernel code, provided that those parts are annotated with kcov_remote_start()/kcov_remote_stop(). This allows to collect coverage from two types of kernel background threads: the global ones, that are spawned during kernel boot in a limited number of instances (e.g. one USB hub_event() worker thread is spawned per USB HCD); and the local ones, that are spawned when a user interacts with some kernel interface (e.g. vhost workers). To enable collecting coverage from a global background thread, a unique global handle must be assigned and passed to the corresponding kcov_remote_start() call. Then a userspace process can pass a list of such handles to the KCOV_REMOTE_ENABLE ioctl in the handles array field of the kcov_remote_arg struct. This will attach the used kcov device to the code sections, that are referenced by those handles. Since there might be many local background threads spawned from different userspace processes, we can't use a single global handle per annotation. Instead, the userspace process passes a non-zero handle through the common_handle field of the kcov_remote_arg struct. This common handle gets saved to the kcov_handle field in the current task_struct and needs to be passed to the newly spawned threads via custom annotations. Those threads should in turn be annotated with kcov_remote_start()/kcov_remote_stop(). Internally kcov stores handles as u64 integers. The top byte of a handle is used to denote the id of a subsystem that this handle belongs to, and the lower 4 bytes are used to denote the id of a thread instance within that subsystem. A reserved value 0 is used as a subsystem id for common handles as they don't belong to a particular subsystem. The bytes 4-7 are currently reserved and must be zero. In the future the number of bytes used for the subsystem or handle ids might be increased. When a particular userspace process collects coverage by via a common handle, kcov will collect coverage for each code section that is annotated to use the common handle obtained as kcov_handle from the current task_struct. However non common handles allow to collect coverage selectively from different subsystems. Link: http://lkml.kernel.org/r/e90e315426a384207edbec1d6aa89e43008e4caf.1572366574.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Dmitry Vyukov Cc: Greg Kroah-Hartman Cc: Alan Stern Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Arnd Bergmann Cc: Steven Rostedt Cc: David Windsor Cc: Elena Reshetova Cc: Anders Roxell Cc: Alexander Potapenko Cc: Marco Elver Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6d13de1489b6bf539695f96d945de3860e6d5e17 Author: Kees Cook Date: Wed Dec 4 16:52:40 2019 -0800 uaccess: disallow > INT_MAX copy sizes As we've done with VFS, string operations, etc, reject usercopy sizes larger than INT_MAX, which would be nice to have for catching bugs related to size calculation overflows[1]. This adds 10 bytes to x86_64 defconfig text and 1980 bytes to the data section: text data bss dec hex filename 19691167 5134320 1646664 26472151 193eed7 vmlinux.before 19691177 5136300 1646664 26474141 193f69d vmlinux.after [1] https://marc.info/?l=linux-s390&m=156631939010493&w=2 Link: http://lkml.kernel.org/r/201908251612.F9902D7A@keescook Signed-off-by: Kees Cook Suggested-by: Dan Carpenter Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5bf8bec3f4ce044a223c40cbce92590d938f0e9c Author: Daniel Vetter Date: Wed Dec 4 16:52:37 2019 -0800 drm: limit to INT_MAX in create_blob ioctl The hardened usercpy code is too paranoid ever since commit 6a30afa8c1fb ("uaccess: disallow > INT_MAX copy sizes") Code itself should have been fine as-is. Link: http://lkml.kernel.org/r/20191106164755.31478-1-daniel.vetter@ffwll.ch Signed-off-by: Daniel Vetter Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com Fixes: 6a30afa8c1fb ("uaccess: disallow > INT_MAX copy sizes") Cc: Kees Cook Cc: Alexander Viro Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bd7bca4335a55561b627149322e93de1b25404c1 Author: Ben Dooks (Codethink) Date: Wed Dec 4 16:52:34 2019 -0800 drivers/rapidio/rio-access.c: fix missing include of Include for the missing declarations of functions exported from this file. Fixes the following sparse warnings: drivers/rapidio/rio-access.c:59:1: warning: symbol '__rio_local_read_config_8' was not declared. Should it be static? drivers/rapidio/rio-access.c:60:1: warning: symbol '__rio_local_read_config_16' was not declared. Should it be static? drivers/rapidio/rio-access.c:61:1: warning: symbol '__rio_local_read_config_32' was not declared. Should it be static? drivers/rapidio/rio-access.c:62:1: warning: symbol '__rio_local_write_config_8' was not declared. Should it be static? drivers/rapidio/rio-access.c:63:1: warning: symbol '__rio_local_write_config_16' was not declared. Should it be static? drivers/rapidio/rio-access.c:64:1: warning: symbol '__rio_local_write_config_32' was not declared. Should it be static? drivers/rapidio/rio-access.c:112:1: warning: symbol 'rio_mport_read_config_8' was not declared. Should it be static? drivers/rapidio/rio-access.c:113:1: warning: symbol 'rio_mport_read_config_16' was not declared. Should it be static? drivers/rapidio/rio-access.c:114:1: warning: symbol 'rio_mport_read_config_32' was not declared. Should it be static? drivers/rapidio/rio-access.c:115:1: warning: symbol 'rio_mport_write_config_8' was not declared. Should it be static? drivers/rapidio/rio-access.c:116:1: warning: symbol 'rio_mport_write_config_16' was not declared. Should it be static? drivers/rapidio/rio-access.c:117:1: warning: symbol 'rio_mport_write_config_32' was not declared. Should it be static? drivers/rapidio/rio-access.c:136:5: warning: symbol 'rio_mport_send_doorbell' was not declared. Should it be static? Link: http://lkml.kernel.org/r/20191017115103.684-1-ben.dooks@codethink.co.uk Signed-off-by: Ben Dooks Cc: Matt Porter Cc: Alexandre Bounine Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 48d6b4dd362c4f3a6032946397385b28ff8d2b9c Author: Ben Dooks (Codethink) Date: Wed Dec 4 16:52:31 2019 -0800 drivers/rapidio/rio-driver.c: fix missing include of Include for the missing declarations of functions exported from this file. Fixes the following sparse warnings: drivers/rapidio/rio-driver.c:53:16: warning: symbol 'rio_dev_get' was not declared. Should it be static? drivers/rapidio/rio-driver.c:70:6: warning: symbol 'rio_dev_put' was not declared. Should it be static? drivers/rapidio/rio-driver.c:150:5: warning: symbol 'rio_register_driver' was not declared. Should it be static? drivers/rapidio/rio-driver.c:169:6: warning: symbol 'rio_unregister_driver' was not declared. Should it be static? Link: http://lkml.kernel.org/r/20191017114923.10888-1-ben.dooks@codethink.co.uk Signed-off-by: Ben Dooks Cc: Matt Porter Cc: Alexandre Bounine Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e8cf4e9ca056cb5dcec3fdf3125c6645fc9b594d Author: Krzysztof Kozlowski Date: Wed Dec 4 16:52:28 2019 -0800 init/Kconfig: fix indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ / /' -i */Kconfig Link: http://lkml.kernel.org/r/1574306670-30234-1-git-send-email-krzk@kernel.org Signed-off-by: Krzysztof Kozlowski Cc: Jiri Kosina Cc: Masahiro Yamada Cc: Greg Kroah-Hartman Cc: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 658c033565118549a07f15927aa6939f481e4712 Author: Alexey Dobriyan Date: Wed Dec 4 16:52:25 2019 -0800 fs/binfmt_elf.c: extract elf_read() function ELF reads done by the kernel have very complicated error detection code which better live in one place. Link: http://lkml.kernel.org/r/20191005165215.GB26927@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 81696d5d544e665674b4f7a09e1304986fbbcbc6 Author: Alexey Dobriyan Date: Wed Dec 4 16:52:22 2019 -0800 fs/binfmt_elf.c: delete unused "interp_map_addr" argument Link: http://lkml.kernel.org/r/20191005165049.GA26927@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f2728fe80cefb40a8f486e64a4bef17ce2c64f5b Author: Heiher Date: Wed Dec 4 16:52:19 2019 -0800 selftests: add epoll selftests This adds the promised selftest for epoll. It will verify the wakeups of epoll. Including leaf and nested mode, epoll_wait() and poll() and multi-threads. Link: http://lkml.kernel.org/r/20191009121518.4027-1-r@hev.cc Signed-off-by: hev Reviewed-by: Roman Penyaev Cc: Jason Baron Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 339ddb53d373baee6e7946aec17c739c4924d6d9 Author: Heiher Date: Wed Dec 4 16:52:15 2019 -0800 fs/epoll: remove unnecessary wakeups of nested epoll Take the case where we have: t0 | (ew) e0 | (et) e1 | (lt) s0 t0: thread 0 e0: epoll fd 0 e1: epoll fd 1 s0: socket fd 0 ew: epoll_wait et: edge-trigger lt: level-trigger We remove unnecessary wakeups to prevent the nested epoll that working in edge- triggered mode to waking up continuously. Test code: #include #include #include int main(int argc, char *argv[]) { int sfd[2]; int efd[2]; struct epoll_event e; if (socketpair(AF_UNIX, SOCK_STREAM, 0, sfd) < 0) goto out; efd[0] = epoll_create(1); if (efd[0] < 0) goto out; efd[1] = epoll_create(1); if (efd[1] < 0) goto out; e.events = EPOLLIN; if (epoll_ctl(efd[1], EPOLL_CTL_ADD, sfd[0], &e) < 0) goto out; e.events = EPOLLIN | EPOLLET; if (epoll_ctl(efd[0], EPOLL_CTL_ADD, efd[1], &e) < 0) goto out; if (write(sfd[1], "w", 1) != 1) goto out; if (epoll_wait(efd[0], &e, 1, 0) != 1) goto out; if (epoll_wait(efd[0], &e, 1, 0) != 0) goto out; close(efd[0]); close(efd[1]); close(sfd[0]); close(sfd[1]); return 0; out: return -1; } More tests: https://github.com/heiher/epoll-wakeup Link: http://lkml.kernel.org/r/20191009060516.3577-1-r@hev.cc Signed-off-by: hev Reviewed-by: Roman Penyaev Cc: Al Viro Cc: Davide Libenzi Cc: Davidlohr Bueso Cc: Dominik Brodowski Cc: Eric Wong Cc: Jason Baron Cc: Sridhar Samudrala Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f6520c520842c532059c380d7a5b30b6e0e72ced Author: Jason Baron Date: Wed Dec 4 16:52:12 2019 -0800 epoll: simplify ep_poll_safewake() for CONFIG_DEBUG_LOCK_ALLOC Currently, ep_poll_safewake() in the CONFIG_DEBUG_LOCK_ALLOC case uses ep_call_nested() in order to pass the correct subclass argument to spin_lock_irqsave_nested(). However, ep_call_nested() adds unnecessary checks for epoll depth and loops that are already verified when doing EPOLL_CTL_ADD. This mirrors a conversion that was done for !CONFIG_DEBUG_LOCK_ALLOC in: commit 37b5e5212a44 ("epoll: remove ep_call_nested() from ep_eventpoll_poll()") Link: http://lkml.kernel.org/r/1567628549-11501-1-git-send-email-jbaron@akamai.com Signed-off-by: Jason Baron Reviewed-by: Roman Penyaev Cc: Davidlohr Bueso Cc: Al Viro Cc: Eric Wong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cd28b119047b9928ddae914dd747f032ab929cc6 Author: Joe Perches Date: Wed Dec 4 16:52:09 2019 -0800 checkpatch: reduce is_maintained_obsolete lookup runtime The is_maintained_obsolete function can be called twice using the same filename. This function spawns a process using get_maintainer.pl. Store the status of each filename when spawned and use the stored result to eliminate the spawning of unnecessary duplicate child processes. Example: old: $ time ./scripts/checkpatch.pl hp100-Move-to-staging.patch > /dev/null real 0m1.767s user 0m1.634s sys 0m0.141s new: $ time ./scripts/checkpatch.pl hp100-Move-to-staging.patch > /dev/null real 0m1.184s user 0m1.085s sys 0m0.103s Link: http://lkml.kernel.org/r/b982566a2b9b4825badce36fdfc3032bd0005151.camel@perches.com Signed-off-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d439e6a5d78b93a85c0f93ea559548fc109ccc1a Author: Joe Perches Date: Wed Dec 4 16:52:06 2019 -0800 checkpatch: improve ignoring CamelCase SI style variants like mA Ignore all upper-case variants before and after SI units like mA, mV and uV so uses like RANGE_mA do not emit a CAMELCASE message. Link: http://lkml.kernel.org/r/5ce6f9131327fd2e12d7a0e20a55f588448de090.camel@perches.com Signed-off-by: Joe Perches Cc: Jules Irenge Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 964975ac6677c97ae61ec9d6969dd5d03f18d1c3 Author: Huang Shijie Date: Wed Dec 4 16:52:03 2019 -0800 lib/genalloc.c: rename addr_in_gen_pool to gen_pool_has_addr Follow the kernel conventions, rename addr_in_gen_pool to gen_pool_has_addr. [sjhuang@iluvatar.ai: fix Documentation/ too] Link: http://lkml.kernel.org/r/20181229015914.5573-1-sjhuang@iluvatar.ai Link: http://lkml.kernel.org/r/20181228083950.20398-1-sjhuang@iluvatar.ai Signed-off-by: Huang Shijie Reviewed-by: Andrew Morton Cc: Russell King Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Christoph Hellwig Cc: Marek Szyprowski Cc: Robin Murphy Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fd7eb2513f8549cf2f6b0c323377816268424bed Author: Huang Shijie Date: Wed Dec 4 16:52:00 2019 -0800 lib/genalloc.c: export symbol addr_in_gen_pool We use addr_in_gen_pool() in a driver module. So export it. Link: http://lkml.kernel.org/r/20181224070622.22197-2-sjhuang@iluvatar.ai Signed-off-by: Huang Shijie Reviewed-by: Andrew Morton Cc: Alexey Skidanov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 323dd2c3ed0641f49e89b4e420f9eef5d3d5a881 Author: Trent Piepho Date: Wed Dec 4 16:51:57 2019 -0800 lib/math/rational.c: fix possible incorrect result from rational fractions helper In some cases the previous algorithm would not return the closest approximation. This would happen when a semi-convergent was the closest, as the previous algorithm would only consider convergents. As an example, consider an initial value of 5/4, and trying to find the closest approximation with a maximum of 4 for numerator and denominator. The previous algorithm would return 1/1 as the closest approximation, while this version will return the correct answer of 4/3. To do this, the main loop performs effectively the same operations as it did before. It must now keep track of the last three approximations, n2/d2 .. n0/d0, while before it only needed the last two. If an exact answer is not found, the algorithm will now calculate the best semi-convergent term, t, which is a single expression with two divisions: min((max_numerator - n0) / n1, (max_denominator - d0) / d1) This will be used if it is better than previous convergent. The test for this is generally a simple comparison, 2*t > a. But in an edge case, where the convergent's final term is even and the best allowable semi-convergent has a final term of exactly half the convergent's final term, the more complex comparison (d0*dp > d1*d) is used. I also wrote some comments explaining the code. While one still needs to look up the math elsewhere, they should help a lot to follow how the code relates to that math. This routine is used in two places in the video4linux code, but in those cases it is only used to reduce a fraction to lowest terms, which the existing code will do correctly. This could be done more efficiently with a different library routine but it would still be the Euclidean alogrithm at its heart. So no change. The remain users are places where a fractional PLL divider is programmed. What would happen is something asked for a clock of X MHz but instead gets Y MHz, where Y is close to X but not exactly due to the hardware limitations. After this change they might, in some cases, get Y' MHz, where Y' is a little closer to X then Y was. Users like this are: Three UARTs, in 8250_mid, 8250_lpss, and imx. One GPU in vp4_hdmi. And three clock drivers, clk-cdce706, clk-si5351, and clk-fractional-divider. The last is a generic clock driver and so would have more users referenced via device tree entries. I think there's a bug in that one, it's limiting an N bit field that is offset-by-1 to the range 0 .. (1< Cc: Oskar Schirmer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dc5c5ad79f0cc2d8756d161dbdee7b370f35f5bb Author: Laura Abbott Date: Wed Dec 4 16:51:53 2019 -0800 lib/test_meminit.c: add bulk alloc/free tests kmem_cache_alloc_bulk/kmem_cache_free_bulk are used to make multiple allocations of the same size to avoid the overhead of multiple kmalloc/kfree calls. Extend the kmem_cache tests to make some calls to these APIs. Link: http://lkml.kernel.org/r/20191107191447.23058-1-labbott@redhat.com Signed-off-by: Laura Abbott Reviewed-by: Kees Cook Tested-by: Alexander Potapenko Cc: Laura Abbott Cc: Christoph Lameter Cc: Nick Desaulniers Cc: Kostya Serebryany Cc: Dmitry Vyukov Cc: Sandeep Patil Cc: Jann Horn Cc: Marco Elver Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8b7569a224a18953b9aee29c375e439b8a6eeb05 Author: Wei Yang Date: Wed Dec 4 16:51:50 2019 -0800 lib/rbtree: get successor's color directly After move parent assignment out, we can check the color directly. Link: http://lkml.kernel.org/r/20191028021442.5450-2-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Acked-by: Peter Zijlstra (Intel) Reviewed-by: Michel Lespinasse Reviewed-by: Davidlohr Bueso Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 11d43e62f693c66c8c76c2ea2349e0f3c5764964 Author: Wei Yang Date: Wed Dec 4 16:51:47 2019 -0800 lib/rbtree: set successor's parent unconditionally Both in Case 2 and 3, we exchange n and s. This mean no matter whether child2 is NULL or not, successor's parent should be assigned to node's. This patch takes this step out to make it explicit and reduce the ambiguity. Besides, this step reduces some symbol size like rb_erase(). KERN_CONFIG upstream patched OPT_FOR_PERF 877 870 OPT_FOR_SIZE 635 621 Link: http://lkml.kernel.org/r/20191028021442.5450-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Acked-by: Peter Zijlstra (Intel) Reviewed-by: Michel Lespinasse Reviewed-by: Davidlohr Bueso Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ae81217edc18135d13e5b6c17609ee2c07af4188 Author: William Breathitt Gray Date: Wed Dec 4 16:51:43 2019 -0800 gpio: pca953x: utilize the for_each_set_clump8 macro Replace verbose implementation in set_multiple callback with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/3543ffc3668ad4ed4c00e8ebaf14a5559fd6ddf2.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Tested-by: Andy Shevchenko Cc: Phil Reid Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Linus Walleij Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d077c78b45168bc869b5453bb1250325c5ed10ff Author: William Breathitt Gray Date: Wed Dec 4 16:51:40 2019 -0800 gpio: max3191x: utilize the for_each_set_clump8 macro Replace verbose implementation in get_multiple callback with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/c2b1ed62caf6fce6e5681809a50c05ce6acdf2a6.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Cc: Andy Shevchenko Cc: Mathias Duckeck Cc: Lukas Wunner Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Linus Walleij Cc: Masahiro Yamada Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 608bd5fda60d9e2083c8bb92f17adfae73afc37a Author: William Breathitt Gray Date: Wed Dec 4 16:51:36 2019 -0800 gpio: pisosr: utilize the for_each_set_clump8 macro Replace verbose implementation in get_multiple callback with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/8a39ee772247d4b7d752b32dbacc06c1cdcb60b5.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Cc: Andy Shevchenko Cc: Morten Hein Tiljeset Cc: Sean Nyekjaer Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Linus Walleij Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Phil Reid Cc: Rasmus Villemoes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9f00ebf518b80e4d58ab32966772b68511d015f2 Author: William Breathitt Gray Date: Wed Dec 4 16:51:32 2019 -0800 thermal: intel: intel_soc_dts_iosf: Utilize for_each_set_clump8 macro Utilize for_each_set_clump8 macro, and the bitmap_set_value8 and bitmap_get_value8 functions, where appropriate. In addition, remove the now unnecessary temp_mask and temp_shift members of the intel_soc_dts_sensor_entry structure. Link: http://lkml.kernel.org/r/2d3c74e9a00a52954f31d19e04623a7f4bc85520.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Suggested-by: Andy Shevchenko Cc: Andy Shevchenko Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Linus Walleij Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b2ca9ebfa68f47950e46b12f2d640f84ee5e1c98 Author: William Breathitt Gray Date: Wed Dec 4 16:51:29 2019 -0800 gpio: 74x164: utilize the for_each_set_clump8 macro Replace verbose implementation in set_multiple callback with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/7ea2df7182a50a1136ca36edc46dffcb2446fd27.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Suggested-by: Andy Shevchenko Tested-by: Andy Shevchenko Cc: Geert Uytterhoeven Cc: Phil Reid Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Linus Walleij Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 17b6038942e304c522d0688c2b29b1c630f1cfa6 Author: William Breathitt Gray Date: Wed Dec 4 16:51:25 2019 -0800 gpio: uniphier: utilize for_each_set_clump8 macro Replace verbose implementation in set_multiple callback with for_each_set_clump8 macro to simplify code and improve clarity. An improvement in this case is that banks that are not masked will now be skipped. Link: http://lkml.kernel.org/r/5b24887e97f3093e4832d7c50a1093f537e91ab4.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Cc: Andy Shevchenko Cc: Masahiro Yamada Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Linus Walleij Cc: Lukas Wunner Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c586aa8f480598f17e1e7d99d3ca7a7a0a6ffbd3 Author: William Breathitt Gray Date: Wed Dec 4 16:51:22 2019 -0800 gpio: pcie-idio-24: utilize for_each_set_clump8 macro Replace verbose implementation in get_multiple/set_multiple callbacks with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/d5d22fa9809dcf8330f4381dbe7e7ca37990e79f.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Cc: Andy Shevchenko Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2dc7c3c16daac7317ef7458bad6b528aa3330951 Author: William Breathitt Gray Date: Wed Dec 4 16:51:18 2019 -0800 gpio: pci-idio-16: utilize for_each_set_clump8 macro Replace verbose implementation in get_multiple/set_multiple callbacks with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/b30f131b4634caf5a70f12e01496f71631a17305.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Cc: Andy Shevchenko Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit acebb82fe9cd4d3dc09e7e28ffa5a5ecc76ae7f8 Author: William Breathitt Gray Date: Wed Dec 4 16:51:15 2019 -0800 gpio: ws16c48: utilize for_each_set_clump8 macro Replace verbose implementation in get_multiple/set_multiple callbacks with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/7a0d2c964e7f2d289b16c63ff6b06fc1f4c50d4d.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Cc: Andy Shevchenko Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b0f49e9b9e2cf0b4c09998bd806dd6ede6c4ad61 Author: William Breathitt Gray Date: Wed Dec 4 16:51:11 2019 -0800 gpio: gpio-mm: utilize for_each_set_clump8 macro Replace verbose implementation in get_multiple/set_multiple callbacks with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/0de53d7021b2d6db10294473cd8a1b6102bcec94.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Cc: Andy Shevchenko Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9bfcce0db3cff35901fbf5d332f7e1f1fe097cfb Author: William Breathitt Gray Date: Wed Dec 4 16:51:08 2019 -0800 gpio: 104-idi-48: utilize for_each_set_clump8 macro Replace verbose implementation in get_multiple/set_multiple callbacks with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/b0631b6d489f85008480399df283ccd33ecfe310.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Cc: Andy Shevchenko Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f70dad5d4c0fd4e184483b70939e935e060d9208 Author: William Breathitt Gray Date: Wed Dec 4 16:51:04 2019 -0800 gpio: 104-dio-48e: utilize for_each_set_clump8 macro Replace verbose implementation in get_multiple/set_multiple callbacks with for_each_set_clump8 macro to simplify code and improve clarity. Link: http://lkml.kernel.org/r/08b9c9a3e75ef1ab0d172223d10a1661f2b43fe2.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Cc: Andy Shevchenko Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Rasmus Villemoes Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e4aa168de88da92f05dd5f13ceb63711011a9b04 Author: William Breathitt Gray Date: Wed Dec 4 16:51:01 2019 -0800 lib/test_bitmap.c: add for_each_set_clump8 test cases The introduction of the for_each_set_clump8 macro warrants test cases to verify the implementation. This patch adds test case checks for whether an out-of-bounds clump index is returned, a zero clump is returned, or the returned clump value differs from the expected clump value. Link: http://lkml.kernel.org/r/febc0fb8151e3e3fdd61c34da9193d1c4d7e6c12.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Tested-by: Andy Shevchenko Cc: Rasmus Villemoes Cc: Arnd Bergmann Cc: Bartosz Golaszewski Cc: Geert Uytterhoeven Cc: Geert Uytterhoeven Cc: Lukas Wunner Cc: Masahiro Yamada Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Phil Reid Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 169c474fb22d8a5e909e172f177b957546d0519d Author: William Breathitt Gray Date: Wed Dec 4 16:50:57 2019 -0800 bitops: introduce the for_each_set_clump8 macro Pach series "Introduce the for_each_set_clump8 macro", v18. While adding GPIO get_multiple/set_multiple callback support for various drivers, I noticed a pattern of looping manifesting that would be useful standardized as a macro. This patchset introduces the for_each_set_clump8 macro and utilizes it in several GPIO drivers. The for_each_set_clump macro8 facilitates a for-loop syntax that iterates over a memory region entire groups of set bits at a time. For example, suppose you would like to iterate over a 32-bit integer 8 bits at a time, skipping over 8-bit groups with no set bit, where XXXXXXXX represents the current 8-bit group: Example: 10111110 00000000 11111111 00110011 First loop: 10111110 00000000 11111111 XXXXXXXX Second loop: 10111110 00000000 XXXXXXXX 00110011 Third loop: XXXXXXXX 00000000 11111111 00110011 Each iteration of the loop returns the next 8-bit group that has at least one set bit. The for_each_set_clump8 macro has four parameters: * start: set to the bit offset of the current clump * clump: set to the current clump value * bits: bitmap to search within * size: bitmap size in number of bits In this version of the patchset, the for_each_set_clump macro has been reimplemented and simplified based on the suggestions provided by Rasmus Villemoes and Andy Shevchenko in the version 4 submission. In particular, the function of the for_each_set_clump macro has been restricted to handle only 8-bit clumps; the drivers that use the for_each_set_clump macro only handle 8-bit ports so a generic for_each_set_clump implementation is not necessary. Thus, a solution for large clumps (i.e. those larger than the width of a bitmap word) can be postponed until a driver appears that actually requires such a generic for_each_set_clump implementation. For what it's worth, a semi-generic for_each_set_clump (i.e. for clumps smaller than the width of a bitmap word) can be implemented by simply replacing the hardcoded '8' and '0xFF' instances with respective variables. I have not yet had a need for such an implementation, and since it falls short of a true generic for_each_set_clump function, I have decided to forgo such an implementation for now. In addition, the bitmap_get_value8 and bitmap_set_value8 functions are introduced to get and set 8-bit values respectively. Their use is based on the behavior suggested in the patchset version 4 review. This patch (of 14): This macro iterates for each 8-bit group of bits (clump) with set bits, within a bitmap memory region. For each iteration, "start" is set to the bit offset of the found clump, while the respective clump value is stored to the location pointed by "clump". Additionally, the bitmap_get_value8 and bitmap_set_value8 functions are introduced to respectively get and set an 8-bit value in a bitmap memory region. [gustavo@embeddedor.com: fix potential sign-extension overflow] Link: http://lkml.kernel.org/r/20191015184657.GA26541@embeddedor [akpm@linux-foundation.org: s/ULL/UL/, per Joe] [vilhelm.gray@gmail.com: add for_each_set_clump8 documentation] Link: http://lkml.kernel.org/r/20191016161825.301082-1-vilhelm.gray@gmail.com Link: http://lkml.kernel.org/r/893c3b4f03266c9496137cc98ac2b1bd27f92c73.1570641097.git.vilhelm.gray@gmail.com Signed-off-by: William Breathitt Gray Signed-off-by: Gustavo A. R. Silva Suggested-by: Andy Shevchenko Suggested-by: Rasmus Villemoes Suggested-by: Lukas Wunner Tested-by: Andy Shevchenko Cc: Arnd Bergmann Cc: Linus Walleij Cc: Bartosz Golaszewski Cc: Masahiro Yamada Cc: Geert Uytterhoeven Cc: Phil Reid Cc: Geert Uytterhoeven Cc: Mathias Duckeck Cc: Morten Hein Tiljeset Cc: Sean Nyekjaer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5e1aada08cd19ea652b2d32a250501d09b02ff2e Author: Joe Perches Date: Wed Dec 4 16:50:53 2019 -0800 kernel/sys.c: avoid copying possible padding bytes in copy_to_user Initialization is not guaranteed to zero padding bytes so use an explicit memset instead to avoid leaking any kernel content in any possible padding bytes. Link: http://lkml.kernel.org/r/dfa331c00881d61c8ee51577a082d8bebd61805c.camel@perches.com Signed-off-by: Joe Perches Cc: Dan Carpenter Cc: Julia Lawall Cc: Thomas Gleixner Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ef70eff9dea66f38f8c2c2dcc7fe4b7a2bbb4921 Author: Nathan Chancellor Date: Wed Dec 4 16:50:50 2019 -0800 kernel/profile.c: use cpumask_available to check for NULL cpumask When building with clang + -Wtautological-pointer-compare, these instances pop up: kernel/profile.c:339:6: warning: comparison of array 'prof_cpu_mask' not equal to a null pointer is always true [-Wtautological-pointer-compare] if (prof_cpu_mask != NULL) ^~~~~~~~~~~~~ ~~~~ kernel/profile.c:376:6: warning: comparison of array 'prof_cpu_mask' not equal to a null pointer is always true [-Wtautological-pointer-compare] if (prof_cpu_mask != NULL) ^~~~~~~~~~~~~ ~~~~ kernel/profile.c:406:26: warning: comparison of array 'prof_cpu_mask' not equal to a null pointer is always true [-Wtautological-pointer-compare] if (!user_mode(regs) && prof_cpu_mask != NULL && ^~~~~~~~~~~~~ ~~~~ 3 warnings generated. This can be addressed with the cpumask_available helper, introduced in commit f7e30f01a9e2 ("cpumask: Add helper cpumask_available()") to fix warnings like this while keeping the code the same. Link: https://github.com/ClangBuiltLinux/linux/issues/747 Link: http://lkml.kernel.org/r/20191022191957.9554-1-natechancellor@gmail.com Signed-off-by: Nathan Chancellor Reviewed-by: Andrew Morton Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 260a2679e5cbfb3d8a4cf6cd1cb6f57e89c7e543 Author: Xiaoming Ni Date: Wed Dec 4 16:50:47 2019 -0800 kernel/notifier.c: remove blocking_notifier_chain_cond_register() blocking_notifier_chain_cond_register() does not consider system_booting state, which is the only difference between this function and blocking_notifier_cain_register(). This can be a bug and is a piece of duplicate code. Delete blocking_notifier_chain_cond_register() Link: http://lkml.kernel.org/r/1568861888-34045-4-git-send-email-nixiaoming@huawei.com Signed-off-by: Xiaoming Ni Reviewed-by: Andrew Morton Cc: Alan Stern Cc: Alexey Dobriyan Cc: Andy Lutomirski Cc: Anna Schumaker Cc: Arjan van de Ven Cc: Chuck Lever Cc: David S. Miller Cc: Ingo Molnar Cc: J. Bruce Fields Cc: Jeff Layton Cc: Nadia Derbey Cc: "Paul E. McKenney" Cc: Sam Protsenko Cc: Thomas Gleixner Cc: Trond Myklebust Cc: Vasily Averin Cc: Viresh Kumar Cc: YueHaibing Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5adaabb65a267d890b29193af2dbc38a3b85bbf2 Author: Xiaoming Ni Date: Wed Dec 4 16:50:43 2019 -0800 kernel/notifier.c: remove notifier_chain_cond_register() The only difference between notifier_chain_cond_register() and notifier_chain_register() is the lack of warning hints for duplicate registrations. Use notifier_chain_register() instead of notifier_chain_cond_register() to avoid duplicate code Link: http://lkml.kernel.org/r/1568861888-34045-3-git-send-email-nixiaoming@huawei.com Signed-off-by: Xiaoming Ni Reviewed-by: Andrew Morton Cc: Alan Stern Cc: Alexey Dobriyan Cc: Andy Lutomirski Cc: Anna Schumaker Cc: Arjan van de Ven Cc: Chuck Lever Cc: David S. Miller Cc: Ingo Molnar Cc: J. Bruce Fields Cc: Jeff Layton Cc: Nadia Derbey Cc: "Paul E. McKenney" Cc: Sam Protsenko Cc: Thomas Gleixner Cc: Trond Myklebust Cc: Vasily Averin Cc: Viresh Kumar Cc: YueHaibing Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1a50cb80f219c44adb6265f5071b81fc3c1deced Author: Xiaoming Ni Date: Wed Dec 4 16:50:39 2019 -0800 kernel/notifier.c: intercept duplicate registrations to avoid infinite loops Registering the same notifier to a hook repeatedly can cause the hook list to form a ring or lose other members of the list. case1: An infinite loop in notifier_chain_register() can cause soft lockup atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test2); case2: An infinite loop in notifier_chain_register() can cause soft lockup atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_call_chain(&test_notifier_list, 0, NULL); case3: lose other hook test2 atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test2); atomic_notifier_chain_register(&test_notifier_list, &test1); case4: Unregister returns 0, but the hook is still in the linked list, and it is not really registered. If you call notifier_call_chain after ko is unloaded, it will trigger oops. If the system is configured with softlockup_panic and the same hook is repeatedly registered on the panic_notifier_list, it will cause a loop panic. Add a check in notifier_chain_register(), intercepting duplicate registrations to avoid infinite loops Link: http://lkml.kernel.org/r/1568861888-34045-2-git-send-email-nixiaoming@huawei.com Signed-off-by: Xiaoming Ni Reviewed-by: Vasily Averin Reviewed-by: Andrew Morton Cc: Alexey Dobriyan Cc: Anna Schumaker Cc: Arjan van de Ven Cc: J. Bruce Fields Cc: Chuck Lever Cc: David S. Miller Cc: Jeff Layton Cc: Andy Lutomirski Cc: Ingo Molnar Cc: Nadia Derbey Cc: "Paul E. McKenney" Cc: Sam Protsenko Cc: Alan Stern Cc: Thomas Gleixner Cc: Trond Myklebust Cc: Viresh Kumar Cc: Xiaoming Ni Cc: YueHaibing Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d717e7da45b382c09cee4f1e03ce30124e672e07 Author: Andy Shevchenko Date: Wed Dec 4 16:50:36 2019 -0800 auxdisplay: charlcd: deduplicate simple_strtoul() Like in commit 8b2303de399f ("serial: core: Fix handling of options after MMIO address") we may use simple_strtoul() which in comparison to kstrtoul() can do conversion in-place without additional and unnecessary code to be written. Link: http://lkml.kernel.org/r/20190801192904.41087-2-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Petr Mladek Cc: Geert Uytterhoeven Cc: Mans Rullgard Cc: Miguel Ojeda Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 885e68e8b7b1328aa1e28b27e13fbfb5f020d269 Author: Andy Shevchenko Date: Wed Dec 4 16:50:32 2019 -0800 kernel.h: update comment about simple_strto() functions There were discussions in the past about use cases for simple_strto() functions and, in some rare cases, they have a benefit over kstrto() ones. Update a comment to reduce confusion about special use cases. Link: http://lkml.kernel.org/r/20190801192904.41087-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Suggested-by: Miguel Ojeda Cc: Geert Uytterhoeven Cc: Mans Rullgard Cc: Petr Mladek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2f5bd343694ed53b3abc4a616ce975505271afe7 Author: Joe Perches Date: Wed Dec 4 16:50:29 2019 -0800 scripts/get_maintainer.pl: add signatures from Fixes: lines in commit message A Fixes: lines in a commit message generally indicate that a previous commit was inadequate for whatever reason. The signers of the previous inadequate commit should also be cc'd on this new commit so update get_maintainer to find the old commit and add the original signers. Link: http://lkml.kernel.org/r/33605b9fc0e0f711236951ae84185a6218acff4f.camel@perches.com Signed-off-by: Joe Perches Suggested-by: Dan Carpenter Reviewed-by: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 24b54fee106d8f9ea41f71e366e03f6a3f083a15 Author: Krzysztof Kozlowski Date: Wed Dec 4 16:50:26 2019 -0800 arch/Kconfig: fix indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ / /' -i */Kconfig Link: http://lkml.kernel.org/r/1574306573-10886-1-git-send-email-krzk@kernel.org Signed-off-by: Krzysztof Kozlowski Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: Jiri Kosina Cc: Masahiro Yamada Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1a18374fc370da5a335b061fe94ebf677b07bd1d Author: Masahiro Yamada Date: Wed Dec 4 16:50:23 2019 -0800 linux/scc.h: make uapi linux/scc.h self-contained Userspace cannot compile CC usr/include/linux/scc.h.s In file included from :32:0: usr/include/linux/scc.h:20:20: error: `SIOCDEVPRIVATE' undeclared here (not in a function) SIOCSCCRESERVED = SIOCDEVPRIVATE, ^~~~~~~~~~~~~~ Include to make it self-contained, and add it to the compile-test coverage. Link: http://lkml.kernel.org/r/20191108055809.26969-1-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8788994376d84d627450fd0d67deb6a66ddf07d7 Author: Rikard Falkeborn Date: Wed Dec 4 16:50:20 2019 -0800 linux/build_bug.h: change type to int Having BUILD_BUG_ON_ZERO produce a value of type size_t leads to awkward casts in cases where the result needs to be signed, or of smaller type than size_t. To avoid this, cast the value to int instead and rely on implicit type conversions when a larger or unsigned type is needed. Link: http://lkml.kernel.org/r/20190811184938.1796-3-rikard.falkeborn@gmail.com Signed-off-by: Rikard Falkeborn Suggested-by: Masahiro Yamada Reviewed-by: Kees Cook Reviewed-by: Masahiro Yamada Cc: Joe Perches Cc: Johannes Berg Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a512ae54cee18296384f45201b3118345ce0dc80 Author: Stephen Boyd Date: Wed Dec 4 16:50:17 2019 -0800 .gitattributes: use 'dts' diff driver for dts files Git is gaining support to display the closest node to the diff in the hunk header via the 'dts' diff driver. Use that driver for all dts and dtsi files so we can gain some more context on where the diff is. Taking a recent commit in the kernel dts files you can see the difference. With this patch and an updated git : diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : index 62e07e1197cc..4c38426a6969 100644 : --- a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : +++ b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : @@ -289,5 +289,29 @@ vdd_hdmi: regulator@1 { : gpio = <&gpio TEGRA194_MAIN_GPIO(A, 3) GPIO_ACTIVE_HIGH>; : enable-active-high; : }; : + : + vdd_3v3_pcie: regulator@2 { : + compatible = "regulator-fixed"; vs. without this patch : diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : index 62e07e1197cc..4c38426a6969 100644 : --- a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : +++ b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : @@ -289,5 +289,29 @@ : gpio = <&gpio TEGRA194_MAIN_GPIO(A, 3) GPIO_ACTIVE_HIGH>; : enable-active-high; : }; : + : + vdd_3v3_pcie: regulator@2 { : + compatible = "regulator-fixed"; You can see that we don't know what the context node is because it isn't shown after the '@@'. dts is not released yet but it is staged to be in the next release[1]. One can probably build git from source and try it out. [1] https://git.kernel.org/pub/scm/git/git.git/commit/?id=d49c2c3466d2c8cb0b3d0a43e6b406b07078fdb1 Link: http://lkml.kernel.org/r/20191004212311.141538-1-swboyd@chromium.org Signed-off-by: Stephen Boyd Cc: Rob Herring Cc: Randy Dunlap Acked-by: Frank Rowand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d5ffb71b633cd5c4b8cce633c9d6448dced4eb74 Author: Alessio Balsini Date: Wed Dec 4 16:50:14 2019 -0800 include/linux/sysctl.h: inline braces for ctl_table and ctl_table_header Fix coding style of "struct ctl_table" and "struct ctl_table_header" to have inline braces. Besides the wide use of this proposed cose style, this change helps to find at a glance the struct definition when navigating the code. Link: http://lkml.kernel.org/r/20190903154906.188651-1-balsini@android.com Signed-off-by: Alessio Balsini Acked-by: Luis Chamberlain Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3d82191c22e20836812afdaef22c5965ae2c55b8 Author: Krzysztof Kozlowski Date: Wed Dec 4 16:50:11 2019 -0800 fs/proc/Kconfig: fix indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ / /' -i */Kconfig [adobriyan@gmail.com: add two spaces where necessary] Link: http://lkml.kernel.org/r/20191124133936.GA5655@avx2 Signed-off-by: Krzysztof Kozlowski Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9573e8f70a82bcbac95b1ea222ac9d5e50266f9f Author: Miaohe Lin Date: Wed Dec 4 16:50:08 2019 -0800 include/linux/proc_fs.h: fix confusing macro arg name state_size and ops are in the wrong position. Link: http://lkml.kernel.org/r/20190910021747.11216-1-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Andrew Morton Acked-by: Aleksa Sarai Reviewed-by: Christian Brauner Cc: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 70a731c0e3c603e84607b770c15e53da4c3a6ecd Author: Alexey Dobriyan Date: Wed Dec 4 16:50:05 2019 -0800 fs/proc/internal.h: shuffle "struct pde_opener" List iteration takes more code than anything else which means embedded list_head should be the first element of the structure. Space savings: add/remove: 0/0 grow/shrink: 0/4 up/down: 0/-18 (-18) Function old new delta close_pdeo 228 227 -1 proc_reg_release 86 82 -4 proc_entry_rundown 143 139 -4 proc_reg_open 298 289 -9 Link: http://lkml.kernel.org/r/20191004234753.GB30246@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5f6354eaa517ce5c1e7b7feb224a0324601f796e Author: Alexey Dobriyan Date: Wed Dec 4 16:50:02 2019 -0800 fs/proc/generic.c: delete useless "len" variable Pointer to next '/' encodes length of path element and next start position. Subtraction and increment are redundant. Link: http://lkml.kernel.org/r/20191004234521.GA30246@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e06689bf57017ac022ccf0f2a5071f760821ce0f Author: Alexey Dobriyan Date: Wed Dec 4 16:49:59 2019 -0800 proc: change ->nlink under proc_subdir_lock Currently gluing PDE into global /proc tree is done under lock, but changing ->nlink is not. Additionally struct proc_dir_entry::nlink is not atomic so updates can be lost. Link: http://lkml.kernel.org/r/20190925202436.GA17388@avx2 Signed-off-by: Alexey Dobriyan Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3cde287bb4769fe9dfc9c532ddc88d90e81bc4c5 Author: Yu Zhao Date: Wed Dec 4 16:49:56 2019 -0800 mm/memory.c: replace is_zero_pfn with is_huge_zero_pmd for thp For hugely mapped thp, we use is_huge_zero_pmd() to check if it's zero page or not. We do fill ptes with my_zero_pfn() when we split zero thp pmd, but this is not what we have in vm_normal_page_pmd() -- pmd_trans_huge_lock() makes sure of it. This is a trivial fix for /proc/pid/numa_maps, and AFAIK nobody complains about it. Gerald Schaefer asked: : Maybe the description could also mention the symptom of this bug? : I would assume that it affects anon/dirty accounting in gather_pte_stats(), : for huge mappings, if zero page mappings are not correctly recognized. I came across this while I was looking at the code, so I'm not aware of any symptom. Link: http://lkml.kernel.org/r/20191108192629.201556-1-yuzhao@google.com Signed-off-by: Yu Zhao Acked-by: Andrew Morton Cc: Matthew Wilcox Cc: Ralph Campbell Cc: Will Deacon Cc: Peter Zijlstra Cc: "Aneesh Kumar K . V" Cc: Dave Airlie Cc: Thomas Hellstrom Cc: Souptick Joarder Cc: Gerald Schaefer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ebc5d83d04438116c24dcc556b0ab6c8ef64b77e Author: Konstantin Khlebnikov Date: Wed Dec 4 16:49:53 2019 -0800 mm/memcontrol: use vmstat names for printing statistics Use common names from vmstat array when possible. This gives not much difference in code size for now, but should help in keeping interfaces consistent. add/remove: 0/2 grow/shrink: 2/0 up/down: 70/-72 (-2) Function old new delta memory_stat_format 984 1050 +66 memcg_stat_show 957 961 +4 memcg1_event_names 32 - -32 mem_cgroup_lru_names 40 - -40 Total: Before=14485337, After=14485335, chg -0.00% Link: http://lkml.kernel.org/r/157113012508.453.80391533767219371.stgit@buzz Signed-off-by: Konstantin Khlebnikov Acked-by: Andrew Morton Cc: Michal Hocko Cc: Vladimir Davydov Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9d7ea9a297e6445d567056f15b469dde13ca4134 Author: Konstantin Khlebnikov Date: Wed Dec 4 16:49:50 2019 -0800 mm/vmstat: add helpers to get vmstat item names for each enum type Statistics in vmstat is combined from counters with different structure, but names for them are merged into one array. This patch adds trivial helpers to get name for each item: const char *zone_stat_name(enum zone_stat_item item); const char *numa_stat_name(enum numa_stat_item item); const char *node_stat_name(enum node_stat_item item); const char *writeback_stat_name(enum writeback_stat_item item); const char *vm_event_name(enum vm_event_item item); Names for enum writeback_stat_item are folded in the middle of vmstat_text so this patch moves declaration into header to calculate offset of following items. Also this patch reuses piece of node stat names for lru list names: const char *lru_list_name(enum lru_list lru); This returns common lru list names: "inactive_anon", "active_anon", "inactive_file", "active_file", "unevictable". [khlebnikov@yandex-team.ru: do not use size of vmstat_text as count of /proc/vmstat items] Link: http://lkml.kernel.org/r/157152151769.4139.15423465513138349343.stgit@buzz Link: https://lore.kernel.org/linux-mm/cd1c42ae-281f-c8a8-70ac-1d01d417b2e1@infradead.org/T/#u Link: http://lkml.kernel.org/r/157113012325.453.562783073839432766.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Andrew Morton Cc: Randy Dunlap Cc: Michal Hocko Cc: Vladimir Davydov Cc: Johannes Weiner Cc: YueHaibing Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a264df74df38855096393447f1b8f386069a94b9 Author: Roman Gushchin Date: Wed Dec 4 16:49:46 2019 -0800 mm: memcg/slab: wait for !root kmem_cache refcnt killing on root kmem_cache destruction Christian reported a warning like the following obtained during running some KVM-related tests on s390: WARNING: CPU: 8 PID: 208 at lib/percpu-refcount.c:108 percpu_ref_exit+0x50/0x58 Modules linked in: kvm(-) xt_CHECKSUM xt_MASQUERADE bonding xt_tcpudp ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ip6table_na> CPU: 8 PID: 208 Comm: kworker/8:1 Not tainted 5.2.0+ #66 Hardware name: IBM 2964 NC9 712 (LPAR) Workqueue: events sysfs_slab_remove_workfn Krnl PSW : 0704e00180000000 0000001529746850 (percpu_ref_exit+0x50/0x58) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 00000000ffff8808 0000001529746740 000003f4e30e8e18 0036008100000000 0000001f00000000 0035008100000000 0000001fb3573ab8 0000000000000000 0000001fbdb6de00 0000000000000000 0000001529f01328 0000001fb3573b00 0000001fbb27e000 0000001fbdb69300 000003e009263d00 000003e009263cd0 Krnl Code: 0000001529746842: f0a0000407fe srp 4(11,%r0),2046,0 0000001529746848: 47000700 bc 0,1792 #000000152974684c: a7f40001 brc 15,152974684e >0000001529746850: a7f4fff2 brc 15,1529746834 0000001529746854: 0707 bcr 0,%r7 0000001529746856: 0707 bcr 0,%r7 0000001529746858: eb8ff0580024 stmg %r8,%r15,88(%r15) 000000152974685e: a738ffff lhi %r3,-1 Call Trace: ([<000003e009263d00>] 0x3e009263d00) [<00000015293252ea>] slab_kmem_cache_release+0x3a/0x70 [<0000001529b04882>] kobject_put+0xaa/0xe8 [<000000152918cf28>] process_one_work+0x1e8/0x428 [<000000152918d1b0>] worker_thread+0x48/0x460 [<00000015291942c6>] kthread+0x126/0x160 [<0000001529b22344>] ret_from_fork+0x28/0x30 [<0000001529b2234c>] kernel_thread_starter+0x0/0x10 Last Breaking-Event-Address: [<000000152974684c>] percpu_ref_exit+0x4c/0x58 ---[ end trace b035e7da5788eb09 ]--- The problem occurs because kmem_cache_destroy() is called immediately after deleting of a memcg, so it races with the memcg kmem_cache deactivation. flush_memcg_workqueue() at the beginning of kmem_cache_destroy() is supposed to guarantee that all deactivation processes are finished, but failed to do so. It waits for an rcu grace period, after which all children kmem_caches should be deactivated. During the deactivation percpu_ref_kill() is called for non root kmem_cache refcounters, but it requires yet another rcu grace period to finish the transition to the atomic (dead) state. So in a rare case when not all children kmem_caches are destroyed at the moment when the root kmem_cache is about to be gone, we need to wait another rcu grace period before destroying the root kmem_cache. This issue can be triggered only with dynamically created kmem_caches which are used with memcg accounting. In this case per-memcg child kmem_caches are created. They are deactivated from the cgroup removing path. If the destruction of the root kmem_cache is racing with the removal of the cgroup (both are quite complicated multi-stage processes), the described issue can occur. The only known way to trigger it in the real life, is to unload some kernel module which creates a dedicated kmem_cache, used from different memory cgroups with GFP_ACCOUNT flag. If the unloading happens immediately after calling rmdir on the corresponding cgroup, there is some chance to trigger the issue. Link: http://lkml.kernel.org/r/20191129025011.3076017-1-guro@fb.com Fixes: f0a3a24b532d ("mm: memcg/slab: rework non-root kmem_cache lifecycle management") Signed-off-by: Roman Gushchin Reported-by: Christian Borntraeger Tested-by: Christian Borntraeger Reviewed-by: Shakeel Butt Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e7d31704c7fe9141b0b27ec1ece254d9993fe2d Author: zhong jiang Date: Wed Dec 4 16:49:43 2019 -0800 mm/kasan/common.c: fix compile error I hit the following compile error in arch/x86/ mm/kasan/common.c: In function kasan_populate_vmalloc: mm/kasan/common.c:797:2: error: implicit declaration of function flush_cache_vmap; did you mean flush_rcu_work? [-Werror=implicit-function-declaration] flush_cache_vmap(shadow_start, shadow_end); ^~~~~~~~~~~~~~~~ flush_rcu_work cc1: some warnings being treated as errors Link: http://lkml.kernel.org/r/1575363013-43761-1-git-send-email-zhongjiang@huawei.com Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") Signed-off-by: zhong jiang Reviewed-by: Andrew Morton Reviewed-by: Daniel Axtens Cc: Mark Rutland Cc: Mark Rutland Cc: Vasily Gorbik Cc: Andrey Ryabinin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2f13437b8917627119d163d62f73e7a78a92303a Merge: 056df578c2dc a356646a5685 Author: Linus Torvalds Date: Wed Dec 4 19:13:52 2019 -0800 Merge tag 'trace-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull more tracing updates from Steven Rostedt: "Two fixes and one patch that was missed: Fixes: - Missing __print_hex_dump undef for processing new function in trace events - Stop WARN_ON messages when lockdown disables tracing on boot up Enhancement: - Debug option to inject trace events from userspace (for rasdaemon)" The enhancement has its own config option and is non invasive. It's been discussed for sever months and should have been added to my original push, but I never pulled it into my queue. * tag 'trace-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Do not create directories if lockdown is in affect tracing: Introduce trace event injection tracing: Fix __print_hex_dump scope commit 78076bb64aa8ba5b7207c38b2660a9e10ffa8cc7 Author: Jens Axboe Date: Wed Dec 4 19:56:40 2019 -0700 io_uring: use hash table for poll command lookups We recently changed this from a single list to an rbtree, but for some real life workloads, the rbtree slows down the submission/insertion case enough so that it's the top cycle consumer on the io_uring side. In testing, using a hash table is a more well rounded compromise. It is fast for insertion, and as long as it's sized appropriately, it works well for the cancellation case as well. Running TAO with a lot of network sockets, this removes io_poll_req_insert() from spending 2% of the CPU cycles. Reported-by: Dan Melnic Signed-off-by: Jens Axboe commit 056df578c2dcac1e624254567f5df5ddaa223234 Merge: aedc0650f913 9fbea0b7e842 Author: Linus Torvalds Date: Wed Dec 4 19:06:18 2019 -0800 Merge tag 'arc-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC updates from Vineet Gupta - Jump Label support for ARC - kmemleak enabled - arc mm backend TLB Miss / flush optimizations - nSIM platform switching to dwuart (vs. arcuart) and ensuing defconfig updates and cleanups - axs platform pll / video-mode updates * tag 'arc-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: add kmemleak support ARC: [plat-axs10x]: remove hardcoded video mode from bootargs ARC: [plat-axs10x]: use pgu pll instead of fixed clock ARC: ARCv2: jump label: implement jump label patching ARC: mm: tlb flush optim: elide redundant uTLB invalidates for MMUv3 ARC: mm: tlb flush optim: elide repeated uTLB invalidate in loop ARC: mm: tlb flush optim: Make TLBWriteNI fallback to TLBWrite if not available ARC: mm: TLB Miss optim: avoid re-reading ECR ARCv2: mm: TLB Miss optim: Use double world load/stores LDD/STD ARCv2: mm: TLB Miss optim: SMP builds can cache pgd pointer in mmu scratch reg ARC: nSIM_700: remove unused network options ARC: nSIM_700: switch to DW UART usage ARC: merge HAPS-HS with nSIM-HS configs ARC: HAPS: cleanup defconfigs from unused ETH drivers ARC: HAPS: add HIGHMEM memory zone to DTS ARC: HAPS: use same UART configuration everywhere ARC: HAPS: cleanup defconfigs from unused IO-related options ARC: regenerate nSIM and HAPS defconfigs commit ef8c84effce3c7a0b8196fcda8f430c815ab511c Author: Stanislav Fomichev Date: Wed Dec 4 11:09:55 2019 -0800 selftests/bpf: De-flake test_tcpbpf It looks like BPF program that handles BPF_SOCK_OPS_STATE_CB state can race with the bpf_map_lookup_elem("global_map"); I sometimes see the failures in this test and re-running helps. Since we know that we expect the callback to be called 3 times (one time for listener socket, two times for both ends of the connection), let's export this number and add simple retry logic around that. Also, let's make EXPECT_EQ() not return on failure, but continue evaluating all conditions; that should make potential debugging easier. With this fix in place I don't observe the flakiness anymore. Signed-off-by: Stanislav Fomichev Signed-off-by: Alexei Starovoitov Cc: Lawrence Brakmo Link: https://lore.kernel.org/bpf/20191204190955.170934-1-sdf@google.com commit a284e11c371e446371675668d8c8120a27227339 Author: Hans Verkuil Date: Mon Dec 2 10:08:12 2019 -0800 Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers This increment of rmi_smbus in rmi_smb_read/write_block() causes garbage to be read/written. The first read of SMB_MAX_COUNT bytes is fine, but after that it is nonsense. Trial-and-error showed that by dropping the increment of rmiaddr everything is fine and the F54 function properly works. I tried a hack with rmi_smb_write_block() as well (writing to the same F54 touchpad data area, then reading it back), and that suggests that there too the rmiaddr increment has to be dropped. It makes sense that if it has to be dropped for read, then it has to be dropped for write as well. It looks like the initial work with F54 was done using i2c, not smbus, and it seems nobody ever tested F54 with smbus. The other functions all read/write less than SMB_MAX_COUNT as far as I can tell, so this issue was never noticed with non-F54 functions. With this change I can read out the touchpad data correctly on my Lenovo X1 Carbon 6th Gen laptop. Signed-off-by: Hans Verkuil Link: https://lore.kernel.org/r/8dd22e21-4933-8e9c-a696-d281872c8de7@xs4all.nl Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 86bcd3a12999447faad60ec59c2d64d18d8e61ac Author: Lucas Stach Date: Mon Dec 2 09:37:00 2019 -0800 Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash F34 is a bit special as it reinitializes the device and related driver structs during the firmware update. This clears the fn_irq_mask which will then prevent F34 from receiving further interrupts, leading to timeouts during the firmware update. Make sure to reinitialize the IRQ enables at the appropriate times. The issue is in F34 code, but the commit in the fixes tag exposed the issue, as before this commit things would work by accident. Fixes: 363c53875aef (Input: synaptics-rmi4 - avoid processing unknown IRQs) Signed-off-by: Lucas Stach Link: https://lore.kernel.org/r/20191129133514.23224-1-l.stach@pengutronix.de Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit df5b5e555b356662a5e4a23c6774fdfce8547d54 Author: Hans de Goede Date: Mon Dec 2 09:36:15 2019 -0800 Input: goodix - add upside-down quirk for Teclast X89 tablet The touchscreen on the Teclast X89 is mounted upside down in relation to the display orientation (the touchscreen itself is mounted upright, but the display is mounted upside-down). Add a quirk for this so that we send coordinates which match the display orientation. Signed-off-by: Hans de Goede Reviewed-by: Bastien Nocera Link: https://lore.kernel.org/r/20191202085636.6650-1-hdegoede@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 25b2f1b77a92b4d850d40eca50d446dd25c09934 Author: Mathew King Date: Wed Dec 4 17:27:47 2019 -0800 Input: add privacy screen toggle keycode Add keycode for toggling electronic privacy screen to the keycodes definition. Some new laptops have a privacy screen which can be toggled with a key on the keyboard. Signed-off-by: Mathew King Link: https://lore.kernel.org/r/20191017163208.235518-1-mathewk@chromium.org Signed-off-by: Dmitry Torokhov commit d4b675e1b5272149d4c6fac6870df6ebdbd8be82 Author: Marcel Holtmann Date: Wed Dec 4 17:27:16 2019 -0800 Input: uinput - fix returning EPOLLOUT from uinput_poll Always return EPOLLOUT from uinput_poll to allow polling /dev/uinput for writable state. Signed-off-by: Marcel Holtmann Link: https://lore.kernel.org/r/20191204025014.5189-1-marcel@holtmann.org Signed-off-by: Dmitry Torokhov commit 6bf6affe18dafea6ef12036001162ac7f2dbf738 Author: Stanislav Fomichev Date: Mon Dec 2 13:59:31 2019 -0800 selftests/bpf: Bring back c++ include/link test Commit 5c26f9a78358 ("libbpf: Don't use cxx to test_libpf target") converted existing c++ test to c. We still want to include and link against libbpf from c++ code, so reinstate this test back, this time in a form of a selftest with a clear comment about its purpose. v2: * -lelf -> $(LDLIBS) (Andrii Nakryiko) Fixes: 5c26f9a78358 ("libbpf: Don't use cxx to test_libpf target") Signed-off-by: Stanislav Fomichev Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191202215931.248178-1-sdf@google.com commit 1e55c176f8f503c7dccba6e2b237f26a065ff79c Author: Dmitry Torokhov Date: Wed Dec 4 17:56:24 2019 -0800 Input: snvs_pwrkey - remove gratuitous NULL initializers Gratuitous NULL initializers rarely help and often prevent compiler from warning about using uninitialized variable. Let's remove them. Reviewed-by: Anson Huang Link: https://lore.kernel.org/r/20191125211407.GA97812@dtor-ws Signed-off-by: Dmitry Torokhov commit 01d434ce98d38e36901c72493b96afc4075ee887 Author: Stanislav Fomichev Date: Mon Dec 2 12:01:43 2019 -0800 selftests/bpf: Don't hard-code root cgroup id Commit 40430452fd5d ("kernfs: use 64bit inos if ino_t is 64bit") changed the way cgroup ids are exposed to the userspace. Instead of assuming fixed root id, let's query it. Fixes: 40430452fd5d ("kernfs: use 64bit inos if ino_t is 64bit") Signed-off-by: Stanislav Fomichev Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191202200143.250793-1-sdf@google.com commit edbca120a8cdfa5a5793707e33497aa5185875ca Author: Jesper Dangaard Brouer Date: Mon Dec 2 13:37:31 2019 +0100 samples/bpf: Fix broken xdp_rxq_info due to map order assumptions In the days of using bpf_load.c the order in which the 'maps' sections were defines in BPF side (*_kern.c) file, were used by userspace side to identify the map via using the map order as an index. In effect the order-index is created based on the order the maps sections are stored in the ELF-object file, by the LLVM compiler. This have also carried over in libbpf via API bpf_map__next(NULL, obj) to extract maps in the order libbpf parsed the ELF-object file. When BTF based maps were introduced a new section type ".maps" were created. I found that the LLVM compiler doesn't create the ".maps" sections in the order they are defined in the C-file. The order in the ELF file is based on the order the map pointer is referenced in the code. This combination of changes lead to xdp_rxq_info mixing up the map file-descriptors in userspace, resulting in very broken behaviour, but without warning the user. This patch fix issue by instead using bpf_object__find_map_by_name() to find maps via their names. (Note, this is the ELF name, which can be longer than the name the kernel retains). Fixes: be5bca44aa6b ("samples: bpf: convert some XDP samples from bpf_load to libbpf") Fixes: 451d1dc886b5 ("samples: bpf: update map definition to new syntax BTF-defined map") Signed-off-by: Jesper Dangaard Brouer Signed-off-by: Alexei Starovoitov Acked-by: Toke Høiland-Jørgensen Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/157529025128.29832.5953245340679936909.stgit@firesoul commit d04ac224b1688f005a84f764cfe29844f8e9da08 Author: Martin Varghese Date: Thu Dec 5 05:57:22 2019 +0530 net: Fixed updating of ethertype in skb_mpls_push() The skb_mpls_push was not updating ethertype of an ethernet packet if the packet was originally received from a non ARPHRD_ETHER device. In the below OVS data path flow, since the device corresponding to port 7 is an l3 device (ARPHRD_NONE) the skb_mpls_push function does not update the ethertype of the packet even though the previous push_eth action had added an ethernet header to the packet. recirc_id(0),in_port(7),eth_type(0x0800),ipv4(tos=0/0xfc,ttl=64,frag=no), actions:push_eth(src=00:00:00:00:00:00,dst=00:00:00:00:00:00), push_mpls(label=13,tc=0,ttl=64,bos=1,eth_type=0x8847),4 Fixes: 8822e270d697 ("net: core: move push MPLS functionality from OvS to core helper") Signed-off-by: Martin Varghese Signed-off-by: David S. Miller commit b53bd16fec3d52ff7be1648a9b0a747288f52cf8 Merge: b7fa0cde29c8 e5a6ca27eb72 Author: Dave Airlie Date: Thu Dec 5 11:11:06 2019 +1000 Merge tag 'drm-misc-next-fixes-2019-12-04' of git://anongit.freedesktop.org/drm/drm-misc into drm-next mgag200- Fix hw with broken 'startadd' support (Thomas) mst- Avoid skipping payloads in payload deletion loop (Wayne) omap- Fix dma_addr refcounting (Tomi) Cc: Wayne Lin Cc: Tomi Valkeinen Cc: Thomas Zimmermann Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20191204212255.GA256395@art_vandelay commit 099ffd7eddfe03b9b5b43e1f4ffece99121dd7ba Author: Alexandru Ardelean Date: Wed Dec 4 09:58:09 2019 +0200 NFC: NCI: use new `delay` structure for SPI transfer delays In a recent change to the SPI subsystem [1], a new `delay` struct was added to replace the `delay_usecs`. This change replaces the current `delay_secs` with `delay` for this driver. The `spi_transfer_delay_exec()` function [in the SPI framework] makes sure that both `delay_usecs` & `delay` are used (in this order to preserve backwards compatibility). [1] commit bebcfd272df6485 ("spi: introduce `delay` field for `spi_transfer` + spi_transfer_delay_exec()") Signed-off-by: Alexandru Ardelean Signed-off-by: David S. Miller commit 38ecd706ca78525d9c4e3bdf9dbe4d2860c125ef Author: Russell King Date: Tue Dec 3 23:51:28 2019 +0000 net: sfp: fix hwmon The referenced commit below allowed more than one hwmon device to be created per SFP, which is definitely not what we want. Avoid this by only creating the hwmon device just as we transition to WAITDEV state. Fixes: 139d3a212a1f ("net: sfp: allow modules with slow diagnostics to probe") Signed-off-by: Russell King Signed-off-by: David S. Miller commit 0cb96b5749bf500f3612cda52fc98eb795fcd62d Author: Russell King Date: Tue Dec 3 23:51:22 2019 +0000 net: sfp: fix unbind When unbinding, we don't correctly tear down the module state, leaving (for example) the hwmon registration behind. Ensure everything is properly removed by sending a remove event at unbind. Fixes: 6b0da5c9c1a3 ("net: sfp: track upstream's attachment state in state machine") Signed-off-by: Russell King Signed-off-by: David S. Miller commit b7fa0cde29c87a6d3f0a11d24c46f52549e5a5c1 Merge: 4673402ebf9f d66dfcf80d0f Author: Dave Airlie Date: Thu Dec 5 10:52:58 2019 +1000 Merge tag 'drm/tegra/for-5.5-rc1-fixes' of git://anongit.freedesktop.org/tegra/linux into drm-next drm/tegra: Fixes for v5.5-rc1 This is a set of small fixes, mostly for regressions introduced with the DMA API and DisplayPort support in the main pull request for v5.5-rc1. Signed-off-by: Dave Airlie From: Thierry Reding Link: https://patchwork.freedesktop.org/patch/msgid/20191204124316.3534855-1-thierry.reding@gmail.com commit ffac2027e18f006f42630f2e01a8a9bd8dc664b5 Author: Shannon Nelson Date: Tue Dec 3 14:17:34 2019 -0800 ionic: keep users rss hash across lif reset If the user has specified their own RSS hash key, don't lose it across queue resets such as DOWN/UP, MTU change, and number of channels change. This is fixed by moving the key initialization to a little earlier in the lif creation. Also, let's clean up the RSS config a little better on the way down by setting it all to 0. Fixes: aa3198819bea ("ionic: Add RSS support") Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 86c76c09898332143be365c702cf8d586ed4ed21 Author: Jonathan Lemon Date: Tue Dec 3 14:01:14 2019 -0800 xdp: obtain the mem_id mutex before trying to remove an entry. A lockdep splat was observed when trying to remove an xdp memory model from the table since the mutex was obtained when trying to remove the entry, but not before the table walk started: Fix the splat by obtaining the lock before starting the table walk. Fixes: c3f812cea0d7 ("page_pool: do not release pool until inflight == 0.") Reported-by: Grygorii Strashko Signed-off-by: Jonathan Lemon Tested-by: Grygorii Strashko Acked-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 95219afbb980f10934de9f23a3e199be69c5ed09 Author: Aaron Conole Date: Tue Dec 3 16:34:14 2019 -0500 act_ct: support asymmetric conntrack The act_ct TC module shares a common conntrack and NAT infrastructure exposed via netfilter. It's possible that a packet needs both SNAT and DNAT manipulation, due to e.g. tuple collision. Netfilter can support this because it runs through the NAT table twice - once on ingress and again after egress. The act_ct action doesn't have such capability. Like netfilter hook infrastructure, we should run through NAT twice to keep the symmetry. Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") Signed-off-by: Aaron Conole Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit 5d50aa83e2c8e91ced2cca77c198b468ca9210f4 Author: Aaron Conole Date: Tue Dec 3 16:34:13 2019 -0500 openvswitch: support asymmetric conntrack The openvswitch module shares a common conntrack and NAT infrastructure exposed via netfilter. It's possible that a packet needs both SNAT and DNAT manipulation, due to e.g. tuple collision. Netfilter can support this because it runs through the NAT table twice - once on ingress and again after egress. The openvswitch module doesn't have such capability. Like netfilter hook infrastructure, we should run through NAT twice to keep the symmetry. Fixes: 05752523e565 ("openvswitch: Interface with NAT.") Signed-off-by: Aaron Conole Signed-off-by: David S. Miller commit 08bdcc35f00c91b325195723cceaba0937a89ddf Author: Jens Axboe Date: Wed Dec 4 17:19:44 2019 -0700 io-wq: clear node->next on list deletion If someone removes a node from a list, and then later adds it back to a list, we can have invalid data in ->next. This can cause all sorts of issues. One such use case is the IORING_OP_POLL_ADD command, which will do just that if we race and get woken twice without any pending events. This is a pretty rare case, but can happen under extreme loads. Dan reports that he saw the following crash: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD d283ce067 P4D d283ce067 PUD e5ca04067 PMD 0 Oops: 0002 [#1] SMP CPU: 17 PID: 10726 Comm: tao:fast-fiber Kdump: loaded Not tainted 5.2.9-02851-gac7bc042d2d1 #116 Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A17 05/03/2019 RIP: 0010:io_wqe_enqueue+0x3e/0xd0 Code: 34 24 74 55 8b 47 58 48 8d 6f 50 85 c0 74 50 48 89 df e8 35 7c 75 00 48 83 7b 08 00 48 8b 14 24 0f 84 84 00 00 00 48 8b 4b 10 <48> 89 11 48 89 53 10 83 63 20 fe 48 89 c6 48 89 df e8 0c 7a 75 00 RSP: 0000:ffffc90006858a08 EFLAGS: 00010082 RAX: 0000000000000002 RBX: ffff889037492fc0 RCX: 0000000000000000 RDX: ffff888e40cc11a8 RSI: ffff888e40cc11a8 RDI: ffff889037492fc0 RBP: ffff889037493010 R08: 00000000000000c3 R09: ffffc90006858ab8 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888e40cc11a8 R13: 0000000000000000 R14: 00000000000000c3 R15: ffff888e40cc1100 FS: 00007fcddc9db700(0000) GS:ffff88903fa40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000e479f5003 CR4: 00000000007606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: io_poll_wake+0x12f/0x2a0 __wake_up_common+0x86/0x120 __wake_up_common_lock+0x7a/0xc0 sock_def_readable+0x3c/0x70 tcp_rcv_established+0x557/0x630 tcp_v6_do_rcv+0x118/0x3c0 tcp_v6_rcv+0x97e/0x9d0 ip6_protocol_deliver_rcu+0xe3/0x440 ip6_input+0x3d/0xc0 ? ip6_protocol_deliver_rcu+0x440/0x440 ipv6_rcv+0x56/0xd0 ? ip6_rcv_finish_core.isra.18+0x80/0x80 __netif_receive_skb_one_core+0x50/0x70 netif_receive_skb_internal+0x2f/0xa0 napi_gro_receive+0x125/0x150 mlx5e_handle_rx_cqe+0x1d9/0x5a0 ? mlx5e_poll_tx_cq+0x305/0x560 mlx5e_poll_rx_cq+0x49f/0x9c5 mlx5e_napi_poll+0xee/0x640 ? smp_reschedule_interrupt+0x16/0xd0 ? reschedule_interrupt+0xf/0x20 net_rx_action+0x286/0x3d0 __do_softirq+0xca/0x297 irq_exit+0x96/0xa0 do_IRQ+0x54/0xe0 common_interrupt+0xf/0xf RIP: 0033:0x7fdc627a2e3a Code: 31 c0 85 d2 0f 88 f6 00 00 00 55 48 89 e5 41 57 41 56 4c 63 f2 41 55 41 54 53 48 83 ec 18 48 85 ff 0f 84 c7 00 00 00 48 8b 07 <41> 89 d4 49 89 f5 48 89 fb 48 85 c0 0f 84 64 01 00 00 48 83 78 10 when running a networked workload with about 5000 sockets being polled for. Fix this by clearing node->next when the node is being removed from the list. Fixes: 6206f0e180d4 ("io-wq: shrink io_wq_work a bit") Reported-by: Dan Melnic Signed-off-by: Jens Axboe commit 551003fff7235ce935bc1fefb72d12b63a408bd0 Author: Aneesh Kumar K.V Date: Mon Dec 2 12:10:18 2019 +0530 powerpc/pmem: Convert to EXPORT_SYMBOL_GPL All other architecture export this as GPL symbol Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191202064018.155083-1-aneesh.kumar@linux.ibm.com commit b6afd1234cf93aa0d71b4be4788c47534905f0be Author: Ard Biesheuvel Date: Wed Dec 4 11:50:15 2019 +0000 powerpc/archrandom: fix arch_get_random_seed_int() Commit 01c9348c7620ec65 powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_* updated arch_get_random_[int|long]() to be NOPs, and moved the hardware RNG backing to arch_get_random_seed_[int|long]() instead. However, it failed to take into account that arch_get_random_int() was implemented in terms of arch_get_random_long(), and so we ended up with a version of the former that is essentially a NOP as well. Fix this by calling arch_get_random_seed_long() from arch_get_random_seed_int() instead. Fixes: 01c9348c7620ec65 ("powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*") Signed-off-by: Ard Biesheuvel Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191204115015.18015-1-ardb@kernel.org commit e5a6ca27eb72c67533ddfc11c06df84beaa167fa Author: Wayne Lin Date: Tue Dec 3 12:24:23 2019 +0800 drm/dp_mst: Correct the bug in drm_dp_update_payload_part1() [Why] If the payload_state is DP_PAYLOAD_DELETE_LOCAL in series, current code doesn't delete the payload at current index and just move the index to next one after shuffling payloads. [How] Drop the i++ increasing part in for loop head and decide whether to increase the index or not according to payload_state of current payload. Changes since v1: * Refine the code to have it easy reading * Amend the commit message to meet the way code is modified now. Signed-off-by: Wayne Lin Reviewed-by: Lyude Paul Fixes: 706246c761dd ("drm/dp_mst: Refactor drm_dp_update_payload_part1()") Cc: Daniel Vetter Cc: Juston Li Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Sean Paul Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Cc: # v5.1+ [Added cc for stable] Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20191203042423.5961-1-Wayne.Lin@amd.com commit 7b3b209e61adf575faf21d08a47f6a842b7b0767 Merge: 8ffb055beae5 6c8991f41546 Author: David S. Miller Date: Wed Dec 4 12:27:13 2019 -0800 Merge branch 'net-convert-ipv6_stub-to-ip6_dst_lookup_flow' Sabrina Dubroca says: ==================== net: convert ipv6_stub to ip6_dst_lookup_flow Xiumei Mu reported a bug in a VXLAN over IPsec setup: IPv6 | ESP | VXLAN Using this setup, packets go out unencrypted, because VXLAN over IPv6 gets its route from ipv6_stub->ipv6_dst_lookup (in vxlan6_get_route), which doesn't perform an XFRM lookup. This patchset first makes ip6_dst_lookup_flow suitable for some existing users of ipv6_stub->ipv6_dst_lookup by adding a 'net' argument, then converts all those users. ==================== Signed-off-by: David S. Miller commit 6c8991f41546c3c472503dff1ea9daaddf9331c2 Author: Sabrina Dubroca Date: Wed Dec 4 15:35:53 2019 +0100 net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup ipv6_stub uses the ip6_dst_lookup function to allow other modules to perform IPv6 lookups. However, this function skips the XFRM layer entirely. All users of ipv6_stub->ip6_dst_lookup use ip_route_output_flow (via the ip_route_output_key and ip_route_output helpers) for their IPv4 lookups, which calls xfrm_lookup_route(). This patch fixes this inconsistent behavior by switching the stub to ip6_dst_lookup_flow, which also calls xfrm_lookup_route(). This requires some changes in all the callers, as these two functions take different arguments and have different return types. Fixes: 5f81bd2e5d80 ("ipv6: export a stub for IPv6 symbols used by vxlan") Reported-by: Xiumei Mu Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit c4e85f73afb6384123e5ef1bba3315b2e3ad031e Author: Sabrina Dubroca Date: Wed Dec 4 15:35:52 2019 +0100 net: ipv6: add net argument to ip6_dst_lookup_flow This will be used in the conversion of ipv6_stub to ip6_dst_lookup_flow, as some modules currently pass a net argument without a socket to ip6_dst_lookup. This is equivalent to commit 343d60aada5a ("ipv6: change ipv6_stub_impl.ipv6_dst_lookup to take net argument"). Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit fd9bee5e24141d00e23b66d1b51bc759efa7e3fe Author: Arnaldo Carvalho de Melo Date: Wed Dec 4 12:53:16 2019 -0300 tools headers UAPI: Update tools's copy of drm.h headers Picking the changes from: 2093dea3def9 ("drm/syncobj: extend syncobj query ability v3") Which doesn't affect tooling, just silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/drm/drm.h' differs from latest version at 'include/uapi/drm/drm.h' diff -u tools/include/uapi/drm/drm.h include/uapi/drm/drm.h Cc: Adrian Hunter Cc: Christian König Cc: Chunming Zhou Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-t1xqmjffo4rxdw395dsnu34j@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 0b3fca6ad3283866e9d2376554b3e4fbf23bfd5d Author: Arnaldo Carvalho de Melo Date: Wed Dec 4 12:49:43 2019 -0300 tools headers UAPI: Sync drm/i915_drm.h with the kernel sources To pick the change in: a0e047156cde ("drm/i915/gem: Make context persistence optional") 9cd20ef7803c ("drm/i915/perf: allow holding preemption on filtered ctx") 7831e9a965ea ("drm/i915/perf: Allow dynamic reconfiguration of the OA stream") 4f6ccc74a85c ("drm/i915: add support for perf configuration queries") b8d49f28aa03 ("drm/i915/perf: introduce a versioning of the i915-perf uapi") 601734f7aabd ("drm/i915/tgl: s/ss/eu fuse reading support") That don't result in any changes in tooling, just silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Cc: Adrian Hunter Cc: Chris Wilson Cc: Daniele Ceraolo Spurio Cc: Jiri Olsa Cc: Lionel Landwerlin Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-qwzjrgwj55y3g6rjdf9spkpr@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit aedc0650f9135f3b92b39cbed1a8fe98d8088825 Merge: 6cdc7f2efc25 7d73710d9ca2 Author: Linus Torvalds Date: Wed Dec 4 11:08:30 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more KVM updates from Paolo Bonzini: - PPC secure guest support - small x86 cleanup - fix for an x86-specific out-of-bounds write on a ioctl (not guest triggerable, data not attacker-controlled) * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm: vmx: Stop wasting a page for guest_msrs KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) Documentation: kvm: Fix mention to number of ioctls classes powerpc: Ultravisor: Add PPC_UV config option KVM: PPC: Book3S HV: Support reset of secure guest KVM: PPC: Book3S HV: Handle memory plug/unplug to secure VM KVM: PPC: Book3S HV: Radix changes for secure guest KVM: PPC: Book3S HV: Shared pages support for secure guests KVM: PPC: Book3S HV: Support for running secure guests mm: ksm: Export ksm_madvise() KVM x86: Move kvm cpuid support out of svm commit 6cdc7f2efc25a6dbddf7c57bb2eee5d6c033d678 Merge: ef66f6b8e3f5 1646220a6d4b Author: Linus Torvalds Date: Wed Dec 4 11:07:00 2019 -0800 Merge tag 'riscv/for-v5.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Paul Walmsley: "A few minor RISC-V updates for v5.5-rc1 that arrived late. New features: - Dump some kernel virtual memory map details to the console if CONFIG_DEBUG_VM is enabled Other improvements: - Enable more debugging options in the primary defconfigs Cleanups: - Clean up Kconfig indentation" * tag 'riscv/for-v5.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: RISC-V: Add address map dumper riscv: defconfigs: enable more debugging options riscv: defconfigs: enable debugfs riscv: Fix Kconfig indentation commit ef66f6b8e3f585ab6c42ed49c5f2e7d2d88bb43e Merge: b92f3d32e098 240b62d381fe Author: Linus Torvalds Date: Wed Dec 4 11:05:13 2019 -0800 Merge tag 'please-pull-misc-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux Pull ia64 update from Tony Luck: "Cleanup some leftover para-virtualization pieces" * tag 'please-pull-misc-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux: ia64: remove stale paravirt leftovers commit b92f3d32e098a39c2136ee0729174e829a1cf335 Merge: ef867c12f31d b65d56305c6f Author: Linus Torvalds Date: Wed Dec 4 10:56:35 2019 -0800 Merge tag 'acpi-5.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull additional ACPI updates from Rafael Wysocki: "These close a nasty race condition in the ACPI memory mappings management code and an invalid parameter check in a library routing, allow GPE 0xFF to be masked via kernel command line, add a new lid switch blacklist entry and clean up Kconfig. Specifics: - Fix locking issue in acpi_os_map_cleanup() leading to a race condition that can be harnessed for provoking a kernel panic from user space (Francesco Ruggeri) - Fix parameter check in acpi_bus_get_private_data() (Vamshi K Sthambamkadi) - Allow GPE 0xFF to be masked via kernel command line (Yunfeng Ye) - Add a new lid switch blacklist entry for Acer Switch 10 SW5-032 to the ACPI button driver (Hans de Goede) - Clean up Kconfig (Krzysztof Kozlowski)" * tag 'acpi-5.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() ACPI: Fix Kconfig indentation ACPI: OSL: only free map once in osl.c ACPI: button: Add DMI quirk for Acer Switch 10 SW5-032 lid-switch ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100 commit ef867c12f31dec4a03be5678d70893f97dc76ea7 Merge: 63de37476ebd 1e4230f56dac Author: Linus Torvalds Date: Wed Dec 4 10:48:09 2019 -0800 Merge tag 'pm-5.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull additional power management updates from Rafael Wysocki: "These fix an ACPI EC driver bug exposed by the recent rework of the suspend-to-idle code flow, reintroduce frequency constraints into device PM QoS (in preparation for adding QoS support to devfreq), drop a redundant field from struct cpuidle_state and clean up Kconfig in some places. Specifics: - Avoid a race condition in the ACPI EC driver that may cause systems to be unable to leave suspend-to-idle (Rafael Wysocki) - Drop the "disabled" field, which is redundant, from struct cpuidle_state (Rafael Wysocki) - Reintroduce device PM QoS frequency constraints (temporarily introduced and than dropped during the 5.4 cycle) in preparation for adding QoS support to devfreq (Leonard Crestez) - Clean up indentation (in multiple places) and the cpuidle drivers help text in Kconfig (Krzysztof Kozlowski, Randy Dunlap)" * tag 'pm-5.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: s2idle: Rework ACPI events synchronization ACPI: EC: Rework flushing of pending work PM / devfreq: Add missing locking while setting suspend_freq PM / QoS: Restore DEV_PM_QOS_MIN/MAX_FREQUENCY PM / QoS: Reorder pm_qos/freq_qos/dev_pm_qos structs PM / QoS: Initial kunit test PM / QoS: Redefine FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX power: avs: Fix Kconfig indentation cpufreq: Fix Kconfig indentation cpuidle: minor Kconfig help text fixes cpuidle: Drop disabled field from struct cpuidle_state cpuidle: Fix Kconfig indentation commit 2d28390aff879238f00e209e38c2a0b78717360e Author: Jens Axboe Date: Wed Dec 4 11:08:05 2019 -0700 io_uring: ensure deferred timeouts copy necessary data If we defer a timeout, we should ensure that we copy the timespec when we have consumed the sqe. This is similar to commit f67676d160c6 for read/write requests. We already did this correctly for timeouts deferred as links, but do it generally and use the infrastructure added by commit 1a6b74fc8702 instead of having the timeout deferral use its own. Signed-off-by: Jens Axboe commit 9a7d5a9e6d7921e1854b4606ce8c3e17d565f463 Author: Aurelien Aptel Date: Wed Dec 4 16:14:54 2019 +0100 cifs: fix possible uninitialized access and race on iface_list iface[0] was accessed regardless of the count value and without locking. * check count before accessing any ifaces * make copy of iface list (it's a simple POD array) and use it without locking. Signed-off-by: Aurelien Aptel Signed-off-by: Steve French Reviewed-by: Paulo Alcantara (SUSE) commit 3345bb44bacd99413a3dc0dcd9a99449d88d4dda Author: Paulo Alcantara (SUSE) Date: Wed Dec 4 11:25:06 2019 -0300 cifs: Fix lookup of SMB connections on multichannel With the addition of SMB session channels, we introduced new TCP server pointers that have no sessions or tcons associated with them. In this case, when we started looking for TCP connections, we might end up picking session channel rather than the master connection, hence failing to get either a session or a tcon. In order to fix that, this patch introduces a new "is_channel" field to TCP_Server_Info structure so we can skip session channels during lookup of connections. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 901e59bba9ddad4bc6994ecb8598ea60a993da4c Author: Jens Axboe Date: Wed Dec 4 10:34:03 2019 -0700 io_uring: allow IO_SQE_* flags on IORING_OP_TIMEOUT There's really no reason why we forbid things like link/drain etc on regular timeout commands. Enable the usual SQE flags on timeouts. Reported-by: 李通洲 Signed-off-by: Jens Axboe commit 1cea335d1db1ce6ab71b3d2f94a807112b738a0f Author: Christoph Hellwig Date: Wed Dec 4 09:33:52 2019 -0800 iomap: fix sub-page uptodate handling bio completions can race when a page spans more than one file system block. Add a spinlock to synchronize marking the page uptodate. Fixes: 9dc55f1389f9 ("iomap: add support for sub-pagesize buffered I/O without buffer heads") Reported-by: Jan Stancek Signed-off-by: Christoph Hellwig Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 9917b54aded12dff9beb9e709981617b788e44b0 Merge: 026948f01eac d567fb881916 Author: Alex Williamson Date: Wed Dec 4 10:15:56 2019 -0700 Merge branch 'v5.5/vfio/jiang-yi-irq-bypass-unregister-v1' into v5.5/vfio/next commit d9c148cfaf0a99296ad7c92fb8b65952196053ec Author: Tomi Valkeinen Date: Thu Nov 14 10:03:43 2019 +0200 drm/omap: fix dma_addr refcounting cec4fa7511ef7a73eb635834e9d85b25a5b47a98 ("drm/omap: use refcount API to track the number of users of dma_addr") changed omap_gem.c to use refcounting API to track dma_addr uses. However, the driver only tracks the refcounts for non-contiguous buffers, and the patch didn't fully take this in account. After the patch, the driver always decreased refcount in omap_gem_unpin, instead of decreasing the refcount only for non-contiguous buffers. This leads to refcounting mismatch. As for the contiguous cases the refcount is never increased, fix this issue by returning from omap_gem_unpin if the buffer being unpinned is contiguous. Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20191114080343.30704-1-tomi.valkeinen@ti.com Fixes: cec4fa7511ef ("drm/omap: use refcount API to track the number of users of dma_addr") Reviewed-by: Laurent Pinchart commit bca1c43cb2dbe4212aea0793bfd91aeb4c2d184d Author: Jens Axboe Date: Wed Dec 4 09:17:41 2019 -0700 null_blk: remove unused variable warning on !CONFIG_BLK_DEV_ZONED If BLK_DEV_ZONED isn't set, 'ret' isn't used. This makes gcc complain, rightfully. Move ret where it is used. Fixes: 979d54475e0b ("null_blk: cleanup null_gendisk_register") Signed-off-by: Jens Axboe commit f1acbf2186dfe761a05ce35c0f36246caed44403 Author: Ming Lei Date: Wed Dec 4 19:31:15 2019 +0800 brd: warn on un-aligned buffer Queue dma alignment limit requires users(fs, target, ...) of block layer to pass aligned buffer. So far brd doesn't support un-aligned buffer, even though it is easy to support it. However, given brd is often used for debug purpose, and there are other drivers which can't support un-aligned buffer too. So add warning so that brd users know what to fix. Reported-by: Stephen Rust Cc: Stephen Rust Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 36582a5a456100ebe4983e3d63b8cbc7e62a0ddc Author: Ming Lei Date: Wed Dec 4 19:31:14 2019 +0800 brd: remove max_hw_sectors queue limit Now we depend on blk_queue_split() to respect most of queue limit (the only one exception could be dma alignment), however blk_queue_split() isn't used for brd, so this limit isn't respected since v4.3. Also max_hw_sectors limit doesn't play a big role for brd, which is added since brd is added to tree for unknown reason. So remove it. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 29f6eeca0e14b301d9c03a3164b852c318d6348a Author: Adrian Hunter Date: Wed Dec 4 14:08:00 2019 +0200 perf inject: Fix processing of ID index for injected instruction tracing The ID index event is used when decoding, but can result in the following error: $ perf record --aux-sample -e '{intel_pt//,branch-misses}:u' ls $ perf inject -i perf.data -o perf.data.inj --itrace=be $ perf script -i perf.data.inj 0x1020 [0x410]: failed to process type: 69 [No such file or directory] Fix by having 'perf inject' drop the ID index event. Fixes: c0a6de06c446 ("perf record: Add support for AUX area sampling") Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191204120800.8138-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit bb30acae4c4dacfa2622387c5ad5563246810583 Author: Ravi Bangoria Date: Thu Nov 14 18:52:13 2019 +0530 perf report: Bail out --mem-mode if mem info is not available If perf.data is recorded without -d, don't allow user to use --mem-mode with 'perf report'. symbol_daddr and phys_daddr can be recorded separately and may be present in the perf.data but at the report time they are associated with mem-mode fields and thus this restriction applies to them as well. Before: $ perf record ls $ perf report --mem-mode --stdio # Overhead Local Weight Memory access Symbol # ........ ............ ............. ....................... 55.56% 0 N/A [k] 0xffffffff81a00ae7 After: $ perf report --mem-mode --stdio Error: Selected --mem-mode but no mem data. Did you call perf record without -d? Suggested-by: Arnaldo Carvalho de Melo Signed-off-by: Ravi Bangoria Acked-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jin Yao Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20191114132213.5419-4-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit aa6b3c99236b49a3e842d7272efa2529f15f7d8a Author: Ravi Bangoria Date: Thu Nov 14 18:52:12 2019 +0530 perf report: Make -F more strict like -s Currently -F allows branch-mode / mem-mode fields with -F even when perf report is not running in that mode. Don't allow that. Suggested-by: Arnaldo Carvalho de Melo Signed-off-by: Ravi Bangoria Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jin Yao Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20191114132213.5419-3-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit ae87405fb511d6220ce86b9a60807fef92e1a934 Author: Ravi Bangoria Date: Thu Nov 14 18:52:11 2019 +0530 perf report/top TUI: Replace pr_err() with ui__error() pr_err() in TUI mode does not print anyting on the screen and just quits. Replace such pr_err() with ui__error(). Before: $ perf report -s + $ After: $ perf report -s + ┌─Error:────────────────┐ │Invalid --sort key: `+'│ │ │ │Press any key... │ └───────────────────────┘ Signed-off-by: Ravi Bangoria Acked-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jin Yao Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20191114132213.5419-2-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 4cc8d6505ab82db3357613d36e6c58a297f57f7c Author: Takashi Iwai Date: Wed Dec 4 15:48:24 2019 +0100 ALSA: pcm: oss: Avoid potential buffer overflows syzkaller reported an invalid access in PCM OSS read, and this seems to be an overflow of the internal buffer allocated for a plugin. Since the rate plugin adjusts its transfer size dynamically, the calculation for the chained plugin might be bigger than the given buffer size in some extreme cases, which lead to such an buffer overflow as caught by KASAN. Fix it by limiting the max transfer size properly by checking against the destination size in each plugin transfer callback. Reported-by: syzbot+f153bde47a62e0b05f83@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/20191204144824.17801-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 0b8d616fb5a8ffa307b1d3af37f55c15dae14f28 Author: Christian Brauner Date: Wed Oct 9 13:48:09 2019 +0200 taskstats: fix data-race When assiging and testing taskstats in taskstats_exit() there's a race when setting up and reading sig->stats when a thread-group with more than one thread exits: write to 0xffff8881157bbe10 of 8 bytes by task 7951 on cpu 0: taskstats_tgid_alloc kernel/taskstats.c:567 [inline] taskstats_exit+0x6b7/0x717 kernel/taskstats.c:596 do_exit+0x2c2/0x18e0 kernel/exit.c:864 do_group_exit+0xb4/0x1c0 kernel/exit.c:983 get_signal+0x2a2/0x1320 kernel/signal.c:2734 do_signal+0x3b/0xc00 arch/x86/kernel/signal.c:815 exit_to_usermode_loop+0x250/0x2c0 arch/x86/entry/common.c:159 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x2d7/0x2f0 arch/x86/entry/common.c:299 entry_SYSCALL_64_after_hwframe+0x44/0xa9 read to 0xffff8881157bbe10 of 8 bytes by task 7949 on cpu 1: taskstats_tgid_alloc kernel/taskstats.c:559 [inline] taskstats_exit+0xb2/0x717 kernel/taskstats.c:596 do_exit+0x2c2/0x18e0 kernel/exit.c:864 do_group_exit+0xb4/0x1c0 kernel/exit.c:983 __do_sys_exit_group kernel/exit.c:994 [inline] __se_sys_exit_group kernel/exit.c:992 [inline] __x64_sys_exit_group+0x2e/0x30 kernel/exit.c:992 do_syscall_64+0xcf/0x2f0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix this by using smp_load_acquire() and smp_store_release(). Reported-by: syzbot+c5d03165a1bd1dead0c1@syzkaller.appspotmail.com Fixes: 34ec12349c8a ("taskstats: cleanup ->signal->stats allocation") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner Acked-by: Marco Elver Reviewed-by: Will Deacon Reviewed-by: Andrea Parri Reviewed-by: Dmitry Vyukov Link: https://lore.kernel.org/r/20191009114809.8643-1-christian.brauner@ubuntu.com commit f9bbb68233aa5bd5ef238bd3532fddf92fa1b53c Author: Mike Marshall Date: Tue Nov 26 12:39:37 2019 -0500 orangefs: posix open permission checking... Orangefs has no open, and orangefs checks file permissions on each file access. Posix requires that file permissions be checked on open and nowhere else. Orangefs-through-the-kernel needs to seem posix compliant. The VFS opens files, even if the filesystem provides no method. We can see if a file was successfully opened for read and or for write by looking at file->f_mode. When writes are flowing from the page cache, file is no longer available. We can trust the VFS to have checked file->f_mode before writing to the page cache. The mode of a file might change between when it is opened and IO commences, or it might be created with an arbitrary mode. We'll make sure we don't hit EACCES during the IO stage by using UID 0. Some of the time we have access without changing to UID 0 - how to check? Signed-off-by: Mike Marshall commit a356646a56857c2e5ad875beec734d7145ecd49a Author: Steven Rostedt (VMware) Date: Mon Dec 2 16:25:27 2019 -0500 tracing: Do not create directories if lockdown is in affect If lockdown is disabling tracing on boot up, it prevents the tracing files from even bering created. But when that happens, there's several places that will give a warning that the files were not created as that is usually a sign of a bug. Add in strategic locations where a check is made to see if tracing is disabled by lockdown, and if it is, do not go further, and fail silently (but print that tracing is disabled by lockdown, without doing a WARN_ON()). Cc: Matthew Garrett Fixes: 17911ff38aa5 ("tracing: Add locked_down checks to the open calls of files created for tracefs") Signed-off-by: Steven Rostedt (VMware) commit 926d1650176448d7684b991fbe1a5b1a8289e97c Author: Gao Xiang Date: Sun Dec 1 16:01:09 2019 +0800 erofs: zero out when listxattr is called with no xattr As David reported [1], ENODATA returns when attempting to modify files by using EROFS as an overlayfs lower layer. The root cause is that listxattr could return unexpected -ENODATA by mistake for inodes without xattr. That breaks listxattr return value convention and it can cause copy up failure when used with overlayfs. Resolve by zeroing out if no xattr is found for listxattr. [1] https://lore.kernel.org/r/CAEvUa7nxnby+rxK-KRMA46=exeOMApkDMAV08AjMkkPnTPV4CQ@mail.gmail.com Link: https://lore.kernel.org/r/20191201084040.29275-1-hsiangkao@aol.com Fixes: cadf1ccf1b00 ("staging: erofs: add error handling for xattr submodule") Cc: # 4.19+ Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 552263456215ada7ee8700ce022d12b0cffe4802 Author: Vincenzo Frascino Date: Mon Dec 2 07:57:29 2019 +0000 powerpc: Fix vDSO clock_getres() clock_getres in the vDSO library has to preserve the same behaviour of posix_get_hrtimer_res(). In particular, posix_get_hrtimer_res() does: sec = 0; ns = hrtimer_resolution; and hrtimer_resolution depends on the enablement of the high resolution timers that can happen either at compile or at run time. Fix the powerpc vdso implementation of clock_getres keeping a copy of hrtimer_resolution in vdso data and using that directly. Fixes: a7f290dad32e ("[PATCH] powerpc: Merge vdso's and add vdso support to 32 bits kernel") Cc: stable@vger.kernel.org Signed-off-by: Vincenzo Frascino Reviewed-by: Christophe Leroy Acked-by: Shuah Khan [chleroy: changed CLOCK_REALTIME_RES to CLOCK_HRTIMER_RES] Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/a55eca3a5e85233838c2349783bcb5164dae1d09.1575273217.git.christophe.leroy@c-s.fr commit 6f4679b956741d2da6ad3ebb738cbe1264ac8781 Author: Aneesh Kumar K.V Date: Wed Dec 4 10:59:09 2019 +0530 powerpc/pmem: Fix kernel crash due to wrong range value usage in flush_dcache_range This patch fix the below kernel crash. BUG: Unable to handle kernel data access on read at 0xc000000380000000 Faulting instruction address: 0xc00000000008b6f0 cpu 0x5: Vector: 300 (Data Access) at [c0000000d8587790] pc: c00000000008b6f0: arch_remove_memory+0x150/0x210 lr: c00000000008b720: arch_remove_memory+0x180/0x210 sp: c0000000d8587a20 msr: 800000000280b033 dar: c000000380000000 dsisr: 40000000 current = 0xc0000000d8558600 paca = 0xc00000000fff8f00 irqmask: 0x03 irq_happened: 0x01 pid = 1220, comm = ndctl enter ? for help memunmap_pages+0x33c/0x410 devm_action_release+0x30/0x50 release_nodes+0x30c/0x3a0 device_release_driver_internal+0x178/0x240 unbind_store+0x74/0x190 drv_attr_store+0x44/0x60 sysfs_kf_write+0x74/0xa0 kernfs_fop_write+0x1b0/0x260 __vfs_write+0x3c/0x70 vfs_write+0xe4/0x200 ksys_write+0x7c/0x140 system_call+0x5c/0x68 Fixes: 076265907cf9 ("powerpc: Chunk calls to flush_dcache_range in arch_*_memory") Reported-by: Sachin Sant Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191204052909.59145-1-aneesh.kumar@linux.ibm.com commit b67a95f2abff0c34e5667c15ab8900de73d8d087 Author: Cédric Le Goater Date: Tue Dec 3 17:36:42 2019 +0100 powerpc/xive: Skip ioremap() of ESB pages for LSI interrupts The PCI INTx interrupts and other LSI interrupts are handled differently under a sPAPR platform. When the interrupt source characteristics are queried, the hypervisor returns an H_INT_ESB flag to inform the OS that it should be using the H_INT_ESB hcall for interrupt management and not loads and stores on the interrupt ESB pages. A default -1 value is returned for the addresses of the ESB pages. The driver ignores this condition today and performs a bogus IO mapping. Recent changes and the DEBUG_VM configuration option make the bug visible with : kernel BUG at arch/powerpc/include/asm/book3s/64/pgtable.h:612! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix MMU=Hash SMP NR_CPUS=1024 NUMA pSeries Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.0-0.rc6.git0.1.fc32.ppc64le #1 NIP: c000000000f63294 LR: c000000000f62e44 CTR: 0000000000000000 REGS: c0000000fa45f0d0 TRAP: 0700 Not tainted (5.4.0-0.rc6.git0.1.fc32.ppc64le) ... NIP ioremap_page_range+0x4c4/0x6e0 LR ioremap_page_range+0x74/0x6e0 Call Trace: ioremap_page_range+0x74/0x6e0 (unreliable) do_ioremap+0x8c/0x120 __ioremap_caller+0x128/0x140 ioremap+0x30/0x50 xive_spapr_populate_irq_data+0x170/0x260 xive_irq_domain_map+0x8c/0x170 irq_domain_associate+0xb4/0x2d0 irq_create_mapping+0x1e0/0x3b0 irq_create_fwspec_mapping+0x27c/0x3e0 irq_create_of_mapping+0x98/0xb0 of_irq_parse_and_map_pci+0x168/0x230 pcibios_setup_device+0x88/0x250 pcibios_setup_bus_devices+0x54/0x100 __of_scan_bus+0x160/0x310 pcibios_scan_phb+0x330/0x390 pcibios_init+0x8c/0x128 do_one_initcall+0x60/0x2c0 kernel_init_freeable+0x290/0x378 kernel_init+0x2c/0x148 ret_from_kernel_thread+0x5c/0x80 Fixes: bed81ee181dd ("powerpc/xive: introduce H_INT_ESB hcall") Cc: stable@vger.kernel.org # v4.14+ Signed-off-by: Cédric Le Goater Tested-by: Daniel Axtens Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191203163642.2428-1-clg@kaod.org commit 71eb40fc53371bc247c8066ae76ad9e22ae1e18d Author: Christophe Leroy Date: Fri Nov 29 14:26:41 2019 +0000 powerpc/kasan: Fix boot failure with RELOCATABLE && FSL_BOOKE When enabling CONFIG_RELOCATABLE and CONFIG_KASAN on FSL_BOOKE, the kernel doesn't boot. relocate_init() requires KASAN early shadow area to be set up because it needs access to the device tree through generic functions. Call kasan_early_init() before calling relocate_init() Reported-by: Lexi Shao Fixes: 2edb16efc899 ("powerpc/32: Add KASAN support") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b58426f1664a4b344ff696d18cacf3b3e8962111.1575036985.git.christophe.leroy@c-s.fr commit d66dfcf80d0f55f95b9ea4a45ca41cc7115e9789 Author: Thierry Reding Date: Tue Dec 3 17:19:14 2019 +0100 drm/tegra: Run hub cleanup on ->remove() The call to tegra_display_hub_cleanup() that takes care of disabling the window groups is missing from the driver's ->remove() callback. Call it to make sure the runtime PM reference counts for the display controllers are balanced. Signed-off-by: Thierry Reding commit b06e145f7030bea2f307d3dc68a6b9aaf2dd905c Author: Thierry Reding Date: Tue Dec 3 17:19:13 2019 +0100 drm/tegra: sor: Make the +5V HDMI supply optional The SOR supports multiple display modes, but only when driving an HDMI monitor does it make sense to control the +5V power supply. eDP and DP don't need this, so make it optional. This fixes a crash observed during system suspend/resume. Reviewed-by: Daniel Vetter Signed-off-by: Thierry Reding commit a8817489dc3e3b1910842958a3b9d9e4832e99b0 Author: Thierry Reding Date: Tue Dec 3 17:19:12 2019 +0100 drm/tegra: Silence expected errors on IOMMU attach Subdevices may not be hooked up to an IOMMU via device tree. Detect such situations and avoid confusing users by not emitting an error message. Reviewed-by: Daniel Vetter Signed-off-by: Thierry Reding commit 82d73874d422b43359698f73c418a02322c886d5 Author: Thierry Reding Date: Tue Dec 3 17:19:11 2019 +0100 drm/tegra: vic: Export module device table Export the module device table to ensure the VIC compatible strings are listed in the module's aliases table. This in turn causes the driver to be automatically loaded on boot if VIC is the only enabled subdevice of the logical host1x DRM device. Reviewed-by: Daniel Vetter Signed-off-by: Thierry Reding commit be0b23f28c028bf11e47d16f79c784106286bcb7 Author: Thierry Reding Date: Tue Dec 3 17:19:10 2019 +0100 drm/tegra: sor: Implement system suspend/resume Upon system suspend, make sure the +5V HDMI regulator is disabled. This avoids potentially leaking current to the HDMI connector. This also makes sure that upon resume the regulator is enabled again, which in some cases is necessary to properly restore the state of the supply on resume. Reviewed-by: Daniel Vetter Signed-off-by: Thierry Reding commit c52e167b41940186d0f4d7364950b654b79b3ef7 Author: Thierry Reding Date: Tue Dec 3 17:19:09 2019 +0100 drm/tegra: Use proper IOVA address for cursor image The IOVA address for the cursor is the result of mapping the buffer object for the given display controller. Make sure to use the proper IOVA address as stored in the cursor's plane state. Reviewed-by: Daniel Vetter Signed-off-by: Thierry Reding commit 49f821919bb9d45de7f1cde6072de01d36235b5d Author: Thierry Reding Date: Tue Dec 3 17:19:08 2019 +0100 drm/tegra: gem: Remove premature import restrictions All the display related blocks on Tegra require contiguous memory. Using the DMA API, there is no knowing at import time which device will end up using the buffer, so it's not known whether or not an IOMMU will be used to map the buffer. Move the check for non-contiguous buffers/mappings to the tegra_dc_pin() function which is now the earliest point where it is known if a DMA BUF can be used by the given device or not. v2: add check for contiguous buffer/mapping in tegra_dc_pin() Reviewed-by: Daniel Vetter Signed-off-by: Thierry Reding commit 1f16deac766926f1f59a7c038e939b09ef8edfc8 Author: Thierry Reding Date: Tue Dec 3 17:19:07 2019 +0100 drm/tegra: gem: Properly pin imported buffers Buffers that are imported from a DMA-BUF don't have pages allocated with them. At the same time an SG table for them can't be derived using the DMA API helpers because the necessary information doesn't exist. However there's already an SG table that was created during import, so this can simply be duplicated. Signed-off-by: Thierry Reding commit 9569c3e9227c03e2b5eb341676e46b0bcbbeaa01 Author: Thierry Reding Date: Tue Dec 3 17:19:06 2019 +0100 drm/tegra: hub: Remove bogus connection mutex check The Tegra DRM never actually took that lock, so the driver was broken until generic locking was added in commit: commit b962a12050a387e4bbf3a48745afe1d29d396b0d Author: Rob Clark Date: Mon Oct 22 14:31:22 2018 +0200 drm/atomic: integrate modeset lock with private objects It's now no longer necessary to take that lock, so drop the check. v2: add rationale for why it is now safe to drop the check (Daniel) Reviewed-by: Daniel Vetter Signed-off-by: Thierry Reding commit 5e9c5236b7b86779b53b762f7e66240c3f18314b Author: Huanpeng Xin Date: Wed Dec 4 15:13:59 2019 +0800 spi: sprd: Fix the incorrect SPI register The original code used an incorrect SPI register to initialize the SPI controller in sprd_spi_init_hw(), thus fix it. Fixes: e7d973a31c24 ("spi: sprd: Add SPI driver for Spreadtrum SC9860") Signed-off-by: Huanpeng Xin Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/b4f7f89ec0fdc595335687bfbd9f962213bc4a1d.1575443510.git.baolin.wang7@gmail.com Signed-off-by: Mark Brown commit f3c7f7b636ef5061906aa119eccc2b8dbbaf7199 Author: Christophe JAILLET Date: Tue Dec 3 22:48:38 2019 +0100 regulator: s5m8767: Fix a warning message Axe a duplicated word ("property") in a warning message. Signed-off-by: Christophe JAILLET Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191203214838.9680-1-christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit 7eccc05c7101f34cc36afe9405d15de6d4099fb4 Author: Hans de Goede Date: Tue Dec 3 23:14:42 2019 +0100 ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89 When the Teclast X89 quirk was added we did not have jack-detection support yet. Note the over-current detection limit is set to 2mA instead of the usual 1.5mA because this tablet tends to give false-positive button-presses when it is set to 1.5mA. Signed-off-by: Hans de Goede Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191203221442.2657-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit cba779d80a5d4ccb8bdeb799abd02bf7ba9be111 Author: Mark Brown Date: Thu Nov 21 13:51:32 2019 +0000 arm64: mm: Fix column alignment for UXN in kernel_page_tables UXN is the only individual PTE bit other than the PTE_ATTRINDX_MASK ones which doesn't have both a set and a clear value provided, meaning that the columns in the table won't all be aligned. The PTE_ATTRINDX_MASK values are all both mutually exclusive and longer so are listed last to make a single final column for those values. Ensure everything is aligned by providing a clear value for UXN. Acked-by: Mark Rutland Signed-off-by: Mark Brown Signed-off-by: Catalin Marinas commit ca2ef4ffabbef25644e02a98b0f48869f8be0375 Author: Mark Rutland Date: Mon Dec 2 16:11:07 2019 +0000 arm64: insn: consistently handle exit text A kernel built with KASAN && FTRACE_WITH_REGS && !MODULES, produces a boot-time splat in the bowels of ftrace: | [ 0.000000] ftrace: allocating 32281 entries in 127 pages | [ 0.000000] ------------[ cut here ]------------ | [ 0.000000] WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:2019 ftrace_bug+0x27c/0x328 | [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.4.0-rc3-00008-g7f08ae53a7e3 #13 | [ 0.000000] Hardware name: linux,dummy-virt (DT) | [ 0.000000] pstate: 60000085 (nZCv daIf -PAN -UAO) | [ 0.000000] pc : ftrace_bug+0x27c/0x328 | [ 0.000000] lr : ftrace_init+0x640/0x6cc | [ 0.000000] sp : ffffa000120e7e00 | [ 0.000000] x29: ffffa000120e7e00 x28: ffff00006ac01b10 | [ 0.000000] x27: ffff00006ac898c0 x26: dfffa00000000000 | [ 0.000000] x25: ffffa000120ef290 x24: ffffa0001216df40 | [ 0.000000] x23: 000000000000018d x22: ffffa0001244c700 | [ 0.000000] x21: ffffa00011bf393c x20: ffff00006ac898c0 | [ 0.000000] x19: 00000000ffffffff x18: 0000000000001584 | [ 0.000000] x17: 0000000000001540 x16: 0000000000000007 | [ 0.000000] x15: 0000000000000000 x14: ffffa00010432770 | [ 0.000000] x13: ffff940002483519 x12: 1ffff40002483518 | [ 0.000000] x11: 1ffff40002483518 x10: ffff940002483518 | [ 0.000000] x9 : dfffa00000000000 x8 : 0000000000000001 | [ 0.000000] x7 : ffff940002483519 x6 : ffffa0001241a8c0 | [ 0.000000] x5 : ffff940002483519 x4 : ffff940002483519 | [ 0.000000] x3 : ffffa00011780870 x2 : 0000000000000001 | [ 0.000000] x1 : 1fffe0000d591318 x0 : 0000000000000000 | [ 0.000000] Call trace: | [ 0.000000] ftrace_bug+0x27c/0x328 | [ 0.000000] ftrace_init+0x640/0x6cc | [ 0.000000] start_kernel+0x27c/0x654 | [ 0.000000] random: get_random_bytes called from print_oops_end_marker+0x30/0x60 with crng_init=0 | [ 0.000000] ---[ end trace 0000000000000000 ]--- | [ 0.000000] ftrace faulted on writing | [ 0.000000] [] _GLOBAL__sub_D_65535_0___tracepoint_initcall_level+0x4/0x28 | [ 0.000000] Initializing ftrace call sites | [ 0.000000] ftrace record flags: 0 | [ 0.000000] (0) | [ 0.000000] expected tramp: ffffa000100b3344 This is due to an unfortunate combination of several factors. Building with KASAN results in the compiler generating anonymous functions to register/unregister global variables against the shadow memory. These functions are placed in .text.startup/.text.exit, and given mangled names like _GLOBAL__sub_{I,D}_65535_0_$OTHER_SYMBOL. The kernel linker script places these in .init.text and .exit.text respectively, which are both discarded at runtime as part of initmem. Building with FTRACE_WITH_REGS uses -fpatchable-function-entry=2, which also instruments KASAN's anonymous functions. When these are discarded with the rest of initmem, ftrace removes dangling references to these call sites. Building without MODULES implicitly disables STRICT_MODULE_RWX, and causes arm64's patch_map() function to treat any !core_kernel_text() symbol as something that can be modified in-place. As core_kernel_text() is only true for .text and .init.text, with the latter depending on system_state < SYSTEM_RUNNING, we'll treat .exit.text as something that can be patched in-place. However, .exit.text is mapped read-only. Hence in this configuration the ftrace init code blows up while trying to patch one of the functions generated by KASAN. We could try to filter out the call sites in .exit.text rather than initializing them, but this would be inconsistent with how we handle .init.text, and requires hooking into core bits of ftrace. The behaviour of patch_map() is also inconsistent today, so instead let's clean that up and have it consistently handle .exit.text. This patch teaches patch_map() to handle .exit.text at init time, preventing the boot-time splat above. The flow of patch_map() is reworked to make the logic clearer and minimize redundant conditionality. Fixes: 3b23e4991fb66f6d ("arm64: implement ftrace with regs") Signed-off-by: Mark Rutland Cc: Amit Daniel Kachhap Cc: Ard Biesheuvel Cc: Torsten Duwe Cc: Will Deacon Signed-off-by: Catalin Marinas commit 93b90414c33f59b7960bc8d607da0ce83377e021 Author: Will Deacon Date: Tue Dec 3 12:10:13 2019 +0000 arm64: mm: Fix initialisation of DMA zones on non-NUMA systems John reports that the recently merged commit 1a8e1cef7603 ("arm64: use both ZONE_DMA and ZONE_DMA32") breaks the boot on his DB845C board: | Booting Linux on physical CPU 0x0000000000 [0x517f803c] | Linux version 5.4.0-mainline-10675-g957a03b9e38f | Machine model: Thundercomm Dragonboard 845c | [...] | Built 1 zonelists, mobility grouping on. Total pages: -188245 | Kernel command line: earlycon | firmware_class.path=/vendor/firmware/ androidboot.hardware=db845c | init=/init androidboot.boot_devices=soc/1d84000.ufshc | printk.devkmsg=on buildvariant=userdebug root=/dev/sda2 | androidboot.bootdevice=1d84000.ufshc androidboot.serialno=c4e1189c | androidboot.baseband=sda | msm_drm.dsi_display0=dsi_lt9611_1080_video_display: | androidboot.slot_suffix=_a skip_initramfs rootwait ro init=/init | | This is because, when CONFIG_NUMA=n, zone_sizes_init() fails to handle memblocks that fall entirely within the ZONE_DMA region and erroneously ends up trying to add a negatively-sized region into the following ZONE_DMA32, which is later interpreted as a large unsigned region by the core MM code. Rework the non-NUMA implementation of zone_sizes_init() so that the start address of the memblock being processed is adjusted according to the end of the previous zone, which is then range-checked before updating the hole information of subsequent zones. Cc: Nicolas Saenz Julienne Cc: Christoph Hellwig Cc: Bjorn Andersson Link: https://lore.kernel.org/lkml/CALAqxLVVcsmFrDKLRGRq7GewcW405yTOxG=KR3csVzQ6bXutkA@mail.gmail.com Fixes: 1a8e1cef7603 ("arm64: use both ZONE_DMA and ZONE_DMA32") Reported-by: John Stultz Tested-by: John Stultz Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas commit 7d73710d9ca2564f29d291d0b3badc09efdf25e9 Author: Jim Mattson Date: Tue Dec 3 16:24:42 2019 -0800 kvm: vmx: Stop wasting a page for guest_msrs We will never need more guest_msrs than there are indices in vmx_msr_index. Thus, at present, the guest_msrs array will not exceed 168 bytes. Signed-off-by: Jim Mattson Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini commit 4bf2e385aa59c2fae5f880aa25cfd2b470109093 Author: Curtis Malainey Date: Tue Dec 3 09:30:07 2019 -0800 ASoC: core: Init pcm runtime work early to avoid warnings There are cases where we fail before we reach soc_new_pcm which would init the workqueue. When we fail we attempt to flush the queue which generates warnings from the workqueue subsystem when we have not inited the queue. Solution is to use a proxy function to get around this issue. Signed-off-by: Curtis Malainey Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20191203173007.46504-1-cujomalainey@chromium.org Signed-off-by: Mark Brown commit 433f4ba1904100da65a311033f17a9bf586b287e Author: Paolo Bonzini Date: Wed Dec 4 10:28:54 2019 +0100 KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) The bounds check was present in KVM_GET_SUPPORTED_CPUID but not KVM_GET_EMULATED_CPUID. Reported-by: syzbot+e3f4897236c4eeb8af4f@syzkaller.appspotmail.com Fixes: 84cffe499b94 ("kvm: Emulate MOVBE", 2013-10-29) Signed-off-by: Paolo Bonzini commit 14855954f63608c5622d5eaa964d3872ce5c5514 Author: Paul Durrant Date: Mon Dec 2 11:41:17 2019 +0000 xen-blkback: allow module to be cleanly unloaded Add a module_exit() to perform the necessary clean-up. Signed-off-by: Paul Durrant Reviewed-by: "Roger Pau Monné" Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 196748a276b4dee01177e6b7abcda27cd759de83 Author: Paul Durrant Date: Mon Dec 2 11:41:16 2019 +0000 xen/xenbus: reference count registered modules To prevent a PV driver module being removed whilst attached to its other end, and hence xenbus calling into potentially invalid text, take a reference on the module before calling the probe() method (dropping it if unsuccessful) and drop the reference after returning from the remove() method. Suggested-by: Jan Beulich Signed-off-by: Paul Durrant Reviewed-by: Jan Beulich Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 4f4afc2c9599520300b3f2b3666d2034fca03df3 Author: Michael Ellerman Date: Wed Dec 4 21:20:28 2019 +1100 docs/core-api: Remove possibly confusing sub-headings from Bit Operations The recent commit 81d2c6f81996 ("kasan: support instrumented bitops combined with generic bitops"), split the KASAN instrumented bitops into separate headers for atomic, non-atomic and locking operations. This was done to allow arches to include just the instrumented bitops they need, while also using some of the generic bitops in asm-generic/bitops (which are automatically instrumented). The generic bitops are already split into atomic, non-atomic and locking headers. This split required an update to kernel-api.rst because it included include/asm-generic/bitops-instrumented.h, which no longer exists. So now kernel-api.rst includes all three instrumented headers to get the definitions for all the bitops. When adding the three headers it seemed sensible to add sub-headings for each, ie. "Atomic", "Non-atomic" and "Locking". The confusion is that test_bit() is (and always has been) in non-atomic.h, but is documented elsewhere (atomic_bitops.txt) as being atomic. So having it appear under the "Non-atomic" heading is possibly confusing. Probably test_bit() should move from bitops/non-atomic.h to atomic.h, but that has flow on effects. For now just remove the newly added sub-headings in the documentation, so we at least aren't adding to the confusion about whether test_bit() is atomic or not. Signed-off-by: Michael Ellerman commit af164898482817a1d487964b68f3c21bae7a1beb Author: Dave Young Date: Wed Dec 4 15:52:33 2019 +0800 x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage Michael Weiser reported that he got this error during a kexec rebooting: esrt: Unsupported ESRT version 2904149718861218184. The ESRT memory stays in EFI boot services data, and it was reserved in kernel via efi_mem_reserve(). The initial purpose of the reservation is to reuse the EFI boot services data across kexec reboot. For example the BGRT image data and some ESRT memory like Michael reported. But although the memory is reserved it is not updated in the X86 E820 table, and kexec_file_load() iterates system RAM in the IO resource list to find places for kernel, initramfs and other stuff. In Michael's case the kexec loaded initramfs overwrote the ESRT memory and then the failure happened. Since kexec_file_load() depends on the E820 table being updated, just fix this by updating the reserved EFI boot services memory as reserved type in E820. Originally any memory descriptors with EFI_MEMORY_RUNTIME attribute are bypassed in the reservation code path because they are assumed as reserved. But the reservation is still needed for multiple kexec reboots, and it is the only possible case we come here thus just drop the code chunk, then everything works without side effects. On my machine the ESRT memory sits in an EFI runtime data range, it does not trigger the problem, but I successfully tested with BGRT instead. both kexec_load() and kexec_file_load() work and kdump works as well. [ mingo: Edited the changelog. ] Reported-by: Michael Weiser Tested-by: Michael Weiser Signed-off-by: Dave Young Cc: Ard Biesheuvel Cc: Borislav Petkov Cc: Eric W. Biederman Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: kexec@lists.infradead.org Cc: linux-efi@vger.kernel.org Link: https://lkml.kernel.org/r/20191204075233.GA10520@dhcp-128-65.nay.redhat.com Signed-off-by: Ingo Molnar commit b65d56305c6f5c74b1b4fcaf55d48e949e49d67c Merge: 833a426cc471 627ead724eff 90ed9c639c1b a7583e72a5f2 feb174069fd7 Author: Rafael J. Wysocki Date: Wed Dec 4 10:24:33 2019 +0100 Merge branches 'acpi-bus', 'acpi-button', 'acpi-sysfs' and 'acpi-misc' * acpi-bus: ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() * acpi-button: ACPI: button: Add DMI quirk for Acer Switch 10 SW5-032 lid-switch * acpi-sysfs: ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100 * acpi-misc: ACPI: Fix Kconfig indentation commit 1e4230f56dac141eb149ebec01f41b6fad27e503 Merge: 36a8015f89e4 024aa8732acb 4d30d4a0441d cde10f856a7d e1e047ace8ce 2a0efc77735b Author: Rafael J. Wysocki Date: Wed Dec 4 10:20:17 2019 +0100 Merge branches 'pm-sleep', 'pm-cpuidle', 'pm-cpufreq', 'pm-devfreq' and 'pm-avs' * pm-sleep: ACPI: PM: s2idle: Rework ACPI events synchronization ACPI: EC: Rework flushing of pending work * pm-cpuidle: cpuidle: minor Kconfig help text fixes cpuidle: Drop disabled field from struct cpuidle_state cpuidle: Fix Kconfig indentation * pm-cpufreq: cpufreq: Fix Kconfig indentation * pm-devfreq: PM / devfreq: Add missing locking while setting suspend_freq * pm-avs: power: avs: Fix Kconfig indentation commit 9f58c93efdffc2cba91fdcee010b3e5e8860334d Merge: 596cf45cbf6e 15b3904f8e88 Author: Ingo Molnar Date: Wed Dec 4 08:49:52 2019 +0100 Merge tag 'perf-core-for-mingo-5.5-20191203' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: perf report/top: - Fix segfault due to missing initialization of recently introduced struct map_symbol 'maps' field in append_inlines(), when running with DWARF callchains. perf stat: Andi Kleen: - Affinity based optimizations for sessions with many events in machines with large core counts, avoiding excessive number of IPIs. libtraceevent: - Sudip Mukherjee: - Fix installation with O=. - Copy pkg-config file to output folder when using O=. perf bench: Arnaldo Carvalho de Melo: - Update the copies of x86's mem{cpy,set}_64.S, and because that now uses new stuff in linux/linkage.h, update that header too, which made the minimal clang version to build perf to be 3.5, as 3.4 as found in some of the container images used to test build perf can't grok STT_FUNC as a token in .type lines. ABI headers: Arnaldo Carvalho de Melo: - Sync x86's msr-index.h copy with the kernel sources, resulting in new MSRs to be usable in filter expressions in 'perf trace', such as IA32_TSX_CTRL. - Sync linux/fscrypt.h, linux/stat.h, sched.h and the kvm headers. perf trace: Arnaldo Carvalho de Melo: - Add CLEAR_SIGHAND support for clone's flags arg perf kvm: Arnaldo Carvalho de Melo: - Clarify the 'perf kvm' -i and -o command line options perf test: Ian Rogers: - Move test functionality in to a 'perf test' entry. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 4673402ebf9fc1712fb41cce6a808923481495f3 Author: Corentin Labbe Date: Thu Nov 21 08:14:45 2019 +0000 ia64: agp: Replace empty define with do while It's dangerous to use empty code define. Furthermore it lead to the following warning: drivers/char/agp/generic.c: In function « agp_generic_destroy_page »: drivers/char/agp/generic.c:1266:28: attention : suggest braces around empty body in an « if » statement [-Wempty-body] So let's replace emptyness by "do {} while(0)" Signed-off-by: Corentin Labbe Acked-by: Arnd Bergmann Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/1574324085-4338-6-git-send-email-clabbe@baylibre.com commit 5f448266ce9632c5318a5dbbc024fc7951f089d7 Author: Corentin Labbe Date: Thu Nov 21 08:14:44 2019 +0000 agp: Add bridge parameter documentation This patch add documentation about the bridge parameter in several function. This will fix the following build warning: drivers/char/agp/generic.c:220: warning: No description found for parameter 'bridge' drivers/char/agp/generic.c:364: warning: No description found for parameter 'bridge' drivers/char/agp/generic.c:1283: warning: No description found for parameter 'bridge' Signed-off-by: Corentin Labbe Acked-by: Arnd Bergmann Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/1574324085-4338-5-git-send-email-clabbe@baylibre.com commit 5f1b24a6445ddbfccc8de1f5c1a31394a5b9ac66 Author: Corentin Labbe Date: Thu Nov 21 08:14:43 2019 +0000 agp: remove unused variable num_segments This patch fix the following build warning: warning: variable 'num_segments' set but not used [-Wunused-but-set-variable] Signed-off-by: Corentin Labbe Acked-by: Arnd Bergmann Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/1574324085-4338-4-git-send-email-clabbe@baylibre.com commit 0f109f0e9a608c381846b3f2270a6a7b72158cb4 Author: Corentin Labbe Date: Thu Nov 21 08:14:42 2019 +0000 agp: move AGPGART_MINOR to include/linux/miscdevice.h This patch move the define for AGPGART_MINOR to include/linux/miscdevice.h. It is better that all minor number definitions are in the same place. Signed-off-by: Corentin Labbe Acked-by: Arnd Bergmann Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/1574324085-4338-3-git-send-email-clabbe@baylibre.com commit 9fc785f17dec699cfe3891077e7506c92193a91b Author: Corentin Labbe Date: Thu Nov 21 08:14:41 2019 +0000 agp: remove unused variable size in agp_generic_create_gatt_table This patch fix the following warning: drivers/char/agp/generic.c:853:6: attention : variable ‘size’ set but not used [-Wunused-but-set-variable] by removing the unused variable size in agp_generic_create_gatt_table Signed-off-by: Corentin Labbe Acked-by: Arnd Bergmann Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/1574324085-4338-2-git-send-email-clabbe@baylibre.com commit 909a60652624b837aff16825197c6a21d84fec82 Merge: 3e25dbca8b75 008037d4d972 Author: Dave Airlie Date: Wed Dec 4 10:13:16 2019 +1000 Merge tag 'drm-next-5.5-2019-12-03' of git://people.freedesktop.org/~agd5f/linux into drm-next drm-next-5.5-2019-12-03: amdgpu: - Fix vram lost handling with BACO on VI/CI asics - DC fixes for Navi14 - Misc gfx10 fixes - SR-IOV fixes - Fix driver unload - Fix XGMI limits on Arcturus amdkfd: - Enable KFD on PPC - Optimize KFD page table reservations radeon: - Fix register checker for r1xx/r2xx Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20191203204135.5437-1-alexander.deucher@amd.com commit 798a9cada4694ca8d970259f216cec47e675bfd5 Author: Brian Foster Date: Tue Dec 3 07:53:15 2019 -0800 xfs: fix mount failure crash on invalid iclog memory access syzbot (via KASAN) reports a use-after-free in the error path of xlog_alloc_log(). Specifically, the iclog freeing loop doesn't handle the case of a fully initialized ->l_iclog linked list. Instead, it assumes that the list is partially constructed and NULL terminated. This bug manifested because there was no possible error scenario after iclog list setup when the original code was added. Subsequent code and associated error conditions were added some time later, while the original error handling code was never updated. Fix up the error loop to terminate either on a NULL iclog or reaching the end of the list. Reported-by: syzbot+c732f8644185de340492@syzkaller.appspotmail.com Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 63de37476ebd1e9bab6a9e17186dc5aa1da9ea99 Merge: 388c645a33a7 856a0a6e2d09 Author: Linus Torvalds Date: Tue Dec 3 14:37:12 2019 -0800 Merge tag 'tag-chrome-platform-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform changes from Benson Leung: "CrOS EC / MFD / IIO: - Contains tag-ib-chrome-mfd-iio-input-5.5, which is the first part of a series from Gwendal to refactor sensor code between MFD, CrOS EC, iio and input in order to add a new sensorhub driver and FIFO processing Wilco EC: - Add support for Dell's USB PowerShare policy control, keyboard backlight LED driver, and a new test_event file. - Fixes use after free in wilco_ec's telemetry driver. Misc: - bugfix in cros_usbpd_logger (missing destroy workqueue)" * tag 'tag-chrome-platform-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: wilco_ec: fix use after free issue platform/chrome: cros_ec: Add Kconfig default for cros-ec-sensorhub Revert "Input: cros_ec_keyb: mask out extra flags in event_type" Revert "Input: cros_ec_keyb - add back missing mask for event_type" platform/chrome: cros_ec: handle MKBP more events flag platform/chrome: cros_ec: Do not attempt to register a non-positive IRQ number platform/chrome: cros-ec: Record event timestamp in the hard irq mfd / platform / iio: cros_ec: Register sensor through sensorhub iio / platform: cros_ec: Add cros-ec-sensorhub driver mfd / platform: cros_ec: Add sensor_count and make check_features public platform/chrome: cros_ec: Put docs with the code platform/chrome: cros_usbpd_logger: add missed destroy_workqueue in remove platform/chrome: cros_ec: Fix Kconfig indentation platform/chrome: wilco_ec: Add keyboard backlight LED support platform/chrome: wilco_ec: Add charging config driver platform/chrome: wilco_ec: Add Dell's USB PowerShare Policy control platform/chrome: wilco_ec: Add debugfs test_event file commit 388c645a33a739bb96aa5ffe283ec68786ea7890 Merge: 537bd0a159a0 bf49d9dd6fef Author: Linus Torvalds Date: Tue Dec 3 14:20:21 2019 -0800 Merge tag 'spdx-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull SPDX fix from Greg KH: "Here is a single SPDX fixup for 5.5-rc1 It resolves an issue where we had missed a few .h files with the auto-tagging scripts because they had "GPL" text in strings within the file themselves. This single patch fixes up the issue and provides the proper SPDX tags at the top of them as needed. This patch has been in linux-next for many many weeks now with no reported issues" * tag 'spdx-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: export,module: add SPDX GPL-2.0 license identifier to headers with no license commit 537bd0a159a041fad72d257d755205cef77582e1 Merge: c3bed3b20e40 27ed14d0ecb3 Author: Linus Torvalds Date: Tue Dec 3 14:09:14 2019 -0800 Merge tag 'tty-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here is the "big" tty and serial driver patches for 5.5-rc1. It's a bit later in the merge window than normal as I wanted to make sure some last-minute patches applied to it were all sane. They seem to be :) There's a lot of little stuff in here, for the tty core, and for lots of serial drivers: - reverts of uartlite serial driver patches that were wrong - msm-serial driver fixes - serial core updates and fixes - tty core fixes - serial driver dma mapping api changes - lots of other tiny fixes and updates for serial drivers All of these have been in linux-next for a while with no reported issues" * tag 'tty-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (58 commits) Revert "serial/8250: Add support for NI-Serial PXI/PXIe+485 devices" vcs: prevent write access to vcsu devices tty: vt: keyboard: reject invalid keycodes tty: don't crash in tty_init_dev when missing tty_port serial: stm32: fix clearing interrupt error flags tty: Fix Kconfig indentation, continued serial: serial_core: Perform NULL checks for break_ctl ops tty: remove unused argument from tty_open_by_driver() tty: Fix Kconfig indentation {tty: serial, nand: onenand}: samsung: rename to fix build warning serial: ifx6x60: add missed pm_runtime_disable serial: pl011: Fix DMA ->flush_buffer() Revert "serial-uartlite: Move the uart register" Revert "serial-uartlite: Add get serial id if not provided" Revert "serial-uartlite: Do not use static struct uart_driver out of probe()" Revert "serial-uartlite: Add runtime support" Revert "serial-uartlite: Change logic how console_port is setup" Revert "serial-uartlite: Use allocated structure instead of static ones" tty: serial: msm_serial: Use dma_request_chan() directly for channel request tty: serial: tegra: Use dma_request_chan() directly for channel request ... commit c3bed3b20e40ab44b98ac5f0471a5bd92a802f5a Merge: 4672c2f2026d 7e124c405172 Author: Linus Torvalds Date: Tue Dec 3 13:58:22 2019 -0800 Merge tag 'pci-v5.5-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: "Enumeration: - Warn if a host bridge has no NUMA info (Yunsheng Lin) - Add PCI_STD_NUM_BARS for the number of standard BARs (Denis Efremov) Resource management: - Fix boot-time Embedded Controller GPE storm caused by incorrect resource assignment after ACPI Bus Check Notification (Mika Westerberg) - Protect pci_reassign_bridge_resources() against concurrent addition/removal (Benjamin Herrenschmidt) - Fix bridge dma_ranges resource list cleanup (Rob Herring) - Add "pci=hpmmiosize" and "pci=hpmmioprefsize" parameters to control the MMIO and prefetchable MMIO window sizes of hotplug bridges independently (Nicholas Johnson) - Fix MMIO/MMIO_PREF window assignment that assigned more space than desired (Nicholas Johnson) - Only enforce bus numbers from bridge EA if the bridge has EA devices downstream (Subbaraya Sundeep) - Consolidate DT "dma-ranges" parsing and convert all host drivers to use shared parsing (Rob Herring) Error reporting: - Restore AER capability after resume (Mayurkumar Patel) - Add PoisonTLPBlocked AER counter (Rajat Jain) - Use for_each_set_bit() to simplify AER code (Andy Shevchenko) - Fix AER kernel-doc (Andy Shevchenko) - Add "pcie_ports=dpc-native" parameter to allow native use of DPC even if platform didn't grant control over AER (Olof Johansson) Hotplug: - Avoid returning prematurely from sysfs requests to enable or disable a PCIe hotplug slot (Lukas Wunner) - Don't disable interrupts twice when suspending hotplug ports (Mika Westerberg) - Fix deadlocks when PCIe ports are hot-removed while suspended (Mika Westerberg) Power management: - Remove unnecessary ASPM locking (Bjorn Helgaas) - Add support for disabling L1 PM Substates (Heiner Kallweit) - Allow re-enabling Clock PM after it has been disabled (Heiner Kallweit) - Add sysfs attributes for controlling ASPM link states (Heiner Kallweit) - Remove CONFIG_PCIEASPM_DEBUG, including "link_state" and "clk_ctl" sysfs files (Heiner Kallweit) - Avoid AMD FCH XHCI USB PME# from D0 defect that prevents wakeup on USB 2.0 or 1.1 connect events (Kai-Heng Feng) - Move power state check out of pci_msi_supported() (Bjorn Helgaas) - Fix incorrect MSI-X masking on resume and revert related nvme quirk for Kingston NVME SSD running FW E8FK11.T (Jian-Hong Pan) - Always return devices to D0 when thawing to fix hibernation with drivers like mlx4 that used legacy power management (previously we only did it for drivers with new power management ops) (Dexuan Cui) - Clear PCIe PME Status even for legacy power management (Bjorn Helgaas) - Fix PCI PM documentation errors (Bjorn Helgaas) - Use dev_printk() for more power management messages (Bjorn Helgaas) - Apply D2 delay as milliseconds, not microseconds (Bjorn Helgaas) - Convert xen-platform from legacy to generic power management (Bjorn Helgaas) - Removed unused .resume_early() and .suspend_late() legacy power management hooks (Bjorn Helgaas) - Rearrange power management code for clarity (Rafael J. Wysocki) - Decode power states more clearly ("4" or "D4" really refers to "D3cold") (Bjorn Helgaas) - Notice when reading PM Control register returns an error (~0) instead of interpreting it as being in D3hot (Bjorn Helgaas) - Add missing link delays required by the PCIe spec (Mika Westerberg) Virtualization: - Move pci_prg_resp_pasid_required() to CONFIG_PCI_PRI (Bjorn Helgaas) - Allow VFs to use PRI (the PF PRI is shared by the VFs, but the code previously didn't recognize that) (Kuppuswamy Sathyanarayanan) - Allow VFs to use PASID (the PF PASID capability is shared by the VFs, but the code previously didn't recognize that) (Kuppuswamy Sathyanarayanan) - Disconnect PF and VF ATS enablement, since ATS in PFs and associated VFs can be enabled independently (Kuppuswamy Sathyanarayanan) - Cache PRI and PASID capability offsets (Kuppuswamy Sathyanarayanan) - Cache the PRI PRG Response PASID Required bit (Bjorn Helgaas) - Consolidate ATS declarations in linux/pci-ats.h (Krzysztof Wilczynski) - Remove unused PRI and PASID stubs (Bjorn Helgaas) - Removed unnecessary EXPORT_SYMBOL_GPL() from ATS, PRI, and PASID interfaces that are only used by built-in IOMMU drivers (Bjorn Helgaas) - Hide PRI and PASID state restoration functions used only inside the PCI core (Bjorn Helgaas) - Add a DMA alias quirk for the Intel VCA NTB (Slawomir Pawlowski) - Serialize sysfs sriov_numvfs reads vs writes (Pierre Crégut) - Update Cavium ACS quirk for ThunderX2 and ThunderX3 (George Cherian) - Fix the UPDCR register address in the Intel ACS quirk (Steffen Liebergeld) - Unify ACS quirk implementations (Bjorn Helgaas) Amlogic Meson host bridge driver: - Fix meson PERST# GPIO polarity problem (Remi Pommarel) - Add DT bindings for Amlogic Meson G12A (Neil Armstrong) - Fix meson clock names to match DT bindings (Neil Armstrong) - Add meson support for Amlogic G12A SoC with separate shared PHY (Neil Armstrong) - Add meson extended PCIe PHY functions for Amlogic G12A USB3+PCIe combo PHY (Neil Armstrong) - Add arm64 DT for Amlogic G12A PCIe controller node (Neil Armstrong) - Add commented-out description of VIM3 USB3/PCIe mux in arm64 DT (Neil Armstrong) Broadcom iProc host bridge driver: - Invalidate iProc PAXB address mapping before programming it (Abhishek Shah) - Fix iproc-msi and mvebu __iomem annotations (Ben Dooks) Cadence host bridge driver: - Refactor Cadence PCIe host controller to use as a library for both host and endpoint (Tom Joseph) Freescale Layerscape host bridge driver: - Add layerscape LS1028a support (Xiaowei Bao) Intel VMD host bridge driver: - Add VMD bus 224-255 restriction decode (Jon Derrick) - Add VMD 8086:9A0B device ID (Jon Derrick) - Remove Keith from VMD maintainer list (Keith Busch) Marvell ARMADA 3700 / Aardvark host bridge driver: - Use LTSSM state to build link training flag since Aardvark doesn't implement the Link Training bit (Remi Pommarel) - Delay before training Aardvark link in case PERST# was asserted before the driver probe (Remi Pommarel) - Fix Aardvark issues with Root Control reads and writes (Remi Pommarel) - Don't rely on jiffies in Aardvark config access path since interrupts may be disabled (Remi Pommarel) - Fix Aardvark big-endian support (Grzegorz Jaszczyk) Marvell ARMADA 370 / XP host bridge driver: - Make mvebu_pci_bridge_emul_ops static (Ben Dooks) Microsoft Hyper-V host bridge driver: - Add hibernation support for Hyper-V virtual PCI devices (Dexuan Cui) - Track Hyper-V pci_protocol_version per-hbus, not globally (Dexuan Cui) - Avoid kmemleak false positive on hv hbus buffer (Dexuan Cui) Mobiveil host bridge driver: - Change mobiveil csr_read()/write() function names that conflict with riscv arch functions (Kefeng Wang) NVIDIA Tegra host bridge driver: - Fix Tegra CLKREQ dependency programming (Vidya Sagar) Renesas R-Car host bridge driver: - Remove unnecessary header include from rcar (Andrew Murray) - Tighten register index checking for rcar inbound range programming (Marek Vasut) - Fix rcar inbound range alignment calculation to improve packing of multiple entries (Marek Vasut) - Update rcar MACCTLR setting to match documentation (Yoshihiro Shimoda) - Clear bit 0 of MACCTLR before PCIETCTLR.CFINIT per manual (Yoshihiro Shimoda) - Add Marek Vasut and Yoshihiro Shimoda as R-Car maintainers (Simon Horman) Rockchip host bridge driver: - Make rockchip 0V9 and 1V8 power regulators non-optional (Robin Murphy) Socionext UniPhier host bridge driver: - Set uniphier to host (RC) mode always (Kunihiko Hayashi) Endpoint drivers: - Fix endpoint driver sign extension problem when shifting page number to phys_addr_t (Alan Mikhak) Misc: - Add NumaChip SPDX header (Krzysztof Wilczynski) - Replace EXTRA_CFLAGS with ccflags-y (Krzysztof Wilczynski) - Remove unused includes (Krzysztof Wilczynski) - Removed unused sysfs attribute groups (Ben Dooks) - Remove PTM and ASPM dependencies on PCIEPORTBUS (Bjorn Helgaas) - Add PCIe Link Control 2 register field definitions to replace magic numbers in AMDGPU and Radeon CIK/SI (Bjorn Helgaas) - Fix incorrect Link Control 2 Transmit Margin usage in AMDGPU and Radeon CIK/SI PCIe Gen3 link training (Bjorn Helgaas) - Use pcie_capability_read_word() instead of pci_read_config_word() in AMDGPU and Radeon CIK/SI (Frederick Lawler) - Remove unused pci_irq_get_node() Greg Kroah-Hartman) - Make asm/msi.h mandatory and simplify PCI_MSI_IRQ_DOMAIN Kconfig (Palmer Dabbelt, Michal Simek) - Read all 64 bits of Switchtec part_event_bitmap (Logan Gunthorpe) - Fix erroneous intel-iommu dependency on CONFIG_AMD_IOMMU (Bjorn Helgaas) - Fix bridge emulation big-endian support (Grzegorz Jaszczyk) - Fix dwc find_next_bit() usage (Niklas Cassel) - Fix pcitest.c fd leak (Hewenliang) - Fix typos and comments (Bjorn Helgaas) - Fix Kconfig whitespace errors (Krzysztof Kozlowski)" * tag 'pci-v5.5-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (160 commits) PCI: Remove PCI_MSI_IRQ_DOMAIN architecture whitelist asm-generic: Make msi.h a mandatory include/asm header Revert "nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T" PCI/MSI: Fix incorrect MSI-X masking on resume PCI/MSI: Move power state check out of pci_msi_supported() PCI/MSI: Remove unused pci_irq_get_node() PCI: hv: Avoid a kmemleak false positive caused by the hbus buffer PCI: hv: Change pci_protocol_version to per-hbus PCI: hv: Add hibernation support PCI: hv: Reorganize the code in preparation of hibernation MAINTAINERS: Remove Keith from VMD maintainer PCI/ASPM: Remove PCIEASPM_DEBUG Kconfig option and related code PCI/ASPM: Add sysfs attributes for controlling ASPM link states PCI: Fix indentation drm/radeon: Prefer pcie_capability_read_word() drm/radeon: Replace numbers with PCI_EXP_LNKCTL2 definitions drm/radeon: Correct Transmit Margin masks drm/amdgpu: Prefer pcie_capability_read_word() PCI: uniphier: Set mode register to host mode drm/amdgpu: Replace numbers with PCI_EXP_LNKCTL2 definitions ... commit 43f8a6a74ee2442b9410ed297f5d4c77e7cb5ace Author: Steve French Date: Mon Dec 2 21:46:54 2019 -0600 smb3: query attributes on file close Since timestamps on files on most servers can be updated at close, and since timestamps on our dentries default to one second we can have stale timestamps in some common cases (e.g. open, write, close, stat, wait one second, stat - will show different mtime for the first and second stat). The SMB2/SMB3 protocol allows querying timestamps at close so add the code to request timestamp and attr information (which is cheap for the server to provide) to be returned when a file is closed (it is not needed for the many paths that call SMB2_close that are from compounded query infos and close nor is it needed for some of the cases where a directory close immediately follows a directory open. Signed-off-by: Steve French Acked-by: Ronnie Sahlberg Reviewed-by: Aurelien Aptel Reviewed-by: Pavel Shilovsky commit 4672c2f2026dbc46b20647803426561fe2d460ea Merge: 2a31aca50067 f830f7cf4752 Author: Linus Torvalds Date: Tue Dec 3 13:31:08 2019 -0800 Merge tag 'rtc-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "A lot of unnecessary code removal in here that ends up decreasing the number of lines in the subsystem. The ds1343 and ds1347 drivers got cleaned up. The rest are the usual fixes and new features. Subsystem: - fix warnings and errors with make W=1 - UIE are now disabled while setting the RTC time - UIE are now disallowed when the RTC time is not set. Drivers: - remove unecessary .remove callbacks - Set RTC range for cros-ec, ds1343, ds1347, m41t80, s35390a, vt8500 - Use devm_platform_ioremap_resource where applicable - rv3028: add clock out support" * tag 'rtc-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (81 commits) rtc: Fix Kconfig indentation rtc: xgene: Remove unused struct device in struct xgene_rtc_dev rtc: sun6i: Remove struct device from sun6i_rtc_dev rtc: st-lpc: Remove struct resource from struct st_rtc rtc: pcf8523: Remove struct pcf8523 rtc: meson: remove redundant assignment to variable retries rtc: v3020: remove set but unused variable rtc: tegra: remove set but unused variable rtc: pm8xxx: update kerneldoc for struct pm8xxx_rtc rtc: m41t80: remove excess kerneldoc rtc: ds1685: fix build error with make W=1 rtc: ds1685: remove set but unused variables rtc: ds1374: remove unused variable rtc: sysfs: fix hctosys_show kerneldoc rtc: interface: fix kerneldoc comments rtc: msm6242: Remove unneeded msm6242_set()/msm6242_clear() functions rtc: msm6242: Fix reading of 10-hour digit rtc: tps65910: allow using RTC without alarm interrupt rtc: fsl-ftm-alarm: remove select FSL_RCPM and default y from Kconfig rtc: pcf8563: Constify clkout_rates ... commit d6d07ca19c045924f2b9cac14cb277cc34f85d43 Author: Guenter Roeck Date: Mon Dec 2 05:36:50 2019 -0800 drm/dp_mst: Fix build on systems with STACKTRACE_SUPPORT=n On systems with STACKTRACE_SUPPORT=n, we get: WARNING: unmet direct dependencies detected for STACKTRACE Depends on [n]: STACKTRACE_SUPPORT Selected by [y]: - STACKDEPOT [=y] and build errors such as: m68k-linux-ld: kernel/stacktrace.o: in function `stack_trace_save': (.text+0x11c): undefined reference to `save_stack_trace' Add the missing deendency on STACKTRACE_SUPPORT. Fixes: 12a280c72868 ("drm/dp_mst: Add topology ref history tracking for debugging") Cc: Lyude Paul Cc: Sean Paul Signed-off-by: Guenter Roeck Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20191202133650.11964-1-linux@roeck-us.net commit 2a31aca5006749f7d4655836c61d4a53bfae8e53 Merge: 79e178a57dae 88cfd30e188f Author: Linus Torvalds Date: Tue Dec 3 13:18:34 2019 -0800 Merge tag 'iomap-5.5-merge-13' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap cleanups from Darrick Wong: "Aome more new iomap code for 5.5. There's not much this time -- just removing some local variables that don't need to exist in the iomap directio code" * tag 'iomap-5.5-merge-13' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: remove unneeded variable in iomap_dio_rw() iomap: Do not create fake iter in iomap_dio_bio_actor() commit f9bd84a8a845d82f9b5a081a7ae68c98a11d2e84 Author: SeongJae Park Date: Tue Nov 26 16:36:05 2019 +0100 xen/blkback: Avoid unmapping unmapped grant pages For each I/O request, blkback first maps the foreign pages for the request to its local pages. If an allocation of a local page for the mapping fails, it should unmap every mapping already made for the request. However, blkback's handling mechanism for the allocation failure does not mark the remaining foreign pages as unmapped. Therefore, the unmap function merely tries to unmap every valid grant page for the request, including the pages not mapped due to the allocation failure. On a system that fails the allocation frequently, this problem leads to following kernel crash. [ 372.012538] BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 [ 372.012546] IP: [] gnttab_unmap_refs.part.7+0x1c/0x40 [ 372.012557] PGD 16f3e9067 PUD 16426e067 PMD 0 [ 372.012562] Oops: 0002 [#1] SMP [ 372.012566] Modules linked in: act_police sch_ingress cls_u32 ... [ 372.012746] Call Trace: [ 372.012752] [] gnttab_unmap_refs+0x34/0x40 [ 372.012759] [] xen_blkbk_unmap+0x83/0x150 [xen_blkback] ... [ 372.012802] [] dispatch_rw_block_io+0x970/0x980 [xen_blkback] ... Decompressing Linux... Parsing ELF... done. Booting the kernel. [ 0.000000] Initializing cgroup subsys cpuset This commit fixes this problem by marking the grant pages of the given request that didn't mapped due to the allocation failure as invalid. Fixes: c6cc142dac52 ("xen-blkback: use balloon pages for all mappings") Reviewed-by: David Woodhouse Reviewed-by: Maximilian Heyne Reviewed-by: Paul Durrant Reviewed-by: Roger Pau Monné Signed-off-by: SeongJae Park Signed-off-by: Jens Axboe commit 79e178a57dae819ae724065b47c25720494cc9f2 Merge: 01d1dff64662 341c1fda5e17 Author: Linus Torvalds Date: Tue Dec 3 12:51:35 2019 -0800 Merge tag 'apparmor-pr-2019-12-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor updates from John Johansen: "Features: - increase left match history buffer size to provide improved conflict resolution in overlapping execution rules. - switch buffer allocation to use a memory pool and GFP_KERNEL where possible. - add compression of policy blobs to reduce memory usage. Cleanups: - fix spelling mistake "immutible" -> "immutable" Bug fixes: - fix unsigned len comparison in update_for_len macro - fix sparse warning for type-casting of current->real_cred" * tag 'apparmor-pr-2019-12-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor: make it so work buffers can be allocated from atomic context apparmor: reduce rcu_read_lock scope for aa_file_perm mediation apparmor: fix wrong buffer allocation in aa_new_mount apparmor: fix unsigned len comparison with less than zero apparmor: increase left match history buffer size apparmor: Switch to GFP_KERNEL where possible apparmor: Use a memory pool instead per-CPU caches apparmor: Force type-casting of current->real_cred apparmor: fix spelling mistake "immutible" -> "immutable" apparmor: fix blob compression when ns is forced on a policy load apparmor: fix missing ZLIB defines apparmor: fix blob compression build failure on ppc apparmor: Initial implementation of raw policy blob compression commit 01d1dff64662646023482806c6db8ef0b280c403 Merge: 4d7048f55104 2115fbf7210b Author: Linus Torvalds Date: Tue Dec 3 12:50:00 2019 -0800 Merge tag 's390-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Vasily Gorbik: - Make stack unwinder reliable and suitable for livepatching. Add unwinder testing module. - Fixes for CALL_ON_STACK helper used for stack switching. - Fix unwinding from bpf code. - Fix getcpu and remove compat support in vdso code. - Fix address space control registers initialization. - Save KASLR offset for early dumps. - Handle new FILTERED_BY_HYPERVISOR reply code in crypto code. - Minor perf code cleanup and potential memory leak fix. - Add couple of error messages for corner cases during PCI device creation. * tag 's390-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (33 commits) s390: remove compat vdso code s390/livepatch: Implement reliable stack tracing for the consistency model s390/unwind: add stack pointer alignment sanity checks s390/unwind: filter out unreliable bogus %r14 s390/unwind: start unwinding from reliable state s390/test_unwind: add program check context tests s390/test_unwind: add irq context tests s390/test_unwind: print verbose unwinding results s390/test_unwind: add CALL_ON_STACK tests s390: fix register clobbering in CALL_ON_STACK s390/test_unwind: require that unwinding ended successfully s390/unwind: add a test for the internal API s390/unwind: always inline get_stack_pointer s390/pci: add error message on device number limit s390/pci: add error message for UID collision s390/cpum_sf: Check for SDBT and SDB consistency s390/cpum_sf: Use TEAR_REG macro consistantly s390/cpum_sf: Remove unnecessary check for pending SDBs s390/cpum_sf: Replace function name in debug statements s390/kaslr: store KASLR offset for early dumps ... commit 4d7048f55104434ec64fe0b5196cbc89a8f99548 Merge: 043cf46825c1 9d9043f6a817 Author: Linus Torvalds Date: Tue Dec 3 12:46:44 2019 -0800 Merge tag 'xtensa-20191201' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - add support for execute in place (XIP) kernels - improvements in inline assembly: use named arguments and "m" constraints where possible - improve stack dumping - clean up system_call code and syscall tracing - various small fixes and cleanups * tag 'xtensa-20191201' of git://github.com/jcmvbkbc/linux-xtensa: (30 commits) xtensa: clean up system_call/xtensa_rt_sigreturn interaction xtensa: fix system_call interaction with ptrace xtensa: rearrange syscall tracing xtensa: fix syscall_set_return_value xtensa: drop unneeded headers from coprocessor.S xtensa: entry: Remove unneeded need_resched() loop xtensa: use MEMBLOCK_ALLOC_ANYWHERE for KASAN shadow map xtensa: fix TLB sanity checker xtensa: get rid of __ARCH_USE_5LEVEL_HACK xtensa: mm: fix PMD folding implementation xtensa: make stack dump size configurable xtensa: improve stack dumping xtensa: use "m" constraint instead of "r" in futex.h assembly xtensa: use "m" constraint instead of "a" in cmpxchg.h assembly xtensa: use named assembly arguments in cmpxchg.h xtensa: use "m" constraint instead of "a" in atomic.h assembly xtensa: use named assembly arguments in atomic.h xtensa: use "m" constraint instead of "a" in bitops.h assembly xtensa: use named assembly arguments in bitops.h xtensa: use macros to generate *_bit and test_and_*_bit functions ... commit 043cf46825c102683b1027762c09c7e2b749e5a3 Merge: b22bfea7f16c 83bae01182ea Author: Linus Torvalds Date: Tue Dec 3 12:20:25 2019 -0800 Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Ingo Molnar: "The main changes in the timer code in this cycle were: - Clockevent updates: - timer-of framework cleanups. (Geert Uytterhoeven) - Use timer-of for the renesas-ostm and the device name to prevent name collision in case of multiple timers. (Geert Uytterhoeven) - Check if there is an error after calling of_clk_get in asm9260 (Chuhong Yuan) - ABI fix: Zero out high order bits of nanoseconds on compat syscalls. This got broken a year ago, with apparently no side effects so far. Since the kernel would use random data otherwise I don't think we'd have other options but to fix the bug, even if there was a side effect to applications (Dmitry Safonov) - Optimize ns_to_timespec64() on 32-bit systems: move away from div_s64_rem() which can be slow, to div_u64_rem() which is faster (Arnd Bergmann) - Annotate KCSAN-reported false positive data races in hrtimer_is_queued() users by moving timer->state handling over to the READ_ONCE()/WRITE_ONCE() APIs. This documents these accesses (Eric Dumazet) - Misc cleanups and small fixes" [ I undid the "ABI fix" and updated the comments instead. The reason there were apparently no side effects is that the fix was a no-op. The updated comment is to say _why_ it was a no-op. - Linus ] * 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time: Zero the upper 32-bits in __kernel_timespec on 32-bit time: Rename tsk->real_start_time to ->start_boottime hrtimer: Remove the comment about not used HRTIMER_SOFTIRQ time: Fix spelling mistake in comment time: Optimize ns_to_timespec64() hrtimer: Annotate lockless access to timer->state clocksource/drivers/asm9260: Add a check for of_clk_get clocksource/drivers/renesas-ostm: Use unique device name instead of ostm clocksource/drivers/renesas-ostm: Convert to timer_of clocksource/drivers/timer-of: Use unique device name instead of timer clocksource/drivers/timer-of: Convert last full_name to %pOF commit 008037d4d972c9c47b273e40e52ae34f9d9e33e7 Author: Alex Deucher Date: Tue Nov 26 09:41:46 2019 -0500 drm/radeon: fix r1xx/r2xx register checker for POT textures Shift and mask were reversed. Noticed by chance. Tested-by: Meelis Roos Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8ffb055beae58574d3e77b4bf9d4d15eace1ca27 Author: Yoshiki Komachi Date: Tue Dec 3 19:40:12 2019 +0900 cls_flower: Fix the behavior using port ranges with hw-offload The recent commit 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges") had added filtering based on port ranges to tc flower. However the commit missed necessary changes in hw-offload code, so the feature gave rise to generating incorrect offloaded flow keys in NIC. One more detailed example is below: $ tc qdisc add dev eth0 ingress $ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \ dst_port 100-200 action drop With the setup above, an exact match filter with dst_port == 0 will be installed in NIC by hw-offload. IOW, the NIC will have a rule which is equivalent to the following one. $ tc qdisc add dev eth0 ingress $ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \ dst_port 0 action drop The behavior was caused by the flow dissector which extracts packet data into the flow key in the tc flower. More specifically, regardless of exact match or specified port ranges, fl_init_dissector() set the FLOW_DISSECTOR_KEY_PORTS flag in struct flow_dissector to extract port numbers from skb in skb_flow_dissect() called by fl_classify(). Note that device drivers received the same struct flow_dissector object as used in skb_flow_dissect(). Thus, offloaded drivers could not identify which of these is used because the FLOW_DISSECTOR_KEY_PORTS flag was set to struct flow_dissector in either case. This patch adds the new FLOW_DISSECTOR_KEY_PORTS_RANGE flag and the new tp_range field in struct fl_flow_key to recognize which filters are applied to offloaded drivers. At this point, when filters based on port ranges passed to drivers, drivers return the EOPNOTSUPP error because they do not support the feature (the newly created FLOW_DISSECTOR_KEY_PORTS_RANGE flag). Fixes: 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges") Signed-off-by: Yoshiki Komachi Signed-off-by: David S. Miller commit 2f23cd42e19c22c24ff0e221089b7b6123b117c5 Author: Dust Li Date: Tue Dec 3 11:17:40 2019 +0800 net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues sch->q.len hasn't been set if the subqueue is a NOLOCK qdisc in mq_dump() and mqprio_dump(). Fixes: ce679e8df7ed ("net: sched: add support for TCQ_F_NOLOCK subqueues to sch_mqprio") Signed-off-by: Dust Li Signed-off-by: Tony Lu Signed-off-by: David S. Miller commit 0d580fbd2db084a5c96ee9c00492236a279d5e0f Author: Eric Dumazet Date: Tue Dec 3 08:05:52 2019 -0800 tcp: refactor tcp_retransmit_timer() It appears linux-4.14 stable needs a backport of commit 88f8598d0a30 ("tcp: exit if nothing to retransmit on RTO timeout") Since tcp_rtx_queue_empty() is not in pre 4.15 kernels, let's refactor tcp_retransmit_timer() to only use tcp_rtx_queue_head() I will provide to stable teams the squashed patches. Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Cc: Greg Kroah-Hartman Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller commit 643a2cc99b53c13d90c02dc344f780ba9a89e012 Author: Takashi Iwai Date: Tue Dec 3 16:41:05 2019 +0100 ALSA: hda: hdmi - Keep old slot assignment behavior for Intel platforms The commit 609f5485344b ("ALSA: hda: hdmi - preserve non-MST PCM routing for Intel platforms") tried to restore the old behavior wrt assignment of the PCM slot for Intel platforms, but this didn't do it right. As found in the later discussion, a positive pipe id on Intel platforms can be passed for single monitor attachment case. This patch reverts the previous attempt and applies a simpler workaround instead. Actually, for Intel platforms, we can handle as if per_pin->dev_id=0, assign the primary slot at the first try. This assures the compatible behavior with the previous versions regarding the slot assignment. Fixes: 609f5485344b ("ALSA: hda: hdmi - preserve non-MST PCM routing for Intel platforms") Link: https://lore.kernel.org/r/20191203154105.30414-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 9385973fe8db9743fa93bf17245635be4eb8c4a6 Author: Vladimir Oltean Date: Tue Dec 3 17:45:35 2019 +0200 net: mscc: ocelot: unregister the PTP clock on deinit Currently a switch driver deinit frees the regmaps, but the PTP clock is still out there, available to user space via /dev/ptpN. Any PTP operation is a ticking time bomb, since it will attempt to use the freed regmaps and thus trigger kernel panics: [ 4.291746] fsl_enetc 0000:00:00.2 eth1: error -22 setting up slave phy [ 4.291871] mscc_felix 0000:00:00.5: Failed to register DSA switch: -22 [ 4.308666] mscc_felix: probe of 0000:00:00.5 failed with error -22 [ 6.358270] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088 [ 6.367090] Mem abort info: [ 6.369888] ESR = 0x96000046 [ 6.369891] EC = 0x25: DABT (current EL), IL = 32 bits [ 6.369892] SET = 0, FnV = 0 [ 6.369894] EA = 0, S1PTW = 0 [ 6.369895] Data abort info: [ 6.369897] ISV = 0, ISS = 0x00000046 [ 6.369899] CM = 0, WnR = 1 [ 6.369902] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020d58c7000 [ 6.369904] [0000000000000088] pgd=00000020d5912003, pud=00000020d5915003, pmd=0000000000000000 [ 6.369914] Internal error: Oops: 96000046 [#1] PREEMPT SMP [ 6.420443] Modules linked in: [ 6.423506] CPU: 1 PID: 262 Comm: phc_ctl Not tainted 5.4.0-03625-gb7b2a5dadd7f #204 [ 6.431273] Hardware name: LS1028A RDB Board (DT) [ 6.435989] pstate: 40000085 (nZcv daIf -PAN -UAO) [ 6.440802] pc : css_release+0x24/0x58 [ 6.444561] lr : regmap_read+0x40/0x78 [ 6.448316] sp : ffff800010513cc0 [ 6.451636] x29: ffff800010513cc0 x28: ffff002055873040 [ 6.456963] x27: 0000000000000000 x26: 0000000000000000 [ 6.462289] x25: 0000000000000000 x24: 0000000000000000 [ 6.467617] x23: 0000000000000000 x22: 0000000000000080 [ 6.472944] x21: ffff800010513d44 x20: 0000000000000080 [ 6.478270] x19: 0000000000000000 x18: 0000000000000000 [ 6.483596] x17: 0000000000000000 x16: 0000000000000000 [ 6.488921] x15: 0000000000000000 x14: 0000000000000000 [ 6.494247] x13: 0000000000000000 x12: 0000000000000000 [ 6.499573] x11: 0000000000000000 x10: 0000000000000000 [ 6.504899] x9 : 0000000000000000 x8 : 0000000000000000 [ 6.510225] x7 : 0000000000000000 x6 : ffff800010513cf0 [ 6.515550] x5 : 0000000000000000 x4 : 0000000fffffffe0 [ 6.520876] x3 : 0000000000000088 x2 : ffff800010513d44 [ 6.526202] x1 : ffffcada668ea000 x0 : ffffcada64d8b0c0 [ 6.531528] Call trace: [ 6.533977] css_release+0x24/0x58 [ 6.537385] regmap_read+0x40/0x78 [ 6.540795] __ocelot_read_ix+0x6c/0xa0 [ 6.544641] ocelot_ptp_gettime64+0x4c/0x110 [ 6.548921] ptp_clock_gettime+0x4c/0x58 [ 6.552853] pc_clock_gettime+0x5c/0xa8 [ 6.556699] __arm64_sys_clock_gettime+0x68/0xc8 [ 6.561331] el0_svc_common.constprop.2+0x7c/0x178 [ 6.566133] el0_svc_handler+0x34/0xa0 [ 6.569891] el0_sync_handler+0x114/0x1d0 [ 6.573908] el0_sync+0x140/0x180 [ 6.577232] Code: d503201f b00119a1 91022263 b27b7be4 (f9004663) [ 6.583349] ---[ end trace d196b9b14cdae2da ]--- [ 6.587977] Kernel panic - not syncing: Fatal exception [ 6.593216] SMP: stopping secondary CPUs [ 6.597151] Kernel Offset: 0x4ada54400000 from 0xffff800010000000 [ 6.603261] PHYS_OFFSET: 0xffffd0a7c0000000 [ 6.607454] CPU features: 0x10002,21806008 [ 6.611558] Memory Limit: none And now that ocelot->ptp_clock is checked at exit, prevent a potential error where ptp_clock_register returned a pointer-encoded error, which we are keeping in the ocelot private data structure. So now, ocelot->ptp_clock is now either NULL or a valid pointer. Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") Cc: Antoine Tenart Reviewed-by: Florian Fainelli Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 9aed6ae0647d8b23b5746223f376acd7de7b8868 Author: Danit Goldberg Date: Tue Dec 3 17:43:36 2019 +0200 net/core: Populate VF index in struct ifla_vf_guid In addition to filling the node_guid and port_guid attributes, there is a need to populate VF index too, otherwise users of netlink interface will see same VF index for all VFs. Fixes: 30aad41721e0 ("net/core: Add support for getting VF GUIDs") Signed-off-by: Danit Goldberg Signed-off-by: Leon Romanovsky Signed-off-by: David S. Miller commit c4b4c421857dc7b1cf0dccbd738472360ff2cd70 Author: Nikolay Aleksandrov Date: Tue Dec 3 16:48:06 2019 +0200 net: bridge: deny dev_set_mac_address() when unregistering We have an interesting memory leak in the bridge when it is being unregistered and is a slave to a master device which would change the mac of its slaves on unregister (e.g. bond, team). This is a very unusual setup but we do end up leaking 1 fdb entry because dev_set_mac_address() would cause the bridge to insert the new mac address into its table after all fdbs are flushed, i.e. after dellink() on the bridge has finished and we call NETDEV_UNREGISTER the bond/team would release it and will call dev_set_mac_address() to restore its original address and that in turn will add an fdb in the bridge. One fix is to check for the bridge dev's reg_state in its ndo_set_mac_address callback and return an error if the bridge is not in NETREG_REGISTERED. Easy steps to reproduce: 1. add bond in mode != A/B 2. add any slave to the bond 3. add bridge dev as a slave to the bond 4. destroy the bridge device Trace: unreferenced object 0xffff888035c4d080 (size 128): comm "ip", pid 4068, jiffies 4296209429 (age 1413.753s) hex dump (first 32 bytes): 41 1d c9 36 80 88 ff ff 00 00 00 00 00 00 00 00 A..6............ d2 19 c9 5e 3f d7 00 00 00 00 00 00 00 00 00 00 ...^?........... backtrace: [<00000000ddb525dc>] kmem_cache_alloc+0x155/0x26f [<00000000633ff1e0>] fdb_create+0x21/0x486 [bridge] [<0000000092b17e9c>] fdb_insert+0x91/0xdc [bridge] [<00000000f2a0f0ff>] br_fdb_change_mac_address+0xb3/0x175 [bridge] [<000000001de02dbd>] br_stp_change_bridge_id+0xf/0xff [bridge] [<00000000ac0e32b1>] br_set_mac_address+0x76/0x99 [bridge] [<000000006846a77f>] dev_set_mac_address+0x63/0x9b [<00000000d30738fc>] __bond_release_one+0x3f6/0x455 [bonding] [<00000000fc7ec01d>] bond_netdev_event+0x2f2/0x400 [bonding] [<00000000305d7795>] notifier_call_chain+0x38/0x56 [<0000000028885d4a>] call_netdevice_notifiers+0x1e/0x23 [<000000008279477b>] rollback_registered_many+0x353/0x6a4 [<0000000018ef753a>] unregister_netdevice_many+0x17/0x6f [<00000000ba854b7a>] rtnl_delete_link+0x3c/0x43 [<00000000adf8618d>] rtnl_dellink+0x1dc/0x20a [<000000009b6395fd>] rtnetlink_rcv_msg+0x23d/0x268 Fixes: 43598813386f ("bridge: add local MAC address to forwarding table (v2)") Reported-by: syzbot+2add91c08eb181fea1bf@syzkaller.appspotmail.com Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 42c17fa69f9866a3f80ac196ce70b4fda1242717 Author: Dan Carpenter Date: Tue Dec 3 17:12:39 2019 +0300 net: fix a leak in register_netdevice() We have to free "dev->name_node" on this error path. Fixes: ff92741270bf ("net: introduce name_node struct to be used in hashlist") Reported-by: syzbot+6e13e65ffbaa33757bcb@syzkaller.appspotmail.com Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit 56e7a2f83d13306500ce807dd7ebbbb73b5a91d6 Merge: 040b5cfbcefa 3d3c817c3a40 Author: David S. Miller Date: Tue Dec 3 11:14:41 2019 -0800 Merge tag 'linux-can-fixes-for-5.5-20191203' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2019-12-03 this is a pull request of 6 patches for net/master. The first two patches are against the MAINTAINERS file and adds Appana Durga Kedareswara rao as maintainer for the xilinx-can driver and Sriram Dash for the m_can (mmio) driver. The next patch is by Jouni Hogander and fixes a use-after-free in the slcan driver. Johan Hovold's patch for the ucan driver fixes the non-atomic allocation in the completion handler. The last two patches target the xilinx-can driver. The first one is by Venkatesh Yadav Abbarapu and skips the error message on deferred probe, the second one is by Srinivas Neeli and fixes the usage of the skb after can_put_echo_skb(). ==================== Signed-off-by: David S. Miller commit 87f80d623c6c93c721b2aaead8a45e848bc8ffbf Author: Jens Axboe Date: Tue Dec 3 11:23:54 2019 -0700 io_uring: handle connect -EINPROGRESS like -EAGAIN Right now we return it to userspace, which means the application has to poll for the socket to be writeable. Let's just treat it like -EAGAIN and have io_uring handle it internally, this makes it much easier to use. Signed-off-by: Jens Axboe commit b22bfea7f16cda6e08918a3e9c7b4b99eb95ea70 Merge: 2dff2a1c9b7c 407e62f52aad Author: Linus Torvalds Date: Tue Dec 3 09:29:50 2019 -0800 Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Ingo Molnar: "Most of the IRQ subsystem changes in this cycle were irq-chip driver updates: - Qualcomm PDC wakeup interrupt support - Layerscape external IRQ support - Broadcom bcm7038 PM and wakeup support - Ingenic driver cleanup and modernization - GICv3 ITS preparation for GICv4.1 updates - GICv4 fixes There's also the series from Frederic Weisbecker that fixes memory ordering bugs for the irq-work logic, whose primary fix is to turn work->irq_work.flags into an atomic variable and then convert the complex (and buggy) atomic_cmpxchg() loop in irq_work_claim() into a much simpler atomic_fetch_or() call. There are also various smaller cleanups" * 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits) pinctrl/sdm845: Add PDC wakeup interrupt map for GPIOs pinctrl/msm: Setup GPIO chip in hierarchy irqchip/qcom-pdc: Add irqchip set/get state calls irqchip/qcom-pdc: Add irqdomain for wakeup capable GPIOs irqchip/qcom-pdc: Do not toggle IRQ_ENABLE during mask/unmask irqchip/qcom-pdc: Update max PDC interrupts of/irq: Document properties for wakeup interrupt parent genirq: Introduce irq_chip_get/set_parent_state calls irqdomain: Add bus token DOMAIN_BUS_WAKEUP genirq: Fix function documentation of __irq_alloc_descs() irq_work: Fix IRQ_WORK_BUSY bit clearing irqchip/ti-sci-inta: Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...)) irq_work: Slightly simplify IRQ_WORK_PENDING clearing irq_work: Fix irq_work_claim() memory ordering irq_work: Convert flags to atomic_t irqchip: Ingenic: Add process for more than one irq at the same time. irqchip: ingenic: Alloc generic chips from IRQ domain irqchip: ingenic: Get virq number from IRQ domain irqchip: ingenic: Error out if IRQ domain creation failed irqchip: ingenic: Drop redundant irq_suspend / irq_resume functions ... commit 2dff2a1c9b7cc83529119eb04cef1d7b68e11352 Merge: 2352923c753f 7c2378800cf7 Author: Linus Torvalds Date: Tue Dec 3 09:27:29 2019 -0800 Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging Pull dmi updates from Jean Delvare. * 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: firmware: dmi: Add dmi_memdev_handle firmware: dmi: Remember the memory type commit 6c6b3549142255c3fe4bab5560efdf8391c8d858 Author: Christoph Hellwig Date: Tue Dec 3 10:39:08 2019 +0100 block: set the zone size in blk_revalidate_disk_zones atomically The current zone revalidation code has a major problem in that it doesn't update the zone size and q->nr_zones atomically, leading to a short window where an out of bounds access to the zone arrays is possible. To fix this move the setting of the zone size into the crticial sections blk_revalidate_disk_zones so that it gets updated together with the zone bitmaps and q->nr_zones. This also slightly simplifies the caller as it deducts the zone size from the report_zones. This change also allows to check for a power of two zone size in generic code. Reported-by: Hans Holmberg Reviewed-by: Javier González Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 4905880b4515721bc4aff17d65be426175d9ddbf Author: Monk Liu Date: Tue Nov 26 19:33:38 2019 +0800 drm/amdgpu: fix GFX10 missing CSIB set(v3) still need to init csb even for SRIOV v2: drop init_pg() for gfx10 at all since PG and GFX off feature will be fully controled by RLC and SMU fw for gfx10 v3: drop the flush_gpu_tlb lines since we consider it is only usefull in emulation Signed-off-by: Monk Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit cd05b51aaa6ea6f7e4c22802e3f2703ac6087912 Author: Monk Liu Date: Fri Nov 29 16:20:51 2019 +0800 drm/amdgpu: should stop GFX ring in hw_fini To align with the scheme from gfx9 disabling GFX ring after VM shutdown could avoid garbage data be fetched to GFX RB which may lead to unnecessary screw up on GFX Signed-off-by: Monk Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit dacf56e45ded829a87cefab17bf6800d6cacd236 Author: Monk Liu Date: Tue Nov 26 19:38:22 2019 +0800 drm/amdgpu: do autoload right after MEC loaded for SRIOV VF since we don't have RLCG ucode loading and no SRlist as well Signed-off-by: Monk Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 6294017fe3525bb45c259db97ab4ac0620af5107 Author: Monk Liu Date: Tue Nov 26 19:36:29 2019 +0800 drm/amdgpu: skip rlc ucode loading for SRIOV gfx10 Signed-off-by: Monk Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 747d4f715fb5aca0002216355df28714cc20250c Author: Monk Liu Date: Tue Nov 26 19:42:25 2019 +0800 drm/amdgpu: fix calltrace during kmd unload(v3) issue: kernel would report a warning from a double unpin during the driver unloading on the CSB bo why: we unpin it during hw_fini, and there will be another unpin in sw_fini on CSB bo. fix: actually we don't need to pin/unpin it during hw_init/fini since it is created with kernel pinned, we only need to fullfill the CSB again during hw_init to prevent CSB/VRAM lost after S3 v2: get_csb in init_rlc so hw_init() will make CSIB content back even after reset or s3 v3: use bo_create_kernel instead of bo_create_reserved for CSB otherwise the bo_free_kernel() on CSB is not aligned and would lead to its internal reserve pending there forever take care of gfx7/8 as well Signed-off-by: Monk Liu Reviewed-by: Hawking Zhang Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher commit fa2b93e39b1d167d342aecd6d3f53d9972405226 Author: Xiaojie Yuan Date: Wed Nov 6 21:10:20 2019 +0800 drm/amdgpu/gfx10: unlock srbm_mutex after queue programming finish srbm_mutex is to guarantee atomicity for r/w of gfx indexed registers Signed-off-by: Xiaojie Yuan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit f0312f45a0540a1551ca4644ff2461250520111a Author: John Clements Date: Mon Dec 2 17:57:25 2019 +0800 drm/amdgpu: Added ASIC specific checks in gfxhub V1.1 get XGMI info Added max hive/node info checks per supported ASIC Reviewed-by: Hawking Zhang Signed-off-by: John Clements Signed-off-by: Alex Deucher commit 2352923c753f0d89a0e2fc85ac37cee858afe33e Merge: 76bb8b05960c ba30e27405af Author: Linus Torvalds Date: Tue Dec 3 08:50:56 2019 -0800 Merge branch 'for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu Pull percpu updates from Dennis Zhou: "This has a change to fix percpu-refcount for RT kernels because rcu-sched disables preemption and the refcount release callback might acquire a spinlock" * 'for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu: Revert "percpu: add __percpu to SHIFT_PERCPU_PTR" percpu-refcount: Use normal instead of RCU-sched" percpu: add __percpu to SHIFT_PERCPU_PTR commit 76d8f83b2a6175909f4e93de868609d76fbba47c Author: Likun Gao Date: Mon Dec 2 15:04:35 2019 +0800 drm/amdgpu/powerplay: unify smu send message function Drop smu_send_smc_msg function from ASIC specify structure. Reuse smu_send_smc_msg_with_param function for smu_send_smc_msg. Set paramer to 0 for smu_send_msg function, otherwise it will send with previous paramer value (Not a certain value). Materialize msg type for smu send message function definition. Signed-off-by: Likun Gao Reviewed-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 627f75d18910b287472593a4a2c41de9a386f5a2 Author: Alex Deucher Date: Fri Nov 15 10:02:44 2019 -0500 drm/amd/display: re-enable wait in pipelock, but add timeout Removing this causes hangs in some games, so re-add it, but add a timeout so we don't hang while switching flip types. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=205169 Bug: https://bugs.freedesktop.org/show_bug.cgi?id=112266 Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 30c517736e1a31a3edcdbfc791c83bc565d437ca Author: Zhan liu Date: Mon Dec 2 15:12:27 2019 -0500 drm/amd/display: Get NV14 specific ip params as needed [Why] NV14 is using its own ip params that's different from other DCN2.0 ASICs. [How] Add ASIC revision check to make sure NV14 gets correct ip params. Signed-off-by: Zhan Liu Reviewed-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher commit 516fb68d9501460dc3e47d107daa9402b075b9fe Author: Zhan liu Date: Mon Dec 2 14:54:16 2019 -0500 drm/amd/display: Adding NV14 IP Parameters [Why] NV14 IP Parameters are missing. [How] Add IP Parameters in. Signed-off-by: Zhan liu Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit c3d03c5a196f21381c1a2166a4648beba13d3d1f Author: Zhan Liu Date: Thu Nov 28 14:12:11 2019 -0500 drm/amd/display: Include num_vmid and num_dsc within NV14's resource caps [Why] "num_vmid" and "num_dsc" are missing within NV14's resource caps structure. [How] Add the missing parts. Signed-off-by: Zhan Liu Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit e2195f7d0e735b9e466873333a7e832e3b7d254b Author: Monk Liu Date: Tue Nov 26 19:40:08 2019 +0800 drm/amdgpu: use CPU to flush vmhub if sched stopped otherwse the flush_gpu_tlb will hang if we unload the KMD becuase the schedulers already stopped Signed-off-by: Monk Liu Reviewed-by: Christian König Signed-off-by: Alex Deucher commit ae58954d8734c44298f55ed71e683ea944994fab Author: Christoph Hellwig Date: Tue Dec 3 10:39:07 2019 +0100 block: don't handle bio based drivers in blk_revalidate_disk_zones bio based drivers only need to update q->nr_zones. Do that manually instead of overloading blk_revalidate_disk_zones to keep that function simpler for the next round of changes that will rely even more on the request based functionality. Reviewed-by: Javier González Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit e94f5819448c5b75829662eaa9c25c17868846cf Author: Christoph Hellwig Date: Tue Dec 3 10:39:06 2019 +0100 block: allocate the zone bitmaps lazily Allocate the conventional zone bitmap and the sequential zone locking bitmap only when we find a zone of the respective type. This avoids wasting memory on the conventional zone bitmap for devices that only have sequential zones, and will also prepare for other future changes. Reviewed-by: Javier González Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit f216fdd77b5654f8c4f6fac6020d6aabc58878ef Author: Christoph Hellwig Date: Tue Dec 3 10:39:05 2019 +0100 block: replace seq_zones_bitmap with conv_zones_bitmap Invert the meaning of seq_zones_bitmap by keeping a bitmap of conventional zones. This allows not having a bitmap for devices that do not have conventional zones. Reviewed-by: Javier González Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 9b38bb4b1e6de47b379afaad2c707df639bb4dc7 Author: Christoph Hellwig Date: Tue Dec 3 10:39:04 2019 +0100 block: simplify blkdev_nr_zones Simplify the arguments to blkdev_nr_zones by passing a gendisk instead of the block_device and capacity. This also removes the need for __blkdev_nr_zones as all callers are outside the fast path and can deal with the additional branch. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit bb55628288fcd96d919a9ecc59dd26704a65493b Author: Christoph Hellwig Date: Tue Dec 3 10:39:03 2019 +0100 block: remove the empty line at the end of blk-zoned.c Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 979d54475e0b75a28e55528617fecf83b4a221da Author: Christoph Hellwig Date: Tue Dec 3 10:39:02 2019 +0100 null_blk: cleanup null_gendisk_register Use a saner size calculation, and do a trivial cleanup on the zone revalidation to prepare to future changes. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 5c4bd1f40c23d08ffbdccd68a5fd63751c794d89 Author: Damien Le Moal Date: Tue Dec 3 10:39:01 2019 +0100 null_blk: fix zone size paramter check For zoned=1 mode, the zone size must be a power of 2. Check this not only when the zone size is specified during modprobe, but also when creating a zoned null_blk device using configfs. Signed-off-by: Damien Le Moal Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit f6c4d97b0d82ed1240690c91f06214018b1531ef Author: Keith Busch Date: Tue Dec 3 05:53:30 2019 +0900 nvme/pci: Remove last_cq_head We had been saving the last_cq_head seen from an interrupt so that a polled queue wouldn't mistakenly trigger spruious interrupt detection. We don't poll interrupt driven queues any more, so saving this value is pointless. Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 795ee49c1a28d1b3eeb2b463f18d557700fc6153 Author: Pavel Begunkov Date: Sat Nov 30 23:23:52 2019 +0300 block: optimise bvec_iter_advance() bvec_iter_advance() is quite popular, but compilers fail to do proper alias analysis and optimise it good enough. The assembly is checked for gcc 9.2, x86-64. - remove @iter->bi_size from min(...), as it's always less than @bytes. Modify at the beginning and forget about it. - the compiler isn't able to collapse memory dependencies and remove writes in the loop. Help it by explicitely using local vars. Signed-off-by: Arvind Sankar Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 8cdda87a4414092cd210e766189cf0353a844861 Author: Jackie Liu Date: Mon Dec 2 17:14:53 2019 +0800 io_uring: remove io_wq_current_is_worker Since commit b18fdf71e01f ("io_uring: simplify io_req_link_next()"), the io_wq_current_is_worker function is no longer needed, clean it up. Signed-off-by: Jackie Liu Signed-off-by: Jens Axboe commit 22efde5998657f6d1f31592c659aa3a9c7ad65f1 Author: Jackie Liu Date: Mon Dec 2 17:14:52 2019 +0800 io_uring: remove parameter ctx of io_submit_state_start Parameter ctx we have never used, clean it up. Signed-off-by: Jackie Liu Signed-off-by: Jens Axboe commit da8c96906990f1108cb626ee7865e69267a3263b Author: Jens Axboe Date: Mon Dec 2 18:51:26 2019 -0700 io_uring: mark us with IORING_FEAT_SUBMIT_STABLE If this flag is set, applications can be certain that any data for async offload has been consumed when the kernel has consumed the SQE. Signed-off-by: Jens Axboe commit f499a021ea8c9f70321fce3d674d8eca5bbeee2c Author: Jens Axboe Date: Mon Dec 2 16:28:46 2019 -0700 io_uring: ensure async punted connect requests copy data Just like commit f67676d160c6 for read/write requests, this one ensures that the sockaddr data has been copied for IORING_OP_CONNECT if we need to punt the request to async context. Signed-off-by: Jens Axboe commit 03b1230ca12a12e045d83b0357792075bf94a1e0 Author: Jens Axboe Date: Mon Dec 2 18:50:25 2019 -0700 io_uring: ensure async punted sendmsg/recvmsg requests copy data Just like commit f67676d160c6 for read/write requests, this one ensures that the msghdr data is fully copied if we need to punt a recvmsg or sendmsg system call to async context. Signed-off-by: Jens Axboe commit a1f4c96b799b80118b50bd47320deb9013b7ff40 Author: YueHaibing Date: Sat Nov 30 09:28:28 2019 +0800 gpiolib: of: Make of_gpio_spi_cs_get_count static Fix sparse warning: drivers/gpio/gpiolib-of.c:35:5: warning: symbol 'of_gpio_spi_cs_get_count' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20191130012828.14504-1-yuehaibing@huawei.com Signed-off-by: Mark Brown commit a3cde9534ebdafe18a9bbab208df724c57e6c8e8 Author: Wen Yang Date: Sun Dec 1 11:02:50 2019 +0800 regulator: core: fix regulator_register() error paths to properly release rdev There are several issues with the error handling code of the regulator_register() function: ret = device_register(&rdev->dev); if (ret != 0) { put_device(&rdev->dev); --> rdev released goto unset_supplies; } ... unset_supplies: ... unset_regulator_supplies(rdev); --> use-after-free ... clean: if (dangling_of_gpiod) gpiod_put(config->ena_gpiod); kfree(rdev); --> double free We add a variable to record the failure of device_register() and move put_device() down a bit to avoid the above issues. Fixes: c438b9d01736 ("regulator: core: Move registration of regulator device") Signed-off-by: Wen Yang Cc: Liam Girdwood Cc: Mark Brown Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/20191201030250.38074-1-wenyang@linux.alibaba.com Signed-off-by: Mark Brown commit d5ee9108adacfbed140e0ac2371941ce7ca1fc54 Author: YueHaibing Date: Thu Nov 28 21:58:53 2019 +0800 ASoC: Intel: sst: Add missing include Fix build error: sound/soc/intel/atom/sst/sst.c: In function intel_sst_interrupt_mrfld: sound/soc/intel/atom/sst/sst.c:93:5: error: implicit declaration of function memcpy_fromio; did you mean memcpy32_fromio? [-Werror=implicit-function-declaration] memcpy_fromio(msg->mailbox_data, ^~~~~~~~~~~~~ memcpy32_fromio Reported-by: Hulk Robot Signed-off-by: YueHaibing Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191128135853.8360-1-yuehaibing@huawei.com Signed-off-by: Mark Brown commit 01bb630319337be15fc50c211126180198d4e157 Author: Matt Roper Date: Wed Nov 27 14:13:13 2019 -0800 drm/i915/ehl: Make icp_digital_port_connected() use phy instead of port When looking at SDEISR to determine the connection status of combo outputs, we should use the phy index rather than the port index. Although they're usually the same thing, EHL's DDI-D (port D) is attached to PHY-A and SDEISR doesn't even have bits for a "D" output. It's also possible that future platforms may map DDIs (the internal display engine programming units) to PHYs (the output handling on the IO side) in ways where port!=phy, so let's look at the PHY index by default. v2: Rename to intel_combo_phy_connected. (Lucas) Fixes: 719d24002602 ("drm/i915/ehl: Enable DDI-D") Cc: José Roberto de Souza Cc: Lucas De Marchi Signed-off-by: Matt Roper Reviewed-by: Lucas De Marchi Reviewed-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20191127221314.575575-2-matthew.d.roper@intel.com (cherry picked from commit 3d1e388d4072dd240e558709d2f73605a742a723) Signed-off-by: Joonas Lahtinen commit 7c2378800cf7ac87e2663afa7f39d102871f0c28 Author: Jean Delvare Date: Tue Dec 3 11:20:37 2019 +0100 firmware: dmi: Add dmi_memdev_handle Add a utility function dmi_memdev_handle() which returns the DMI handle associated with a given memory slot. This will allow kernel drivers to iterate over the memory slots. Signed-off-by: Jean Delvare commit 9e0afe3910ff7e5493c5d8ebe3b499994b5e0272 Author: Jean Delvare Date: Tue Dec 3 11:20:37 2019 +0100 firmware: dmi: Remember the memory type Store the memory type while walking the memory slots, and provide a way to retrieve it later. Signed-off-by: Jean Delvare commit 3d3c817c3a409ba51ad6e44dd8fde4cfc07c93fe Author: Srinivas Neeli Date: Mon Dec 2 18:32:11 2019 +0530 can: xilinx_can: Fix usage of skb memory As per linux can framework, driver not allowed to touch the skb memory after can_put_echo_skb() call. This patch fixes the same. https://www.spinics.net/lists/linux-can/msg02199.html Signed-off-by: Srinivas Neeli Reviewed-by: Appana Durga Kedareswara Rao Signed-off-by: Marc Kleine-Budde commit b848238d86aacc3df69c76a20ab2aa85db8775e1 Author: Venkatesh Yadav Abbarapu Date: Mon Dec 2 18:32:10 2019 +0530 can: xilinx_can: skip error message on deferred probe When the CAN bus clock is provided from the clock wizard, clock wizard driver may not be available when can driver probes resulting to the error message "bus clock not found error". As this error message is not very useful to the end user, skip printing in the case of deferred probe. Signed-off-by: Venkatesh Yadav Abbarapu Signed-off-by: Srinivas Neeli Signed-off-by: Michal Simek Reviewed-by: Appana Durga Kedareswara Rao Signed-off-by: Marc Kleine-Budde commit 870db5d1015c8bd63e93b579e857223c96249ff7 Author: Johan Hovold Date: Thu Nov 28 19:26:03 2019 +0100 can: ucan: fix non-atomic allocation in completion handler USB completion handlers are called in atomic context and must specifically not allocate memory using GFP_KERNEL. Fixes: 9f2d3eae88d2 ("can: ucan: add driver for Theobroma Systems UCAN devices") Cc: stable # 4.19 Cc: Jakob Unterwurzacher Cc: Martin Elshuber Cc: Philipp Tomsich Signed-off-by: Johan Hovold Signed-off-by: Marc Kleine-Budde commit 9ebd796e24008f33f06ebea5a5e6aceb68b51794 Author: Jouni Hogander Date: Wed Nov 27 08:40:26 2019 +0200 can: slcan: Fix use-after-free Read in slcan_open Slcan_open doesn't clean-up device which registration failed from the slcan_devs device list. On next open this list is iterated and freed device is accessed. Fix this by calling slc_free_netdev in error path. Driver/net/can/slcan.c is derived from slip.c. Use-after-free error was identified in slip_open by syzboz. Same bug is in slcan.c. Here is the trace from the Syzbot slip report: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:634 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 sl_sync drivers/net/slip/slip.c:725 [inline] slip_open+0xecd/0x11b7 drivers/net/slip/slip.c:801 tty_ldisc_open.isra.0+0xa3/0x110 drivers/tty/tty_ldisc.c:469 tty_set_ldisc+0x30e/0x6b0 drivers/tty/tty_ldisc.c:596 tiocsetd drivers/tty/tty_io.c:2334 [inline] tty_ioctl+0xe8d/0x14f0 drivers/tty/tty_io.c:2594 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xdb6/0x13e0 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: ed50e1600b44 ("slcan: Fix memory leak in error path") Cc: Wolfgang Grandegger Cc: Marc Kleine-Budde Cc: David Miller Cc: Oliver Hartkopp Cc: Lukas Bulwahn Signed-off-by: Jouni Hogander Cc: linux-stable # >= v5.4 Acked-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde commit 8c2a58568d6d952f7c7f1dac125b33dc8414627b Author: Sriram Dash Date: Tue Dec 3 09:59:09 2019 +0530 MAINTAINERS: add myself as maintainer of MCAN MMIO device driver Since we are actively working on MMIO MCAN device driver, as discussed with Marc, I am adding myself as a maintainer. Signed-off-by: Sriram Dash Signed-off-by: Marc Kleine-Budde commit 825e5601c14278cf065a0f28e99a73a2745f2549 Author: Appana Durga Kedareswara rao Date: Thu Nov 21 14:09:24 2019 +0530 MAINTAINERS: add fragment for xilinx CAN driver Added entry for xilinx CAN driver. Signed-off-by: Appana Durga Kedareswara rao Signed-off-by: Marc Kleine-Budde commit e38e486d66e2a3b902768fd71c32dbf10f77e1cb Author: Takashi Iwai Date: Mon Dec 2 08:49:47 2019 +0100 ALSA: hda: Modify stream stripe mask only when needed The recent commit in HD-audio stream management for changing the stripe control seems causing a regression on some platforms. The stripe control is currently used only by HDMI codec, and applying the stripe mask unconditionally may lead to scratchy and static noises as seen on some MacBooks. For addressing the regression, this patch changes the stream management code to apply the stripe mask conditionally only when the codec driver requested. Fixes: 9b6f7e7a296e ("ALSA: hda: program stripe bits for controller") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204477 Tested-by: Michael Pobega Cc: Link: https://lore.kernel.org/r/20191202074947.1617-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit f67676d160c6ee2ed82917fadfed6d29cab8237c Author: Jens Axboe Date: Mon Dec 2 11:03:47 2019 -0700 io_uring: ensure async punted read/write requests copy iovec Currently we don't copy the iovecs when we punt to async context. This can be problematic for applications that store the iovec on the stack, as they often assume that it's safe to let the iovec go out of scope as soon as IO submission has been called. This isn't always safe, as we will re-copy the iovec once we're in async context. Make this 100% safe by copying the iovec just once. With this change, applications may safely store the iovec on the stack for all cases. Reported-by: 李通洲 Signed-off-by: Jens Axboe commit 69ffe5960df16938bccfe1b65382af0b3de51265 Author: Omar Sandoval Date: Tue Nov 26 16:58:08 2019 -0800 xfs: don't check for AG deadlock for realtime files in bunmapi Commit 5b094d6dac04 ("xfs: fix multi-AG deadlock in xfs_bunmapi") added a check in __xfs_bunmapi() to stop early if we would touch multiple AGs in the wrong order. However, this check isn't applicable for realtime files. In most cases, it just makes us do unnecessary commits. However, without the fix from the previous commit ("xfs: fix realtime file data space leak"), if the last and second-to-last extents also happen to have different "AG numbers", then the break actually causes __xfs_bunmapi() to return without making any progress, which sends xfs_itruncate_extents_flags() into an infinite loop. Fixes: 5b094d6dac04 ("xfs: fix multi-AG deadlock in xfs_bunmapi") Signed-off-by: Omar Sandoval Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 0c4da70c83d41a8461fdf50a3f7b292ecb04e378 Author: Omar Sandoval Date: Tue Nov 26 16:58:07 2019 -0800 xfs: fix realtime file data space leak Realtime files in XFS allocate extents in rextsize units. However, the written/unwritten state of those extents is still tracked in blocksize units. Therefore, a realtime file can be split up into written and unwritten extents that are not necessarily aligned to the realtime extent size. __xfs_bunmapi() has some logic to handle these various corner cases. Consider how it handles the following case: 1. The last extent is unwritten. 2. The last extent is smaller than the realtime extent size. 3. startblock of the last extent is not aligned to the realtime extent size, but startblock + blockcount is. In this case, __xfs_bunmapi() calls xfs_bmap_add_extent_unwritten_real() to set the second-to-last extent to unwritten. This should merge the last and second-to-last extents, so __xfs_bunmapi() moves on to the second-to-last extent. However, if the size of the last and second-to-last extents combined is greater than MAXEXTLEN, xfs_bmap_add_extent_unwritten_real() does not merge the two extents. When that happens, __xfs_bunmapi() skips past the last extent without unmapping it, thus leaking the space. Fix it by only unwriting the minimum amount needed to align the last extent to the realtime extent size, which is guaranteed to merge with the last extent. Signed-off-by: Omar Sandoval Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 1a6b74fc87024db59d41cd7346bd437f20fb3e2d Author: Jens Axboe Date: Mon Dec 2 10:33:15 2019 -0700 io_uring: add general async offload context Right now we just copy the sqe for async offload, but we want to store more context across an async punt. In preparation for doing so, put the sqe copy inside a structure that we can expand. With this pointer added, we can get rid of REQ_F_FREE_SQE, as that is now indicated by whether req->io is NULL or not. No functional changes in this patch. Signed-off-by: Jens Axboe commit 490547ca2df66b8413bce97cb651630f2c531487 Author: Eric Biggers Date: Mon Dec 2 10:21:34 2019 -0800 block: don't send uevent for empty disk when not invalidating Commit 6917d0689993 ("block: merge invalidate_partitions into rescan_partitions") caused a regression where systemd-udevd spins forever using max CPU starting at boot time. It's caused by a behavior change where a KOBJ_CHANGE uevent is now sent in a case where previously it wasn't. Restore the old behavior. Fixes: 6917d0689993 ("block: merge invalidate_partitions into rescan_partitions") Reviewed-by: Christoph Hellwig Signed-off-by: Eric Biggers Signed-off-by: Jens Axboe commit 441cdbd5449b4923cd413d3ba748124f91388be9 Author: Jens Axboe Date: Mon Dec 2 18:49:10 2019 -0700 io_uring: transform send/recvmsg() -ERESTARTSYS to -EINTR We should never return -ERESTARTSYS to userspace, transform it into -EINTR. Cc: stable@vger.kernel.org # v5.3+ Signed-off-by: Jens Axboe commit 76bb8b05960c3d1668e6bee7624ed886cbd135ba Merge: e30dbe50dc91 d21b7e6b985c Author: Linus Torvalds Date: Mon Dec 2 17:35:04 2019 -0800 Merge tag 'kbuild-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - remove unneeded asm headers from hexagon, ia64 - add 'dir-pkg' target, which works like 'tar-pkg' but skips archiving - add 'helpnewconfig' target, which shows help for new CONFIG options - support 'make nsdeps' for external modules - make rebuilds faster by deleting $(wildcard $^) checks - remove compile tests for kernel-space headers - refactor modpost to simplify modversion handling - make single target builds faster - optimize and clean up scripts/kallsyms.c - refactor various Makefiles and scripts * tag 'kbuild-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (59 commits) MAINTAINERS: update Kbuild/Kconfig maintainer's email address scripts/kallsyms: remove redundant initializers scripts/kallsyms: put check_symbol_range() calls close together scripts/kallsyms: make check_symbol_range() void function scripts/kallsyms: move ignored symbol types to is_ignored_symbol() scripts/kallsyms: move more patterns to the ignored_prefixes array scripts/kallsyms: skip ignored symbols very early scripts/kallsyms: add const qualifiers where possible scripts/kallsyms: make find_token() return (unsigned char *) scripts/kallsyms: replace prefix_underscores_count() with strspn() scripts/kallsyms: add sym_name() to mitigate cast ugliness scripts/kallsyms: remove unneeded length check for prefix matching scripts/kallsyms: remove redundant is_arm_mapping_symbol() scripts/kallsyms: set relative_base more effectively scripts/kallsyms: shrink table before sorting it scripts/kallsyms: fix definitely-lost memory leak scripts/kallsyms: remove unneeded #ifndef ARRAY_SIZE kbuild: make single target builds even faster modpost: respect the previous export when 'exported twice' is warned modpost: do not set ->preloaded for symbols from Module.symvers ... commit e30dbe50dc91d25dde251169b66d39f99bf45bad Merge: 483847a70262 f60b85e83659 Author: Linus Torvalds Date: Mon Dec 2 17:29:25 2019 -0800 Merge tag 'linux-kselftest-5.5-rc1-fixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull more kselftest fixes from Shuah Khan: "This second Kselftest fixes update for Linux 5.5-rc1 consists of an urgent revert to fix regression in CI coverage" * tag 'linux-kselftest-5.5-rc1-fixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: Revert "selftests: Fix O= and KBUILD_OUTPUT handling for relative paths" commit 483847a70262f7361f8a6f78513c985c2c8b1719 Merge: 120e47686a00 8a6b8f4d7a89 Author: Linus Torvalds Date: Mon Dec 2 17:23:21 2019 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix build error in crypto lib code when crypto API is off - Fix NULL/error check in hisilicon - Fix Kconfig-related build error in talitos * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: hisilicon - fix a NULL vs IS_ERR() bug in sec_create_qp_ctx() crypto: talitos - Fix build error by selecting LIB_DES crypto: arch - conditionalize crypto api in arch glue for lib code commit 120e47686a00144ef1195cfc137645d1bed46d23 Merge: fcaa0ad72d8a 0ecdcaa6d5e7 Author: Linus Torvalds Date: Mon Dec 2 17:18:43 2019 -0800 Merge tag 'for-linus' of git://github.com/openrisc/linux Pull OpenRISC update from Stafford Horne: "White space fixups in Kconfig files from Krzysztof Kozlowski" * tag 'for-linus' of git://github.com/openrisc/linux: openrisc: Fix Kconfig indentation commit fcaa0ad72d8a14736595bb48c49f9ebd62963d63 Merge: e3a251e366e1 9807019a62dc Author: Linus Torvalds Date: Mon Dec 2 17:14:02 2019 -0800 Merge tag 'for-linus-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML updates from Richard Weinberger: - Fixes for our new virtio code - Fix for the irqflags tracer - Kconfig coding style fixes - Allow BPF firmware loading in our vector driver * tag 'for-linus-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: Loadable BPF "Firmware" for vector drivers um: Fix Kconfig indentation um: virtio_uml: Disallow modular build um: virtio: Keep reading on -EAGAIN um: virtio: Remove device on disconnect um: Don't trace irqflags during shutdown commit e3a251e366e1a007c7ce7b2809b67f4dece6b17c Merge: 97eeb4d9d755 6e78c01fde90 Author: Linus Torvalds Date: Mon Dec 2 17:06:34 2019 -0800 Merge tag 'upstream-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBI/UBIFS/JFFS2 updates from Richard Weinberger: "This pull request contains mostly fixes for UBI, UBIFS and JFFS2: UBI: - Fix a regression around producing a anchor PEB for fastmap. Due to a change in our locking fastmap was unable to produce fresh anchors an re-used the existing one a way to often. UBIFS: - Fixes for endianness. A few places blindly assumed little endian. - Fix for a memory leak in the orphan code. - Fix for a possible crash during a commit. - Revert a wrong bugfix. JFFS2: - Revert a bad bugfix (false positive from a code checking tool)" * tag 'upstream-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()" ubi: Fix producing anchor PEBs ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps ubifs: do_kill_orphans: Fix a memory leak bug Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path" ubifs: Fix type of sup->hash_algo ubifs: Fixed missed le64_to_cpu() in journal ubifs: Force prandom result to __le32 ubifs: Remove obsolete TODO from dfs_file_write() ubi: Fix warning static is not at beginning of declaration ubi: Print skip_check in ubi_dump_vol_info() commit 15b3904f8e884e0d34d5f09906cf6526d0b889a2 Author: Sudip Mukherjee Date: Fri Nov 15 11:36:10 2019 +0000 libtraceevent: Copy pkg-config file to output folder when using O= When we use 'O=' with make to build libtraceevent in a separate folder it still copies 'libtraceevent.pc' to its source folder. Modify the Makefile so that it uses the output folder to copy the pkg-config file and install from there. Signed-off-by: Sudipm Mukherjee Reviewed-by: Steven Rostedt (VMware) Cc: linux-trace-devel@vger.kernel.org Link: http://lore.kernel.org/lkml/20191115113610.21493-2-sudipm.mukherjee@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 587db8ebdac2c5eb3a8851e16b26f2e2711ab797 Author: Sudip Mukherjee Date: Fri Nov 15 11:36:09 2019 +0000 libtraceevent: Fix lib installation with O= When we use 'O=' with make to build libtraceevent in a separate folder it fails to install libtraceevent.a and libtraceevent.so.1.1.0 with the error: INSTALL /home/sudip/linux/obj-trace/libtraceevent.a INSTALL /home/sudip/linux/obj-trace/libtraceevent.so.1.1.0 cp: cannot stat 'libtraceevent.a': No such file or directory Makefile:225: recipe for target 'install_lib' failed make: *** [install_lib] Error 1 I used the command: make O=../../../obj-trace DESTDIR=~/test prefix==/usr install It turns out libtraceevent Makefile, even though it builds in a separate folder, searches for libtraceevent.a and libtraceevent.so.1.1.0 in its source folder. So, add the 'OUTPUT' prefix to the source path so that 'make' looks for the files in the correct place. Signed-off-by: Sudipm Mukherjee Reviewed-by: Steven Rostedt (VMware) Cc: linux-trace-devel@vger.kernel.org Link: http://lore.kernel.org/lkml/20191115113610.21493-1-sudipm.mukherjee@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 9e8fae2597405ab1deac8909928eb8e99876f639 Author: Steve French Date: Mon Dec 2 17:55:41 2019 -0600 smb3: remove unused flag passed into close functions close was relayered to allow passing in an async flag which is no longer needed in this path. Remove the unneeded parameter "flags" passed in on close. Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg commit a9f76cf82719aea0f41bfcae57e17ffec39743d0 Author: Colin Ian King Date: Mon Dec 2 18:59:42 2019 +0000 cifs: remove redundant assignment to pointer pneg_ctxt The pointer pneg_ctxt is being initialized with a value that is never read and it is being updated later with a new value. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: Steve French commit 97eeb4d9d755605385fa329da9afa38729f3413c Merge: 9b326948c239 8feb4732ff9f Author: Linus Torvalds Date: Mon Dec 2 14:46:22 2019 -0800 Merge tag 'xfs-5.5-merge-16' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull XFS updates from Darrick Wong: "For this release, we changed quite a few things. Highlights: - Fixed some long tail latency problems in the block allocator - Removed some long deprecated (and for the past several years no-op) mount options and ioctls - Strengthened the extended attribute and directory verifiers - Audited and fixed all the places where we could return EFSCORRUPTED without logging anything - Refactored the old SGI space allocation ioctls to make the equivalent fallocate calls - Fixed a race between fallocate and directio - Fixed an integer overflow when files have more than a few billion(!) extents - Fixed a longstanding bug where quota accounting could be incorrect when performing unwritten extent conversion on a freshly mounted fs - Fixed various complaints in scrub about soft lockups and unresponsiveness to signals - De-vtable'd the directory handling code, which should make it faster - Converted to the new mount api, for better or for worse - Cleaned up some memory leaks and quite a lot of other smaller fixes and cleanups. A more detailed summary: - Fill out the build string - Prevent inode fork extent count overflows - Refactor the allocator to reduce long tail latency - Rework incore log locking a little to reduce spinning - Break up the xfs_iomap_begin functions into smaller more cohesive parts - Fix allocation alignment being dropped too early when the allocation request is for more blocks than an AG is large - Other small cleanups - Clean up file buftarg retrieval helpers - Hoist the resvsp and unresvsp ioctls to the vfs - Remove the undocumented biosize mount option, since it has never been mentioned as existing or supported on linux - Clean up some of the mount option printing and parsing - Enhance attr leaf verifier to check block structure - Check dirent and attr names for invalid characters before passing them to the vfs - Refactor open-coded bmbt walking - Fix a few places where we return EIO instead of EFSCORRUPTED after failing metadata sanity checks - Fix a synchronization problem between fallocate and aio dio corrupting the file length - Clean up various loose ends in the iomap and bmap code - Convert to the new mount api - Make sure we always log something when returning EFSCORRUPTED - Fix some problems where long running scrub loops could trigger soft lockup warnings and/or fail to exit due to fatal signals pending - Fix various Coverity complaints - Remove most of the function pointers from the directory code to reduce indirection penalties - Ensure that dquots are attached to the inode when performing unwritten extent conversion after io - Deuglify incore projid and crtime types - Fix another AGI/AGF locking order deadlock when renaming - Clean up some quota typedefs - Remove the FSSETDM ioctls which haven't done anything in 20 years - Fix some memory leaks when mounting the log fails - Fix an underflow when updating an xattr leaf freemap - Remove some trivial wrappers - Report metadata corruption as an error, not a (potentially) fatal assertion - Clean up the dir/attr buffer mapping code - Allow fatal signals to kill scrub during parent pointer checks" * tag 'xfs-5.5-merge-16' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (198 commits) xfs: allow parent directory scans to be interrupted with fatal signals xfs: remove the mappedbno argument to xfs_da_get_buf xfs: remove the mappedbno argument to xfs_da_read_buf xfs: split xfs_da3_node_read xfs: remove the mappedbno argument to xfs_dir3_leafn_read xfs: remove the mappedbno argument to xfs_dir3_leaf_read xfs: remove the mappedbno argument to xfs_attr3_leaf_read xfs: remove the mappedbno argument to xfs_da_reada_buf xfs: improve the xfs_dabuf_map calling conventions xfs: refactor xfs_dabuf_map xfs: simplify mappedbno handling in xfs_da_{get,read}_buf xfs: report corruption only as a regular error xfs: Remove kmem_zone_free() wrapper xfs: Remove kmem_zone_destroy() wrapper xfs: Remove slab init wrappers xfs: fix attr leaf header freemap.size underflow xfs: fix some memory leaks in log recovery xfs: fix another missing include xfs: remove XFS_IOC_FSSETDM and XFS_IOC_FSSETDM_BY_HANDLE xfs: remove duplicated include from xfs_dir2_data.c ... commit 240b62d381fe5b66c496a6fd55edff3976a9be51 Author: Juergen Gross Date: Mon Oct 21 12:04:15 2019 +0200 ia64: remove stale paravirt leftovers Remove the last leftovers from IA64 Xen pv-guest support. PARAVIRT is long gone from IA64 Kconfig and Xen IA64 support, too. Due to lack of infrastructure no testing done. Signed-off-by: Juergen Gross Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20191021100415.7642-1-jgross@suse.com commit 9b326948c23908692d7dfe56ed149840d3829eaa Merge: ef2cc88e2a20 7807759e4ad8 Author: Linus Torvalds Date: Mon Dec 2 14:13:00 2019 -0800 Merge tag 'firewire-update' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull FireWire updates from Stefan Richter: - another y2038 fix - janitorial code movement * tag 'firewire-update' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: code cleanup after vm_map_pages_zero introduction firewire: ohci: stop using get_seconds() for BUS_TIME commit ef2cc88e2a205b8a11a19e78db63a70d3728cdf5 Merge: 937d6eefc716 65309ef6b258 Author: Linus Torvalds Date: Mon Dec 2 13:37:02 2019 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "This is mostly update of the usual drivers: aacraid, ufs, zfcp, NCR5380, lpfc, qla2xxx, smartpqi, hisi_sas, target, mpt3sas, pm80xx plus a whole load of minor updates and fixes. The major core changes are Al Viro's reworking of sg's handling of copy to/from user, Ming Lei's removal of the host busy counter to avoid contention in the multiqueue case and Damien Le Moal's fixing of residual tracking across error handling" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (251 commits) scsi: bnx2fc: timeout calculation invalid for bnx2fc_eh_abort() scsi: target: core: Fix a pr_debug() argument scsi: iscsi: Don't send data to unbound connection scsi: target: iscsi: Wait for all commands to finish before freeing a session scsi: target: core: Release SPC-2 reservations when closing a session scsi: target: core: Document target_cmd_size_check() scsi: bnx2i: fix potential use after free Revert "scsi: qla2xxx: Fix memory leak when sending I/O fails" scsi: NCR5380: Add disconnect_mask module parameter scsi: NCR5380: Unconditionally clear ICR after do_abort() scsi: NCR5380: Call scsi_set_resid() on command completion scsi: scsi_debug: num_tgts must be >= 0 scsi: lpfc: use hdwq assigned cpu for allocation scsi: arcmsr: fix indentation issues scsi: qla4xxx: fix double free bug scsi: pm80xx: Modified the logic to collect fatal dump scsi: pm80xx: Tie the interrupt name to the module instance scsi: pm80xx: Controller fatal error through sysfs scsi: pm80xx: Do not request 12G sas speeds scsi: pm80xx: Cleanup command when a reset times out ... commit d567fb8819162099035e546b11a736e29c2af0ea Author: Jiang Yi Date: Wed Nov 27 17:49:10 2019 +0100 vfio/pci: call irq_bypass_unregister_producer() before freeing irq Since irq_bypass_register_producer() is called after request_irq(), we should do tear-down in reverse order: irq_bypass_unregister_producer() then free_irq(). Specifically free_irq() may release resources required by the irqbypass del_producer() callback. Notably an example provided by Marc Zyngier on arm64 with GICv4 that he indicates has the potential to wedge the hardware: free_irq(irq) __free_irq(irq) irq_domain_deactivate_irq(irq) its_irq_domain_deactivate() [unmap the VLPI from the ITS] kvm_arch_irq_bypass_del_producer(cons, prod) kvm_vgic_v4_unset_forwarding(kvm, irq, ...) its_unmap_vlpi(irq) [Unmap the VLPI from the ITS (again), remap the original LPI] Signed-off-by: Jiang Yi Cc: stable@vger.kernel.org # v4.4+ Fixes: 6d7425f109d26 ("vfio: Register/unregister irq_bypass_producer") Link: https://lore.kernel.org/kvm/20191127164910.15888-1-giangyi@amazon.com Reviewed-by: Marc Zyngier Reviewed-by: Eric Auger [aw: commit log] Signed-off-by: Alex Williamson commit 69738cfdfa7032f45d9e7462d24490e61cf163dd Author: Deepa Dinamani Date: Fri Nov 29 21:30:25 2019 -0800 fs: cifs: Fix atime update check vs mtime According to the comment in the code and commit log, some apps expect atime >= mtime; but the introduced code results in atime==mtime. Fix the comparison to guard against atime Cc: stfrench@microsoft.com Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 6f582b273ec23332074d970a7fb25bef835df71f Author: Pavel Shilovsky Date: Wed Nov 27 16:18:39 2019 -0800 CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks Currently when the client creates a cifsFileInfo structure for a newly opened file, it allocates a list of byte-range locks with a pointer to the new cfile and attaches this list to the inode's lock list. The latter happens before initializing all other fields, e.g. cfile->tlink. Thus a partially initialized cifsFileInfo structure becomes available to other threads that walk through the inode's lock list. One example of such a thread may be an oplock break worker thread that tries to push all cached byte-range locks. This causes NULL-pointer dereference in smb2_push_mandatory_locks() when accessing cfile->tlink: [598428.945633] BUG: kernel NULL pointer dereference, address: 0000000000000038 ... [598428.945749] Workqueue: cifsoplockd cifs_oplock_break [cifs] [598428.945793] RIP: 0010:smb2_push_mandatory_locks+0xd6/0x5a0 [cifs] ... [598428.945834] Call Trace: [598428.945870] ? cifs_revalidate_mapping+0x45/0x90 [cifs] [598428.945901] cifs_oplock_break+0x13d/0x450 [cifs] [598428.945909] process_one_work+0x1db/0x380 [598428.945914] worker_thread+0x4d/0x400 [598428.945921] kthread+0x104/0x140 [598428.945925] ? process_one_work+0x380/0x380 [598428.945931] ? kthread_park+0x80/0x80 [598428.945937] ret_from_fork+0x35/0x40 Fix this by reordering initialization steps of the cifsFileInfo structure: initialize all the fields first and then add the new byte-range lock list to the inode's lock list. Cc: Stable Signed-off-by: Pavel Shilovsky Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 22802bf742c25b1e2473c70b3b99da98af65ef4d Author: Keith Busch Date: Tue Dec 3 00:44:59 2019 +0900 nvme: Namepace identification descriptor list is optional Despite NVM Express specification 1.3 requires a controller claiming to be 1.3 or higher implement Identify CNS 03h (Namespace Identification Descriptor list), the driver doesn't really need this identification in order to use a namespace. The code had already documented in comments that we're not to consider an error to this command. Return success if the controller provided any response to an namespace identification descriptors command. Fixes: 538af88ea7d9de24 ("nvme: make nvme_report_ns_ids propagate error back") Link: https://bugzilla.kernel.org/show_bug.cgi?id=205679 Reported-by: Ingo Brunberg Cc: Sagi Grimberg Cc: stable@vger.kernel.org # 5.4+ Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 040b5cfbcefa263ccf2c118c4938308606bb7ed8 Author: Martin Varghese Date: Mon Dec 2 10:49:51 2019 +0530 Fixed updating of ethertype in function skb_mpls_pop The skb_mpls_pop was not updating ethertype of an ethernet packet if the packet was originally received from a non ARPHRD_ETHER device. In the below OVS data path flow, since the device corresponding to port 7 is an l3 device (ARPHRD_NONE) the skb_mpls_pop function does not update the ethertype of the packet even though the previous push_eth action had added an ethernet header to the packet. recirc_id(0),in_port(7),eth_type(0x8847), mpls(label=12/0xfffff,tc=0/0,ttl=0/0x0,bos=1/1), actions:push_eth(src=00:00:00:00:00:00,dst=00:00:00:00:00:00), pop_mpls(eth_type=0x800),4 Fixes: ed246cee09b9 ("net: core: move pop MPLS functionality from OvS to core helper") Signed-off-by: Martin Varghese Acked-by: Pravin B Shelar Signed-off-by: David S. Miller commit b3c424eb6a1a3c485de64619418a471dee6ce849 Author: Victorien Molle Date: Mon Dec 2 15:11:38 2019 +0100 sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO This field has never been checked since introduction in mainline kernel Signed-off-by: Victorien Molle Signed-off-by: Florent Fourcot Fixes: 2db6dc2662ba "sch_cake: Make gso-splitting configurable from userspace" Acked-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller commit 937d6eefc716a9071f0e3bada19200de1bb9d048 Merge: 2c97b5ae83dc 36bb9778fd11 Author: Linus Torvalds Date: Mon Dec 2 11:51:02 2019 -0800 Merge tag 'docs-5.5a' of git://git.lwn.net/linux Pull Documentation updates from Jonathan Corbet: "Here are the main documentation changes for 5.5: - Various kerneldoc script enhancements. - More RST conversions; those are slowing down as we run out of things to convert, but we're a ways from done still. - Dan's "maintainer profile entry" work landed at last. Now we just need to get maintainers to fill in the profiles... - A reworking of the parallel build setup to work better with a variety of systems (and to not take over huge systems entirely in particular). - The MAINTAINERS file is now converted to RST during the build. Hopefully nobody ever tries to print this thing, or they will need to load a lot of paper. - A script and documentation making it easy for maintainers to add Link: tags at commit time. Also included is the removal of a bunch of spurious CR characters" * tag 'docs-5.5a' of git://git.lwn.net/linux: (91 commits) docs: remove a bunch of stray CRs docs: fix up the maintainer profile document libnvdimm, MAINTAINERS: Maintainer Entry Profile Maintainer Handbook: Maintainer Entry Profile MAINTAINERS: Reclaim the P: tag for Maintainer Entry Profile docs, parallelism: Rearrange how jobserver reservations are made docs, parallelism: Do not leak blocking mode to other readers docs, parallelism: Fix failure path and add comment Documentation: Remove bootmem_debug from kernel-parameters.txt Documentation: security: core.rst: fix warnings Documentation/process/howto/kokr: Update for 4.x -> 5.x versioning Documentation/translation: Use Korean for Korean translation title docs/memory-barriers.txt: Remove remaining references to mmiowb() docs/memory-barriers.txt/kokr: Update I/O section to be clearer about CPU vs thread docs/memory-barriers.txt/kokr: Fix style, spacing and grammar in I/O section Documentation/kokr: Kill all references to mmiowb() docs/memory-barriers.txt/kokr: Rewrite "KERNEL I/O BARRIER EFFECTS" section docs: Add initial documentation for devfreq Documentation: Document how to get links with git am docs: Add request_irq() documentation ... commit 2c97b5ae83dca56718774e7b4bf9640f05d11867 Merge: 8328dd2f394e a8de1304b7df Author: Linus Torvalds Date: Mon Dec 2 11:41:35 2019 -0800 Merge tag 'devicetree-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree updates from Rob Herring: - DT schemas for PWM, syscon, power domains, SRAM, syscon-reboot, syscon-poweroff, renesas-irqc, simple-pm-bus, renesas-bsc, pwm-rcar, Renesas tpu, at24 eeprom, rtc-sh, Allwinner PS/2, sharp,ld-d5116z01b panel, Arm SMMU, max77650, Meson CEC, Amlogic canvas and DWC3 glue, Allwinner A10 mUSB and CAN, TI Davinci MDIO, QCom QCS404 interconnect, Unisoc/Spreadtrum SoCs and UART - Convert a bunch of Samsung bindings to DT schema - Convert a bunch of ST stm32 bindings to DT schema - Realtek and Exynos additions to Arm Mali bindings - Fix schema errors in RiscV CPU schema - Various schema fixes from improved meta-schema checks - Improve the handling of 'dma-ranges' and in particular fix DMA mask setup on PCI bridges - Fix a memory leak in add_changeset_property() and DT unit tests. - Several documentation improvements for schema validation - Rework build rules to improve schema validation errors - Color output for dtx_diff * tag 'devicetree-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (138 commits) libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h dt-bindings: arm: Remove leftover axentia.txt of: unittest: fix memory leak in attach_node_and_children of: overlay: add_changeset_property() memory leak dt-bindings: interrupt-controller: arm,gic-v3: Add missing type to interrupt-partition-* nodes dt-bindings: firmware: ixp4xx: Drop redundant minItems/maxItems dt-bindings: power: Rename back power_domain.txt bindings to fix references dt-bindings: i2c: stm32: Migrate i2c-stm32 documentation to yaml dt-bindings: mtd: Convert stm32 fmc2-nand bindings to json-schema dt-bindings: remoteproc: convert stm32-rproc to json-schema dt-bindings: mailbox: convert stm32-ipcc to json-schema dt-bindings: mfd: Convert stm32 low power timers bindings to json-schema dt-bindings: interrupt-controller: Convert stm32-exti to json-schema dt-bindings: crypto: Convert stm32 HASH bindings to json-schema dt-bindings: rng: Convert stm32 RNG bindings to json-schema dt-bindings: pwm: Convert Samsung PWM bindings to json-schema dt-bindings: pwm: Convert PWM bindings to json-schema dt-bindings: serial: Add a new compatible string for SC9863A dt-bindings: serial: Convert sprd-uart to json-schema dt-bindings: arm: Add bindings for Unisoc SC9863A ... commit 8328dd2f394e48a010383af176bf55ba4be79da0 Merge: 1daa56bcfd8b 8d82cee2f8aa Author: Linus Torvalds Date: Mon Dec 2 11:26:40 2019 -0800 Merge tag 'pstore-v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore bug fix from Kees Cook: - add missing "static" (Ben Dooks) * tag 'pstore-v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore: Make pstore_choose_compression() static commit 1daa56bcfd8b329447e0c1b1e91c3925d08489b7 Merge: a5255bc31673 9b3a713feef8 Author: Linus Torvalds Date: Mon Dec 2 11:05:00 2019 -0800 Merge tag 'iommu-updates-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: - Conversion of the AMD IOMMU driver to use the dma-iommu code for imlementing the DMA-API. This gets rid of quite some code in the driver itself, but also has some potential for regressions (non are known at the moment). - Support for the Qualcomm SMMUv2 implementation in the SDM845 SoC. This also includes some firmware interface changes, but those are acked by the respective maintainers. - Preparatory work to support two distinct page-tables per domain in the ARM-SMMU driver - Power management improvements for the ARM SMMUv2 - Custom PASID allocator support - Multiple PCI DMA alias support for the AMD IOMMU driver - Adaption of the Mediatek driver to the changed IO/TLB flush interface of the IOMMU core code. - Preparatory patches for the Renesas IOMMU driver to support future hardware. * tag 'iommu-updates-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (62 commits) iommu/rockchip: Don't provoke WARN for harmless IRQs iommu/vt-d: Turn off translations at shutdown iommu/vt-d: Check VT-d RMRR region in BIOS is reported as reserved iommu/arm-smmu: Remove duplicate error message iommu/arm-smmu-v3: Don't display an error when IRQ lines are missing iommu/ipmmu-vmsa: Add utlb_offset_base iommu/ipmmu-vmsa: Add helper functions for "uTLB" registers iommu/ipmmu-vmsa: Calculate context registers' offset instead of a macro iommu/ipmmu-vmsa: Add helper functions for MMU "context" registers iommu/ipmmu-vmsa: tidyup register definitions iommu/ipmmu-vmsa: Remove all unused register definitions iommu/mediatek: Reduce the tlb flush timeout value iommu/mediatek: Get rid of the pgtlock iommu/mediatek: Move the tlb_sync into tlb_flush iommu/mediatek: Delete the leaf in the tlb_flush iommu/mediatek: Use gather to achieve the tlb range flush iommu/mediatek: Add a new tlb_lock for tlb_flush iommu/mediatek: Correct the flush_iotlb_all callback iommu/io-pgtable-arm: Rename IOMMU_QCOM_SYS_CACHE and improve doc iommu/io-pgtable-arm: Rationalise MAIR handling ... commit a5255bc31673c72e264d837cd13cd3085d72cb58 Merge: 596cf45cbf6e 67805a4b3c92 Author: Linus Torvalds Date: Mon Dec 2 11:00:19 2019 -0800 Merge tag 'dmaengine-5.5-rc1' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine updates from Vinod Koul: "Here are the changes this time around, couple of new drivers and updates to few more: - New drivers for SiFive PDMA, Socionext Milbeaut HDMAC and XDMAC, Freescale dpaa2 qDMA - Support for X1000 in JZ4780 - Xilinx dma updates and support for Xilinx AXI MCDM controller - New bindings for rcar R8A774B1 - Minor updates to dw, dma-jz4780, ti-edma, sprd drivers" * tag 'dmaengine-5.5-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (61 commits) dmaengine: Fix Kconfig indentation dmaengine: sf-pdma: move macro to header file dmaengine: sf-pdma: replace /** with /* for non-function comment dmaengine: ti: edma: fix missed failure handling dmaengine: mmp_pdma: add missed of_dma_controller_free dmaengine: mmp_tdma: add missed of_dma_controller_free dmaengine: sprd: Add wrap address support for link-list mode MAINTAINERS: Add Green as SiFive PDMA driver maintainer dmaengine: sf-pdma: add platform DMA support for HiFive Unleashed A00 dt-bindings: dmaengine: sf-pdma: add bindins for SiFive PDMA dmaengine: zx: remove: removed dmam_pool_destroy dmaengine: mediatek: hsdma_probe: fixed a memory leak when devm_request_irq fails dmaengine: iop-adma: clean up an indentation issue dmaengine: milbeaut-xdmac: remove redundant error log dmaengine: milbeaut-hdmac: remove redundant error log dmaengine: dma-jz4780: add missed clk_disable_unprepare in remove dmaengine: JZ4780: Add support for the X1000. dt-bindings: dmaengine: Add X1000 bindings. dmaengine: xilinx_dma: Add Xilinx AXI MCDMA Engine driver support dmaengine: xilinx_dma: Extend dma_config struct to store irq routine handle ... commit a7effde99b6e8119b28c235eda5419c2e03b3089 Author: Joe Perches Date: Thu Nov 28 09:13:26 2019 -0800 MIPS: Kconfig: Use correct form for 'depends on' Remove the CONFIG_ prefix from "depends on" as it makes the selection not possible. Signed-off-by: Joe Perches Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: LKML commit 7d2aa4bb90f5f6f1b8de8848c26042403f2d7bf9 Author: Vincenzo Frascino Date: Fri Nov 29 14:36:58 2019 +0000 mips: Fix gettimeofday() in the vdso library The libc provides a discovery mechanism for vDSO library and its symbols. When a symbol is not exposed by the vDSOs the libc falls back on the system calls. With the introduction of the unified vDSO library on mips this behavior is not honored anymore by the kernel in the case of gettimeofday(). The issue has been noticed and reported due to a dhclient failure on the CI20 board: root@letux:~# dhclient ../../../../lib/isc/unix/time.c:200: Operation not permitted root@letux:~# Restore the original behavior fixing gettimeofday() in the vDSO library. Reported-by: H. Nikolaus Schaller Tested-by: H. Nikolaus Schaller # CI20 with JZ4780 Signed-off-by: Vincenzo Frascino Signed-off-by: Paul Burton Cc: mips-creator-ci20-dev@googlegroups.com Cc: letux-kernel@openphoenux.org Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 734c7022adaa7833aa809b3f2c3fc0cf09b2a48e Merge: 596cf45cbf6e 3464afdf11f9 Author: David S. Miller Date: Mon Dec 2 10:50:29 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-12-02 The following pull-request contains BPF updates for your *net* tree. We've added 10 non-merge commits during the last 6 day(s) which contain a total of 10 files changed, 60 insertions(+), 51 deletions(-). The main changes are: 1) Fix vmlinux BTF generation for binutils pre v2.25, from Stanislav Fomichev. 2) Fix libbpf global variable relocation to take symbol's st_value offset into account, from Andrii Nakryiko. 3) Fix libbpf build on powerpc where check_abi target fails due to different readelf output format, from Aurelien Jarno. 4) Don't set BPF insns RO for the case when they are JITed in order to avoid fragmenting the direct map, from Daniel Borkmann. 5) Fix static checker warning in btf_distill_func_proto() as well as a build error due to empty enum when BPF is compiled out, from Alexei Starovoitov. 6) Fix up generation of bpf_helper_defs.h for perf, from Arnaldo Carvalho de Melo. ==================== Signed-off-by: David S. Miller commit 9974406884459c9301597c2c9f7def6c38099ab4 Author: Arnaldo Carvalho de Melo Date: Mon Dec 2 15:38:59 2019 -0300 perf kvm: Clarify the 'perf kvm' -i and -o command line options The 'perf kvm' subcommand has options that it in turn passes to other perf subcommands such as 'report' and 'record', particularly -i and -o end up setting the same variable that will then be used for 'record's -o and report '-i', which ends up being confusing, leading some to think that both -i and -o can be used with 'report'. Improve the man page to state that -i is used with the post-processing subcommands while -o is used just with 'record' and that to save the output of 'report' one should simply redirect its output to a file. Noticed while reading the https://www.linux-kvm.org/page/Perf_events page. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Steve Dickson Cc: William Cohen Link: https://lkml.kernel.org/n/tip-tclbttvmgtm525fvmh85f7d9@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a717ab38a51404a3f7069987f77676cde82139ac Author: Arnaldo Carvalho de Melo Date: Mon Dec 2 15:11:51 2019 -0300 tools arch x86: Sync asm/cpufeatures.h with the kernel sources To pick up the changes from: a25bbc2644f0 ("Merge branches 'x86-cpu-for-linus' and 'x86-fpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip") db4d30fbb71b ("x86/bugs: Add ITLB_MULTIHIT bug infrastructure") 1b42f017415b ("x86/speculation/taa: Add mitigation for TSX Async Abort") 9d40b85bb46a ("x86/cpufeatures: Add feature bit RDPRU on AMD") These don't cause any changes in tooling, just silences this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Cc: Adrian Hunter Cc: Babu Moger Cc: Borislav Petkov Cc: Jiri Olsa Cc: Namhyung Kim Cc: Pawan Gupta Cc: Thomas Gleixner Cc: Vineela Tummalapalli Link: https://lkml.kernel.org/n/tip-yufg9yt2nbkh45r9xvxnnscq@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f6661125ff41e27b488f36422226653baad3c382 Author: Arnaldo Carvalho de Melo Date: Mon Dec 2 13:02:25 2019 -0300 perf beauty: Add CLEAR_SIGHAND support for clone's flags arg Add support for the recently added CLONE_CLEAR_SIGHAND flag. This takes advantage of the copy of the uapi/linux/sched.h we have in tools/include, which allows us to build tools/perf in older systems and have the binary support printing that flag whenever that system gets its kernel updated to one where this feature is present. Cc: Adrian Hunter Cc: Adrian Reber Cc: Christian Brauner Cc: Jiri Olsa Cc: Namhyung Kim commit 6c3edaf9fd6a3be7fb5bc6931897c24cd3848f84 Author: Cong Wang Date: Fri Nov 29 20:52:18 2019 -0800 tracing: Introduce trace event injection We have been trying to use rasdaemon to monitor hardware errors like correctable memory errors. rasdaemon uses trace events to monitor various hardware errors. In order to test it, we have to inject some hardware errors, unfortunately not all of them provide error injections. MCE does provide a way to inject MCE errors, but errors like PCI error and devlink error don't, it is not easy to add error injection to each of them. Instead, it is relatively easier to just allow users to inject trace events in a generic way so that all trace events can be injected. This patch introduces trace event injection, where a new 'inject' is added to each tracepoint directory. Users could write into this file with key=value pairs to specify the value of each fields of the trace event, all unspecified fields are set to zero values by default. For example, for the net/net_dev_queue tracepoint, we can inject: INJECT=/sys/kernel/debug/tracing/events/net/net_dev_queue/inject echo "" > $INJECT echo "name='test'" > $INJECT echo "name='test' len=1024" > $INJECT cat /sys/kernel/debug/tracing/trace ... <...>-614 [000] .... 36.571483: net_dev_queue: dev= skbaddr=00000000fbf338c2 len=0 <...>-614 [001] .... 136.588252: net_dev_queue: dev=test skbaddr=00000000fbf338c2 len=0 <...>-614 [001] .N.. 208.431878: net_dev_queue: dev=test skbaddr=00000000fbf338c2 len=1024 Triggers could be triggered as usual too: echo "stacktrace if len == 1025" > /sys/kernel/debug/tracing/events/net/net_dev_queue/trigger echo "len=1025" > $INJECT cat /sys/kernel/debug/tracing/trace ... bash-614 [000] .... 36.571483: net_dev_queue: dev= skbaddr=00000000fbf338c2 len=0 bash-614 [001] .... 136.588252: net_dev_queue: dev=test skbaddr=00000000fbf338c2 len=0 bash-614 [001] .N.. 208.431878: net_dev_queue: dev=test skbaddr=00000000fbf338c2 len=1024 bash-614 [001] .N.1 284.236349: => event_inject_write => vfs_write => ksys_write => do_syscall_64 => entry_SYSCALL_64_after_hwframe The only thing that can't be injected is string pointers as they require constant string pointers, this can't be done at run time. Link: http://lkml.kernel.org/r/20191130045218.18979-1-xiyou.wangcong@gmail.com Cc: Ingo Molnar Signed-off-by: Cong Wang Signed-off-by: Steven Rostedt (VMware) commit 2603a4903bf96d2fe15b7d9e2d03b7efdffbd99a Author: Arnaldo Carvalho de Melo Date: Mon Dec 2 12:56:39 2019 -0300 tools headers UAPI: Sync sched.h with the kernel To get the changes in: 0acefef58451 ("Merge tag 'threads-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux") 49cb2fc42ce4 ("fork: extend clone3() to support setting a PID") fa729c4df558 ("clone3: validate stack arguments") b612e5df4587 ("clone3: add CLONE_CLEAR_SIGHAND") This file gets rebuilt, but no changes ensues: CC /tmp/build/perf/trace/beauty/clone.o This addresses this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/sched.h' differs from latest version at 'include/uapi/linux/sched.h' diff -u tools/include/uapi/linux/sched.h include/uapi/linux/sched. The CLONE_CLEAR_SIGHAND one will be used in tools/perf/trace/beauty/clone.c in a followup patch to show that string when this bit is set in the syscall arg. Keeping a copy of this file allows us to build this in older systems and have the binary support printing that flag whenever that system gets its kernel updated to one where this feature is present. Cc: Adrian Hunter Cc: Adrian Reber Cc: Christian Brauner Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-nprqsvvzbhzoy64cbvos6c5b@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 1fc3d0ee242de68267769afcaf5520439de42f64 Author: Arnaldo Carvalho de Melo Date: Mon Dec 2 12:44:24 2019 -0300 tools headers kvm: Sync kvm headers with the kernel sources To pick up the changes from: 14edff88315a Merge tag 'kvmarm-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD a4b28f5c6798 Merge remote-tracking branch 'kvmarm/kvm-arm64/stolen-time' into kvmarm-master/next 58772e9a3db7 ("KVM: arm64: Provide VCPU attributes for stolen time") da345174ceca ("KVM: arm/arm64: Allow user injection of external data aborts") c726200dd106 ("KVM: arm/arm64: Allow reporting non-ISV data aborts to userspace") efe5ddcae496 ("KVM: PPC: Book3S HV: XIVE: Allow userspace to set the # of VPs") No tools changes are caused by this, as the only defines so far used from these files are for syscall arg pretty printing are: $ grep KVM tools/perf/trace/beauty/*.sh tools/perf/trace/beauty/kvm_ioctl.sh:regex='^#[[:space:]]*define[[:space:]]+KVM_(\w+)[[:space:]]+_IO[RW]*\([[:space:]]*KVMIO[[:space:]]*,[[:space:]]*(0x[[:xdigit:]]+).*' $ Some are also include by: tools/perf/arch/x86/util/kvm-stat.c tools/perf/arch/powerpc/util/kvm-stat.c This addresses these tools/perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Warning: Kernel ABI header at 'tools/arch/powerpc/include/uapi/asm/kvm.h' differs from latest version at 'arch/powerpc/include/uapi/asm/kvm.h' diff -u tools/arch/powerpc/include/uapi/asm/kvm.h arch/powerpc/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/arm/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm/include/uapi/asm/kvm.h' diff -u tools/arch/arm/include/uapi/asm/kvm.h arch/arm/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm64/include/uapi/asm/kvm.h' diff -u tools/arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/kvm.h Cc: Adrian Hunter Cc: Christoffer Dall Cc: Fabiano Rosas Cc: Greg Kurz Cc: Jiri Olsa Cc: Marc Zyngier Cc: Namhyung Kim Cc: Paul Mackerras Cc: Steven Price Link: https://lkml.kernel.org/n/tip-qrjdudhq25mk5bfnhveofbm4@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 0b8c0ec7eedcd8f9f1a1f238d87f9b512b09e71a Author: Jens Axboe Date: Mon Dec 2 08:50:00 2019 -0700 io_uring: use current task creds instead of allocating a new one syzbot reports: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9217 Comm: io_uring-sq Not tainted 5.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:creds_are_invalid kernel/cred.c:792 [inline] RIP: 0010:__validate_creds include/linux/cred.h:187 [inline] RIP: 0010:override_creds+0x9f/0x170 kernel/cred.c:550 Code: ac 25 00 81 fb 64 65 73 43 0f 85 a3 37 00 00 e8 17 ab 25 00 49 8d 7c 24 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 96 00 00 00 41 8b 5c 24 10 bf RSP: 0018:ffff88809c45fda0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000043736564 RCX: ffffffff814f3318 RDX: 0000000000000002 RSI: ffffffff814f3329 RDI: 0000000000000010 RBP: ffff88809c45fdb8 R08: ffff8880a3aac240 R09: ffffed1014755849 R10: ffffed1014755848 R11: ffff8880a3aac247 R12: 0000000000000000 R13: ffff888098ab1600 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd51c40664 CR3: 0000000092641000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: io_sq_thread+0x1c7/0xa20 fs/io_uring.c:3274 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Modules linked in: ---[ end trace f2e1a4307fbe2245 ]--- RIP: 0010:creds_are_invalid kernel/cred.c:792 [inline] RIP: 0010:__validate_creds include/linux/cred.h:187 [inline] RIP: 0010:override_creds+0x9f/0x170 kernel/cred.c:550 Code: ac 25 00 81 fb 64 65 73 43 0f 85 a3 37 00 00 e8 17 ab 25 00 49 8d 7c 24 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 96 00 00 00 41 8b 5c 24 10 bf RSP: 0018:ffff88809c45fda0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000043736564 RCX: ffffffff814f3318 RDX: 0000000000000002 RSI: ffffffff814f3329 RDI: 0000000000000010 RBP: ffff88809c45fdb8 R08: ffff8880a3aac240 R09: ffffed1014755849 R10: ffffed1014755848 R11: ffff8880a3aac247 R12: 0000000000000000 R13: ffff888098ab1600 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd51c40664 CR3: 0000000092641000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 which is caused by slab fault injection triggering a failure in prepare_creds(). We don't actually need to create a copy of the creds as we're not modifying it, we just need a reference on the current task creds. This avoids the failure case as well, and propagates the const throughout the stack. Fixes: 181e448d8709 ("io_uring: async workers should inherit the user creds") Reported-by: syzbot+5320383e16029ba057ff@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit c66f2566db340b04c113ea1d930651246d9d4049 Author: Arnaldo Carvalho de Melo Date: Mon Dec 2 12:24:52 2019 -0300 tools headers uapi: Sync linux/stat.h with the kernel sources To pick the changes from: 3ad2522c64cf ("statx: define STATX_ATTR_VERITY") That don't trigger any changes in tooling. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/stat.h' differs from latest version at 'include/uapi/linux/stat.h' diff -u tools/include/uapi/linux/stat.h include/uapi/linux/stat.h At some point we wi'll beautify structs passed in pointers to syscalls and then we'll need to have tables for these defines, for now update the file to silence the warning as this file is used for doing this type of number -> string translations for other defines found in these file. Cc: Adrian Hunter Cc: Eric Biggers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-thcy60dpry5qrpn7nmc58bwg@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ad46f35cca45e3164137271cd7f06d7e66dae6be Author: Arnaldo Carvalho de Melo Date: Mon Dec 2 12:19:24 2019 -0300 tools headers uapi: Sync linux/fscrypt.h with the kernel sources To pick the changes from: b103fb7653ff ("fscrypt: add support for IV_INO_LBLK_64 policies") That don't trigger any changes in tooling. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/fscrypt.h' differs from latest version at 'include/uapi/linux/fscrypt.h' diff -u tools/include/uapi/linux/fscrypt.h include/uapi/linux/fscrypt.h Cc: Adrian Hunter Cc: Eric Biggers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-cgfz3ffe07pw2m8hmstvkudl@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 8122b047dd18ef6e7e1c564e28f3c7067c5a2d71 Author: Arnaldo Carvalho de Melo Date: Mon Dec 2 12:03:49 2019 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes from these csets: 3f3c8be973af Merge tag 'for-linus-5.5a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip 4e3f77d8419b ("xen/mcelog: add PPIN to record when available") db4d30fbb71b ("x86/bugs: Add ITLB_MULTIHIT bug infrastructure") 1b42f017415b ("x86/speculation/taa: Add mitigation for TSX Async Abort") c2955f270a84 ("x86/msr: Add the IA32_TSX_CTRL MSR") These are the changes in tooling that this udpate ensues: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > /tmp/before $ $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > /tmp/after $ diff -u /tmp/before /tmp/after --- /tmp/before 2019-12-02 11:54:44.371035723 -0300 +++ /tmp/after 2019-12-02 11:55:31.847859784 -0300 @@ -48,6 +48,7 @@ [0x00000119] = "IA32_BBL_CR_CTL", [0x0000011e] = "IA32_BBL_CR_CTL3", [0x00000120] = "IDT_MCR_CTRL", + [0x00000122] = "IA32_TSX_CTRL", [0x00000140] = "MISC_FEATURES_ENABLES", [0x00000174] = "IA32_SYSENTER_CS", [0x00000175] = "IA32_SYSENTER_ESP", @@ -283,4 +284,6 @@ [0xc0010240 - x86_AMD_V_KVM_MSRs_offset] = "F15H_NB_PERF_CTL", [0xc0010241 - x86_AMD_V_KVM_MSRs_offset] = "F15H_NB_PERF_CTR", [0xc0010280 - x86_AMD_V_KVM_MSRs_offset] = "F15H_PTSC", + [0xc00102f0 - x86_AMD_V_KVM_MSRs_offset] = "AMD_PPIN_CTL", + [0xc00102f1 - x86_AMD_V_KVM_MSRs_offset] = "AMD_PPIN", }; $ CC /tmp/build/perf/trace/beauty/tracepoints/x86_msr.o LD /tmp/build/perf/trace/beauty/tracepoints/perf-in.o LD /tmp/build/perf/trace/beauty/perf-in.o LD /tmp/build/perf/perf-in.o Now it is possible to use these strings when setting up filters for the msr:* tracepoints, like: # perf trace -e msr:* --filter=msr==IA32_TSX_CTRL ^C[root@quaco ~]# If we use an invalid operator we can check what is the filter that is put in place: # perf trace -e msr:* --filter=msr=IA32_TSX_CTRL Failed to set filter "(msr=0x122) && (common_pid != 25976 && common_pid != 25860)" on event msr:read_msr with 22 (Invalid argument) One can as well use -v to see the tracepoints and its filters: # perf trace -v -e msr:* --filter=msr==IA32_TSX_CTRL Using CPUID GenuineIntel-6-8E-A New filter for msr:read_msr: (msr==0x122) && (common_pid != 26110 && common_pid != 25860) New filter for msr:write_msr: (msr==0x122) && (common_pid != 26110 && common_pid != 25860) New filter for msr:rdpmc: (msr==0x122) && (common_pid != 26110 && common_pid != 25860) mmap size 528384B ^C# Better than keep looking up those numbers, works with callchains as well, e.g. for something more common: # perf trace -e msr:*/max-stack=16/ --filter="msr==IA32_SPEC_CTRL" --max-events=2 0.000 SCTP timer/6158 msr:write_msr(msr: IA32_SPEC_CTRL, val: 6) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __sched_text_start ([kernel.kallsyms]) schedule ([kernel.kallsyms]) schedule_hrtimeout_range_clock ([kernel.kallsyms]) poll_schedule_timeout.constprop.0 ([kernel.kallsyms]) do_select ([kernel.kallsyms]) core_sys_select ([kernel.kallsyms]) kern_select ([kernel.kallsyms]) __x64_sys_select ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64 ([kernel.kallsyms]) __select (/usr/lib64/libc-2.29.so) [0] ([unknown]) 0.024 :0/0 msr:write_msr(msr: IA32_SPEC_CTRL) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __sched_text_start ([kernel.kallsyms]) schedule_idle ([kernel.kallsyms]) do_idle ([kernel.kallsyms]) cpu_startup_entry ([kernel.kallsyms]) start_secondary ([kernel.kallsyms]) [0x2000d4] ([kernel.kallsyms]) # Cc: Adrian Hunter Cc: Jan Beulich Cc: Jiri Olsa Cc: Juergen Gross Cc: Namhyung Kim Cc: Pawan Gupta Cc: Thomas Gleixner Cc: Vineela Tummalapalli Link: https://lkml.kernel.org/n/tip-n1xd78fpd5lxn4q1brqi2jl6@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 1e58252e334dc3f3756f424a157d1b7484464c40 Author: qize wang Date: Fri Nov 29 18:10:54 2019 +0800 mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() mwifiex_process_tdls_action_frame() without checking the incoming tdls infomation element's vality before use it, this may cause multi heap buffer overflows. Fix them by putting vality check before use it. IE is TLV struct, but ht_cap and ht_oper aren’t TLV struct. the origin marvell driver code is wrong: memcpy(&sta_ptr->tdls_cap.ht_oper, pos,.... memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos,... Fix the bug by changing pos(the address of IE) to pos+2 ( the address of IE value ). Signed-off-by: qize wang Signed-off-by: Kalle Valo commit 693d060536abca7b16d2fb8e66aa56be2a2443a2 Author: Lorenzo Bianconi Date: Sun Nov 24 00:42:22 2019 +0200 mt76: mt76x0: fix default mac address overwrite Current implementation always use default eeprom mac address to configure device registers even if it is updated using mt76_eeprom_override. Fix it initializing macaddr filed of mt76_dev data structure with eeprom mac address and running mt76_eeprom_override before mt76x02_mac_setaddr Fixes: d1bc9bf2072c ("mt76: mt76x0: eeprom: add support for MAC address from OF") Tested-by: Kevin Schmidt Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo commit bd5c6b81dd6025bd4c6ca7800a580b217d9899b9 Author: Arnaldo Carvalho de Melo Date: Mon Dec 2 11:40:57 2019 -0300 perf bench: Update the copies of x86's mem{cpy,set}_64.S And update linux/linkage.h, which requires in turn that we make these files switch from ENTRY()/ENDPROC() to SYM_FUNC_START()/SYM_FUNC_END(): tools/perf/arch/arm64/tests/regs_load.S tools/perf/arch/arm/tests/regs_load.S tools/perf/arch/powerpc/tests/regs_load.S tools/perf/arch/x86/tests/regs_load.S We also need to switch SYM_FUNC_START_LOCAL() to SYM_FUNC_START() for the functions used directly by 'perf bench', and update tools/perf/check_headers.sh to ignore those changes when checking if the kernel original files drifted from the copies we carry. This is to get the changes from: 6dcc5627f6ae ("x86/asm: Change all ENTRY+ENDPROC to SYM_FUNC_*") ef1e03152cb0 ("x86/asm: Make some functions local") e9b9d020c487 ("x86/asm: Annotate aliases") And address these tools/perf build warnings: Warning: Kernel ABI header at 'tools/arch/x86/lib/memcpy_64.S' differs from latest version at 'arch/x86/lib/memcpy_64.S' diff -u tools/arch/x86/lib/memcpy_64.S arch/x86/lib/memcpy_64.S Warning: Kernel ABI header at 'tools/arch/x86/lib/memset_64.S' differs from latest version at 'arch/x86/lib/memset_64.S' diff -u tools/arch/x86/lib/memset_64.S arch/x86/lib/memset_64.S Cc: Adrian Hunter Cc: Borislav Petkov Cc: Jiri Olsa Cc: Jiri Slaby Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-tay3l8x8k11p7y3qcpqh9qh5@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 856a0a6e2d09d31fd8f00cc1fc6645196a509d56 Author: Wen Yang Date: Sat Nov 30 21:08:42 2019 +0800 platform/chrome: wilco_ec: fix use after free issue This is caused by dereferencing 'dev_data' after put_device() in the telem_device_remove() function. This patch just moves the put_device() down a bit to avoid this issue. Fixes: 1210d1e6bad1 ("platform/chrome: wilco_ec: Add telemetry char device interface") Signed-off-by: Wen Yang Cc: Benson Leung Cc: Enric Balletbo i Serra Cc: Nick Crews Cc: linux-kernel@vger.kernel.org Signed-off-by: Enric Balletbo i Serra commit 4afaab78522f5ea96a1b1087fe9768f3af935ac2 Merge: 3ee1a9f5d0bc 92b1aa773fad Author: Joonas Lahtinen Date: Mon Dec 2 12:17:25 2019 +0200 Merge tag 'gvt-next-fixes-2019-12-02' of https://github.com/intel/gvt-linux into drm-intel-next-fixes gvt-next-fixes-2019-12-02 - Fix cmd parser for MI_ATOMIC (Zhenyu) - Fix non-priv register access warning on CFL (Fred) Signed-off-by: Joonas Lahtinen From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20191202051711.GZ4196@zhen-hp.sh.intel.com commit 3464afdf11f9a1e031e7858a05351ceca1792fea Author: Aurelien Jarno Date: Sun Dec 1 20:57:28 2019 +0100 libbpf: Fix readelf output parsing on powerpc with recent binutils On powerpc with recent versions of binutils, readelf outputs an extra field when dumping the symbols of an object file. For example: 35: 0000000000000838 96 FUNC LOCAL DEFAULT [: 8] 1 btf_is_struct The extra "[: 8]" prevents the GLOBAL_SYM_COUNT variable to be computed correctly and causes the check_abi target to fail. Fix that by looking for the symbol name in the last field instead of the 8th one. This way it should also cope with future extra fields. Signed-off-by: Aurelien Jarno Signed-off-by: Daniel Borkmann Tested-by: Michael Ellerman Link: https://lore.kernel.org/bpf/20191201195728.4161537-1-aurelien@aurel32.net commit 3ee1a9f5d0bc0e9dbac5b014e2e8a7d540b836df Author: Chris Wilson Date: Fri Nov 29 15:18:45 2019 +0000 drm/i915/gem: Take timeline->mutex to walk list-of-requests Though the context is closed and so no more requests can be added to the timeline, retirement can still be removing requests. It can even be removing the very request we are inspecting and so cause us to wander into dead links. Serialise with the retirement by taking the timeline->mutex used for guarding the timeline->requests list. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112404 Fixes: 4a3174152147 ("drm/i915/gem: Refine occupancy test in kill_context()") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Mika Kuoppala Cc: Matthew Auld Cc: Joonas Lahtinen Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191129151845.1092933-1-chris@chris-wilson.co.uk (cherry picked from commit 7ce596a8036cf3a4cb9ffa0c4edd8a76a7a43cc3) Signed-off-by: Joonas Lahtinen commit d1f4c966475c6dd2545c6625022cb24e878bee11 Author: wenxu Date: Wed Nov 13 12:21:07 2019 +0800 netfilter: nf_tables_offload: Check for the NETDEV_UNREGISTER event Check for the NETDEV_UNREGISTER event from the nft_offload_netdev_event function, which is the event that actually triggers the clean up. Fixes: 06d392cbe3db ("netfilter: nf_tables_offload: remove rules when the device unregisters") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit 024aa8732acb7d2503eae43c3fe3504d0a8646d0 Author: Rafael J. Wysocki Date: Thu Nov 28 23:50:40 2019 +0100 ACPI: PM: s2idle: Rework ACPI events synchronization Note that the EC GPE processing need not be synchronized in acpi_s2idle_wake() after invoking acpi_ec_dispatch_gpe(), because that function checks the GPE status and dispatches its handler if need be and the SCI action handler is not going to run anyway at that point. Moreover, it is better to drain all of the pending ACPI events before restoring the working-state configuration of GPEs in acpi_s2idle_restore(), because those events are likely to be related to system wakeup, in which case they will not be relevant going forward. Rework the code to take these observations into account. Tested-by: Kenneth R. Crudup Signed-off-by: Rafael J. Wysocki commit 016b87ca5c8c6e9e87db442f04dc99609b11ed36 Author: Rafael J. Wysocki Date: Thu Nov 28 23:47:51 2019 +0100 ACPI: EC: Rework flushing of pending work There is a race condition in the ACPI EC driver, between __acpi_ec_flush_event() and acpi_ec_event_handler(), that may cause systems to stay in suspended-to-idle forever after a wakeup event coming from the EC. Namely, acpi_s2idle_wake() calls acpi_ec_flush_work() to wait until the delayed work resulting from the handling of the EC GPE in acpi_ec_dispatch_gpe() is processed, and that function invokes __acpi_ec_flush_event() which uses wait_event() to wait for ec->nr_pending_queries to become zero on ec->wait, and that wait queue may be woken up too early. Suppose that acpi_ec_dispatch_gpe() has caused acpi_ec_gpe_handler() to run, so advance_transaction() has been called and it has invoked acpi_ec_submit_query() to queue up an event work item, so ec->nr_pending_queries has been incremented (under ec->lock). The work function of that work item, acpi_ec_event_handler() runs later and calls acpi_ec_query() to process the event. That function calls acpi_ec_transaction() which invokes acpi_ec_transaction_unlocked() and the latter wakes up ec->wait under ec->lock, but it drops that lock before returning. When acpi_ec_query() returns, acpi_ec_event_handler() acquires ec->lock and decrements ec->nr_pending_queries, but at that point __acpi_ec_flush_event() (woken up previously) may already have acquired ec->lock, checked the value of ec->nr_pending_queries (and it would not have been zero then) and decided to go back to sleep. Next, if ec->nr_pending_queries is equal to zero now, the loop in acpi_ec_event_handler() terminates, ec->lock is released and acpi_ec_check_event() is called, but it does nothing unless ec_event_clearing is equal to ACPI_EC_EVT_TIMING_EVENT (which is not the case by default). In the end, if no more event work items have been queued up while executing acpi_ec_transaction_unlocked(), there is nothing to wake up __acpi_ec_flush_event() again and it sleeps forever, so the suspend-to-idle loop cannot make progress and the system is permanently suspended. To avoid this issue, notice that it actually is not necessary to wait for ec->nr_pending_queries to become zero in every case in which __acpi_ec_flush_event() is used. First, during platform-based system suspend (not suspend-to-idle), __acpi_ec_flush_event() is called by acpi_ec_disable_event() after clearing the EC_FLAGS_QUERY_ENABLED flag, which prevents acpi_ec_submit_query() from submitting any new event work items, so calling flush_scheduled_work() and flushing ec_query_wq subsequently (in order to wait until all of the queries in that queue have been processed) would be sufficient to flush all of the pending EC work in that case. Second, the purpose of the flushing of pending EC work while suspended-to-idle described above really is to wait until the first event work item coming from acpi_ec_dispatch_gpe() is complete, because it should produce system wakeup events if that is a valid EC-based system wakeup, so calling flush_scheduled_work() followed by flushing ec_query_wq is also sufficient for that purpose. Rework the code to follow the above observations. Fixes: 56b9918490 ("PM: sleep: Simplify suspend-to-idle control flow") Reported-by: Kenneth R. Crudup Tested-by: Kenneth R. Crudup Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki commit b3f7931f5c61ba39e81a5c958bf5d65ebb1838af Author: Juergen Gross Date: Thu Nov 7 12:15:46 2019 +0100 xen/gntdev: switch from kcalloc() to kvcalloc() With sufficient many pages to map gntdev can reach order 9 allocation sizes. As there is no need to have physically contiguous buffers switch to kvcalloc() in order to avoid failing allocations. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Andrushchenko Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 3b06ac6707c196b5036fe013c460da86c9060085 Author: Juergen Gross Date: Thu Nov 7 12:15:45 2019 +0100 xen/gntdev: replace global limit of mapped pages by limit per call Today there is a global limit of pages mapped via /dev/xen/gntdev set to 1 million pages per default. There is no reason why that limit is existing, as total number of grant mappings is limited by the hypervisor anyway and preferring kernel mappings over userspace ones doesn't make sense. It should be noted that the gntdev device is usable by root only. Additionally checking of that limit is fragile, as the number of pages to map via one call is specified in a 32-bit unsigned variable which isn't tested to stay within reasonable limits (the only test is the value to be <= zero, which basically excludes only calls without any mapping requested). So trying to map e.g. 0xffff0000 pages while already nearly 1000000 pages are mapped will effectively lower the global number of mapped pages such that a parallel call mapping a reasonable amount of pages can succeed in spite of the global limit being violated. So drop the global limit and introduce per call limit instead. This per call limit (default: 65536 grant mappings) protects against allocating insane large arrays in the kernel for doing a hypercall which will fail anyway in case a user is e.g. trying to map billions of pages. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Andrushchenko Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit d41b26d81a83e04500e926fbab746ae87c20bb0e Author: Colin Ian King Date: Mon Nov 11 12:20:09 2019 +0000 xen/gntdev: remove redundant non-zero check on ret The non-zero check on ret is always going to be false because ret was initialized as zero and the only place it is set to non-zero contains a return path before the non-zero check. Hence the check is redundant and can be removed. [ jgross@suse.com: limit scope of ret ] Addresses-Coverity: ("Logically dead code") Signed-off-by: Colin Ian King Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 348be43384e6bcd5e9da7ff5f1680d49f65c488d Author: Juergen Gross Date: Fri Nov 29 13:39:41 2019 +0100 xen/events: remove event handling recursion detection __xen_evtchn_do_upcall() contains guards against being called recursively. This mechanism was introduced in the early pvops times (kernel 2.6.26) when there were all the Xen backend drivers missing from the upstream kernel, and some of those out-of-tree drivers were enabling interrupts in their event handlers (which was explicitly allowed in the initial XenoLinux). Nowadays we don't need to support those old drivers any more and the capability to allow recursive calls of __xen_evtchn_do_upcall() can be removed. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 596cf45cbf6e4fa7bcb0df33e373a7d062b644b5 Merge: c3bfc5dd73c6 937790699be9 Author: Linus Torvalds Date: Sun Dec 1 20:36:41 2019 -0800 Merge branch 'akpm' (patches from Andrew) Merge updates from Andrew Morton: "Incoming: - a small number of updates to scripts/, ocfs2 and fs/buffer.c - most of MM I still have quite a lot of material (mostly not MM) staged after linux-next due to -next dependencies. I'll send those across next week as the preprequisites get merged up" * emailed patches from Andrew Morton : (135 commits) mm/page_io.c: annotate refault stalls from swap_readpage mm/Kconfig: fix trivial help text punctuation mm/Kconfig: fix indentation mm/memory_hotplug.c: remove __online_page_set_limits() mm: fix typos in comments when calling __SetPageUptodate() mm: fix struct member name in function comments mm/shmem.c: cast the type of unmap_start to u64 mm: shmem: use proper gfp flags for shmem_writepage() mm/shmem.c: make array 'values' static const, makes object smaller userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK fs/userfaultfd.c: wp: clear VM_UFFD_MISSING or VM_UFFD_WP during userfaultfd_register() userfaultfd: wrap the common dst_vma check into an inlined function userfaultfd: remove unnecessary WARN_ON() in __mcopy_atomic_hugetlb() userfaultfd: use vma_pagesize for all huge page size calculation mm/madvise.c: use PAGE_ALIGN[ED] for range checking mm/madvise.c: replace with page_size() in madvise_inject_error() mm/mmap.c: make vma_merge() comment more easy to understand mm/hwpoison-inject: use DEFINE_DEBUGFS_ATTRIBUTE to define debugfs fops autonuma: reduce cache footprint when scanning page tables autonuma: fix watermark checking in migrate_balanced_pgdat() ... commit c3bfc5dd73c6f519ff0636d4e709515f06edef78 Merge: e5b3fc125d76 c5d728113532 Author: Linus Torvalds Date: Sun Dec 1 20:35:03 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Fix several scatter gather list issues in kTLS code, from Jakub Kicinski. 2) macb driver device remove has to kill the hresp_err_tasklet. From Chuhong Yuan. 3) Several memory leak and reference count bug fixes in tipc, from Tung Nguyen. 4) Fix mlx5 build error w/o ipv6, from Yue Haibing. 5) Fix jumbo frame and other regressions in r8169, from Heiner Kallweit. 6) Undo some BUG_ON()'s and replace them with WARN_ON_ONCE and proper error propagation/handling. From Paolo Abeni. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (24 commits) openvswitch: remove another BUG_ON() openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() net: phy: realtek: fix using paged operations with RTL8105e / RTL8208 r8169: fix resume on cable plug-in r8169: fix jumbo configuration for RTL8168evl net: emulex: benet: indent a Kconfig depends continuation line selftests: forwarding: fix race between packet receive and tc check net: sched: fix `tc -s class show` no bstats on class with nolock subqueues net: ethernet: ti: ale: ensure vlan/mdb deleted when no members net/mlx5e: Fix build error without IPV6 selftests: pmtu: use -oneline for ip route list cache tipc: fix duplicate SYN messages under link congestion tipc: fix wrong timeout input for tipc_wait_for_cond() tipc: fix wrong socket reference counter after tipc_sk_timeout() returns tipc: fix potential memory leak in __tipc_sendmsg() net: macb: add missed tasklet_kill selftests: bpf: correct perror strings selftests: bpf: test_sockmap: handle file creation failures gracefully net/tls: use sg_next() to walk sg entries net/tls: remove the dead inplace_crypto code ... commit 92b1aa773fadb4e2a90ed5d3beecb422d568ad9a Author: Zhenyu Wang Date: Thu Nov 21 13:57:45 2019 +0800 drm/i915/gvt: Fix cmd length check for MI_ATOMIC Correct valid command length check for MI_ATOMIC, need to check inline data available field instead of operand data length for whole command. Fixes: 00a33be40634 ("drm/i915/gvt: Add valid length check for MI variable commands") Reported-by: Alex Williamson Acked-by: Gao Fred Cc: stable@vger.kernel.org Signed-off-by: Zhenyu Wang commit e5b3fc125d768eacd73bb4dc5019f0ce95635af4 Merge: b7fcf31f7036 91298f1a302d Author: Linus Torvalds Date: Sun Dec 1 19:05:07 2019 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Various fixes: - Fix the PAT performance regression that downgraded write-combining device memory regions to uncached. - There's been a number of bugs in 32-bit double fault handling - hopefully all fixed now. - Fix an LDT crash - Fix an FPU over-optimization that broke with GCC9 code optimizations. - Misc cleanups" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm/pat: Fix off-by-one bugs in interval tree search x86/ioperm: Save an indentation level in tss_update_io_bitmap() x86/fpu: Don't cache access to fpu_fpregs_owner_ctx x86/entry/32: Remove unused 'restore_all_notrace' local label x86/ptrace: Document FSBASE and GSBASE ABI oddities x86/ptrace: Remove set_segment_reg() implementations for current x86/traps: die() instead of panicking on a double fault x86/doublefault/32: Rewrite the x86_32 #DF handler and unify with 64-bit x86/doublefault/32: Move #DF stack and TSS to cpu_entry_area x86/doublefault/32: Rename doublefault.c to doublefault_32.c x86/traps: Disentangle the 32-bit and 64-bit doublefault code lkdtm: Add a DOUBLE_FAULT crash type on x86 selftests/x86/single_step_syscall: Check SYSENTER directly x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all() commit b7fcf31f7036895ca8fc3a30eefffab0e82f75f6 Merge: 72c0870e3a05 e680a41fcaf0 Author: Linus Torvalds Date: Sun Dec 1 18:49:57 2019 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: - Make /sys/devices/cpu/rdpmc based RDPMC enforcement more instantaneous - decoder: Update the Intel opcode map - Various tooling fixes, including a few late optimizations and cleanups. * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) perf script: Fix invalid LBR/binary mismatch error perf script: Fix brstackinsn for AUXTRACE perf affinity: Add infrastructure to save/restore affinity perf pmu: Use file system cache to optimize sysfs access perf regs: Make perf_reg_name() return "unknown" instead of NULL perf diff: Use llabs() with 64-bit values perf diff: Use llabs() with 64-bit values perf/x86: Implement immediate enforcement of /sys/devices/cpu/rdpmc value of 0 perf tools: Allow to link with libbpf dynamicaly perf tests: Rename tests/map_groups.c to tests/maps.c perf tests: Rename thread-mg-share to thread-maps-share perf maps: Rename map_groups.h to maps.h perf maps: Rename 'mg' variables to 'maps' perf map_symbol: Rename ms->mg to ms->maps perf addr_location: Rename al->mg to al->maps perf thread: Rename thread->mg to thread->maps perf maps: Merge 'struct maps' with 'struct map_groups' x86/insn: perf tools: Add some more instructions to the new instructions test x86/insn: Add some more Intel instructions to the opcode map perf map: Remove unused functions ... commit 72c0870e3a05d9cd5466d08c3d2a3069ed0a2f9f Merge: d10032dd539c 976e3645923b Author: Linus Torvalds Date: Sun Dec 1 18:45:29 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - updates to Ilitech driver to support ILI2117 - face lift of st1232 driver to support MT-B protocol - a new driver for i.MX system controller keys - mpr121 driver now supports polling mode - various input drivers have been switched away from input_polled_dev to use polled mode of regular input devices - other assorted cleanups and fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (70 commits) Input: synaptics-rmi4 - fix various V4L2 compliance problems in F54 Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus Input: fix Kconfig indentation Input: imx_sc_key - correct SCU message structure to avoid stack corruption Input: ili210x - optionally show calibrate sysfs attribute Input: ili210x - add resolution to chip operations structure Input: ili210x - do not retrieve/print chip firmware version Input: mms114 - use device_get_match_data Input: ili210x - remove unneeded suspend and resume handlers Input: ili210x - do not unconditionally mark touchscreen as wakeup source Input: ili210x - define and use chip operations structure Input: ili210x - do not set parent device explicitly Input: ili210x - handle errors from input_mt_init_slots() Input: ili210x - switch to using threaded IRQ Input: ili210x - add ILI2117 support dt-bindings: input: touchscreen: ad7879: generic node names in example Input: ar1021 - fix typo in preprocessor macro name Input: synaptics-rmi4 - simplify data read in rmi_f54_work Input: kxtj9 - switch to using polled mode of input devices Input: kxtj9 - switch to using managed resources ... commit d10032dd539c93dbff016f5667e5627c6c2a4467 Merge: 43fd4bd72c85 0dfbb932bb67 Author: Linus Torvalds Date: Sun Dec 1 18:43:25 2019 -0800 Merge tag 'libnvdimm-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Dan Williams: "The highlight this cycle is continuing integration fixes for PowerPC and some resulting optimizations. Summary: - Updates to better support vmalloc space restrictions on PowerPC platforms. - Cleanups to move common sysfs attributes to core 'struct device_type' objects. - Export the 'target_node' attribute (the effective numa node if pmem is marked online) for regions and namespaces. - Miscellaneous fixups and optimizations" * tag 'libnvdimm-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: (21 commits) MAINTAINERS: Remove Keith from NVDIMM maintainers libnvdimm: Export the target_node attribute for regions and namespaces dax: Add numa_node to the default device-dax attributes libnvdimm: Simplify root read-only definition for the 'resource' attribute dax: Simplify root read-only definition for the 'resource' attribute dax: Create a dax device_type libnvdimm: Move nvdimm_bus_attribute_group to device_type libnvdimm: Move nvdimm_attribute_group to device_type libnvdimm: Move nd_mapping_attribute_group to device_type libnvdimm: Move nd_region_attribute_group to device_type libnvdimm: Move nd_numa_attribute_group to device_type libnvdimm: Move nd_device_attribute_group to device_type libnvdimm: Move region attribute group definition libnvdimm: Move attribute groups to device type libnvdimm: Remove prototypes for nonexistent functions libnvdimm/btt: fix variable 'rc' set but not used libnvdimm/pmem: Delete include of nd-core.h libnvdimm/namespace: Differentiate between probe mapping and runtime mapping libnvdimm/pfn_dev: Don't clear device memmap area during generic namespace probe libnvdimm: Trivial comment fix ... commit 43fd4bd72c85c1e8dac0f23dce16f0277791dcdd Merge: 454d9c4aa7d5 c6c6bc6ea9fc Author: Linus Torvalds Date: Sun Dec 1 18:42:02 2019 -0800 Merge tag 'mailbox-v5.5' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - omap : misc - catch error returned from pm_runtime_put_sync - hisi : misc - drop .owner from platform_driver - stm : change how wakeup is handled - imx : fix - bailout on error and nuke correct irq - imx : add support for imx7ulp platform * tag 'mailbox-v5.5' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: imx: add support for imx v1 mu dt-bindings: mailbox: imx-mu: add imx7ulp MU support mailbox: imx: Clear the right interrupts at shutdown mailbox: imx: Fix Tx doorbell shutdown path mailbox: stm32-ipcc: Update wakeup management mailbox: no need to set .owner platform_driver_register mailbox/omap: Handle if CONFIG_PM is disabled commit 454d9c4aa7d54fd4f15c1427fc4f51347f300262 Merge: 687fcad8a3ab 9d399f0c5295 Author: Linus Torvalds Date: Sun Dec 1 18:40:28 2019 -0800 Merge tag 'hwlock-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc Pull hwspinlock updates from Bjorn Andersson: "This contains a number of cleanups to the core and several drivers, in particular removing the requirement for drivers to implement pm_runtime. It also udpates the location of the git tree in MAINTAINERS" * tag 'hwlock-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc: hwspinlock: u8500_hsem: Remove redundant PM runtime implementation hwspinlock: sprd: Remove redundant PM runtime implementation hwspinlock: Let the PM runtime can be optional hwspinlock: Remove BUG_ON() from the hwspinlock core hwspinlock: sprd: Use devm_hwspin_lock_register() to register hwlock controller hwspinlock: sprd: Use devm_add_action_or_reset() for calls to clk_disable_unprepare() hwspinlock: sprd: Check the return value of clk_prepare_enable() hwspinlock: sprd: Change to use devm_platform_ioremap_resource() hwspinlock: u8500_hsem: Use devm_hwspin_lock_register() to register hwlock controller hwspinlock: u8500_hsem: Use devm_kzalloc() to allocate memory hwspinlock: u8500_hsem: Change to use devm_platform_ioremap_resource() MAINTAINERS: hwspinlock: update git tree location commit 687fcad8a3ab95f228e62a58b03eb10af67146f4 Merge: 5e3b06d3bbdf 8cf9b615653e Author: Linus Torvalds Date: Sun Dec 1 18:39:24 2019 -0800 Merge tag 'rpmsg-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc Pull rpmsg updates from Bjorn Andersson: "This contains a number of bug fixes to the GLINK transport driver, an off-by-one in the GLINK smem driver and a memory leak fix in the rpmsg char driver" * tag 'rpmsg-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc: rpmsg: Fix Kconfig indentation rpmsg: char: Simplify 'rpmsg_eptdev_release()' rpmsg: glink: Free pending deferred work on remove rpmsg: glink: Don't send pending rx_done during remove rpmsg: glink: Fix rpmsg_register_device err handling rpmsg: glink: Put an extra reference during cleanup rpmsg: glink: Fix use after free in open_ack TIMEOUT case rpmsg: glink: Fix reuse intents memory leak issue rpmsg: glink: Set tail pointer to 0 at end of FIFO rpmsg: char: release allocated memory commit 5e3b06d3bbdfb875ec6ad5e5fa5d86b0e79ea065 Merge: 3265568db8c3 e3cb40d4d805 Author: Linus Torvalds Date: Sun Dec 1 18:35:47 2019 -0800 Merge tag 'rproc-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc Pull remoteproc updates from Bjorn Andersson: "This adds support for booting the modem processor on Qualcomm MSM8998 and carries some cleanup up and bug fixes to the framework and the stm32 driver" * tag 'rproc-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc: Revert "dt-bindings: remoteproc: stm32: add wakeup-source" remoteproc: stm32: fix probe error case remoteproc: stm32: wakeup the system by wdg irq dt-bindings: remoteproc: stm32: add wakeup-source remoteproc: Fix wrong rvring index computation remoteproc: stm32: use workqueue to treat mailbox callback remoteproc: fix argument 2 of rproc_mem_entry_init remoteproc: qcom_q6v5_mss: Add support for MSM8998 dt-bindings: remoteproc: qcom: Add Q6v5 Modem PIL binding for MSM8998 remoteproc: debug: Remove unneeded NULL check remoteproc: remove useless typedef commit 3265568db8c37d391ee8ad2afa8b0fd7257f4526 Merge: 31764f1b6d93 a72e27f7a470 Author: Linus Torvalds Date: Sun Dec 1 18:29:36 2019 -0800 Merge branch 'i2c/for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "I2C has mostly driver updates this time. The few noteworthy changes are: the core has now support for analog and digital filters with at91 being the first user, a core addition to replace the NULL returning i2c_new_probed_device() with an ERR_PTR variant, and the pxa driver has finally being moved to use the generic I2C slave interface. We have quite a significant number of reviews per patch this time, so thank you to all involved!" * 'i2c/for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (37 commits) video: fbdev: matrox: convert to i2c_new_scanned_device i2c: icy: convert to i2c_new_scanned_device i2c: replace i2c_new_probed_device with an ERR_PTR variant i2c: Fix Kconfig indentation i2c: smbus: Don't filter out duplicate alerts i2c: i801: Correct Intel Jasper Lake SOC naming i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop i2c: iproc: Add i2c repeated start capability i2c: remove helpers for ref-counting clients i2c: tegra: Use dma_request_chan() directly for channel request i2c: sh_mobile: Use dma_request_chan() directly for channel request i2c: qup: Use dma_request_chan() directly for channel request i2c: at91: Use dma_request_chan() directly for channel request i2c: rcar: Remove superfluous call to clk_get_rate() i2c: pxa: remove unused i2c-slave APIs i2c: pxa: migrate to new i2c_slave APIs i2c: cros-ec-tunnel: Make the device acpi compatible i2c: stm32f7: report dma error during probe i2c: icy: no need to populate address for scanned device i2c: xiic: Fix kerneldoc warnings ... commit 31764f1b6d93e126ed341fb600d2765d630e8bf6 Merge: 67b8ed29e0d4 aa4c3967756c Author: Linus Torvalds Date: Sun Dec 1 18:26:56 2019 -0800 Merge tag 'for-linus-20191129' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "I wasn't going to send this one off so soon, but unfortunately one of the fixes from the previous pull broke the build on some archs. So I'm sending this sooner rather than later. This contains: - Add highmem.h include for io_uring, because of the kmap() additions from last round. For some reason the build bot didn't spot this even though it sat for days. - Three minor ';' removals - Add support for the Beurer CD-on-a-chip device - Make io_uring work on MMU-less archs" * tag 'for-linus-20191129' of git://git.kernel.dk/linux-block: io_uring: fix missing kmap() declaration on powerpc ataflop: Remove unneeded semicolon block: sunvdc: Remove unneeded semicolon drbd: Remove unneeded semicolon io_uring: add mapping support for NOMMU archs sr_vendor: support Beurer GL50 evo CD-on-a-chip devices. cdrom: respect device capabilities during opening action commit 67b8ed29e0d472bda2f3afe48d6ff99e127eff0c Merge: d004701d1cc5 f3e4f3fc8ee9 Author: Linus Torvalds Date: Sun Dec 1 18:24:25 2019 -0800 Merge tag 'platform-drivers-x86-v5.5-1' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver updates from Andy Shevchenko: - New bootctl driver for Mellanox BlueField SoC. - New driver to support System76 laptops. - Temperature monitoring and fan control on Acer Aspire 7551 is now supported. - Previously the Huawei driver handled only hotkeys. After the conversion to WMI it has been expanded to support newer laptop models. - Big refactoring of intel-speed-select tools allows to use it on Intel CascadeLake-N systems. - Touchscreen support for ezpad 6 m4 and Schneider SCT101CTM tablets - Miscellaneous clean ups and fixes here and there. * tag 'platform-drivers-x86-v5.5-1' of git://git.infradead.org/linux-platform-drivers-x86: (59 commits) platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support to intel_pmc_core driver platform/x86: intel_pmc_core: Fix the SoC naming inconsistency platform/mellanox: Fix Kconfig indentation tools/power/x86/intel-speed-select: Display TRL buckets for just base config level tools/power/x86/intel-speed-select: Ignore missing config level platform/x86: touchscreen_dmi: Add info for the ezpad 6 m4 tablet tools/power/x86/intel-speed-select: Increment version tools/power/x86/intel-speed-select: Use core count for base-freq mask tools/power/x86/intel-speed-select: Support platform with limited Intel(R) Speed Select tools/power/x86/intel-speed-select: Use Frequency weight for CLOS tools/power/x86/intel-speed-select: Make CLOS frequency in MHz tools/power/x86/intel-speed-select: Use mailbox for CLOS_PM_QOS_CONFIG tools/power/x86/intel-speed-select: Auto mode for CLX tools/power/x86/intel-speed-select: Correct CLX-N frequency units tools/power/x86/intel-speed-select: Change display of "avx" to "avx2" tools/power/x86/intel-speed-select: Extend command set for perf-profile Add touchscreen platform data for the Schneider SCT101CTM tablet platform/x86: intel_int0002_vgpio: Pass irqchip when adding gpiochip ... commit d004701d1cc5a036b1f2dec34dd5973064c72eab Merge: 4a08fe579258 d8d0470875aa Author: Linus Torvalds Date: Sun Dec 1 18:20:54 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - Support for Logitech G15 (Hans de Goede) - HID parser improvements, improving support for some devices; e.g. Windows Precision Touchpad, products from Primax, etc. (Blaž Hrastnik, Candle Sun) - robustification of tablet mode support in google-whiskers driver (Dmitry Torokhov) - assorted small fixes, device-specific quirks and device ID additions * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (23 commits) HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device HID: quirks: remove hid-led devices from hid_have_special_driver HID: Improve Windows Precision Touchpad detection. HID: i2c-hid: Reset ALPS touchpads on resume HID: i2c-hid: fix no irq after reset on raydium 3118 HID: logitech-hidpp: Silence intermittent get_battery_capacity errors HID: i2c-hid: remove orphaned member sleep_delay HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse HID: core: check whether Usage Page item is after Usage ID items HID: intel-ish-hid: Spelling s/diconnect/disconnect/ HID: google: Detect base folded usage instead of hard-coding whiskers HID: logitech: Add depends on LEDS_CLASS to Logitech Kconfig entry HID: lg-g15: Add support for the G510's M1-M3 and MR LEDs HID: lg-g15: Add support for controlling the G510's RGB backlight HID: lg-g15: Add support for the G510 keyboards' gaming keys HID: lg-g15: Add support for the M1-M3 and MR LEDs HID: lg-g15: Add keyboard and LCD backlight control HID: Add driver for Logitech gaming keyboards (G15, G15 v2) Input: Add event-codes for macro keys found on various keyboards HID: hidraw: replace printk() with corresponding pr_xx() variant ... commit 4a08fe5792583d81bf237a75ebc803f756204e46 Merge: 99a0d9f5e873 33c26ab4d6be Author: Linus Torvalds Date: Sun Dec 1 18:01:03 2019 -0800 Merge tag 'linux-watchdog-5.5-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - support for NCT6116D - several small fixes and improvements * tag 'linux-watchdog-5.5-rc1' of git://www.linux-watchdog.org/linux-watchdog: (24 commits) watchdog: jz4740: Drop dependency on MACH_JZ47xx watchdog: jz4740: Use regmap provided by TCU driver watchdog: jz4740: Use WDT clock provided by TCU driver dt-bindings: watchdog: sama5d4_wdt: add microchip,sam9x60-wdt compatible watchdog: sama5d4_wdt: cleanup the bit definitions watchdog: sprd: Fix the incorrect pointer getting from driver data watchdog: aspeed: Fix clock behaviour for ast2600 watchdog: imx7ulp: Fix reboot hang watchdog: make nowayout sysfs file writable watchdog: prevent deferral of watchdogd wakeup on RT watchdog: imx7ulp: Use definitions instead of magic values watchdog: imx7ulp: Remove inline annotations watchdog: imx7ulp: Remove unused structure member watchdog: imx7ulp: Pass the wdog instance inimx7ulp_wdt_enable() watchdog: wdat_wdt: Spelling s/configrable/configurable/ watchdog: bd70528: Trivial function documentation fix watchdog: cadence: Do not show error in case of deferred probe watchdog: Fix the race between the release of watchdog_core_data and cdev watchdog: sbc7240_wdt: Fix yet another -Wimplicit-fallthrough warning watchdog: intel-mid_wdt: Add WATCHDOG_NOWAYOUT support ... commit 99a0d9f5e87352c4bd8d01bc9b39f7091c12e4d4 Merge: 37323918cac2 41c4616bb81f Author: Linus Torvalds Date: Sun Dec 1 17:56:50 2019 -0800 Merge tag 'gpio-v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO updates from Linus Walleij: "This is the bulk of GPIO changes for the v5.5 kernel cycle Core changes: - Expose pull up/down flags for the GPIO character device to userspace. After clear input from the RaspberryPi and Beagle communities, it has been established that prototyping, industrial automation and make communities strongly need this feature, and as we want people to use the character device, we have implemented the simple pull up/down interface for GPIO lines. This means we can specify that a (chip-specific) pull up/down resistor can be enabled, but does not offer fine-grained control such as cases where the resistance of the same pull resistor can be controlled (yet). - Introduce devm_fwnode_gpiod_get_index() and start to phase out the old symbol devm_fwnode_get_index_gpiod_from_child(). - A bit of documentation clean-up work. - Introduce a define for GPIO line directions and deploy it in all GPIO drivers in the drivers/gpio directory. - Add a special callback to populate pin ranges when cooperating with the pin control subsystem and registering ranges as part of adding a gpiolib driver and a gpio_irq_chip driver at the same time. This is also deployed in the Intel Merrifield driver. New drivers: - RDA Micro GPIO controller. - XGS-iproc GPIO driver. Driver improvements: - Wake event and debounce support on the Tegra 186 driver. - Finalize the Aspeed SGPIO driver. - MPC8xxx uses a normal IRQ handler rather than a chained handler" * tag 'gpio-v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (64 commits) gpio: Add TODO item for regmap helper Documentation: gpio: driver.rst: Fix warnings gpio: of: Fix bogus reference to gpiod_get_count() gpiolib: Grammar s/manager/managed/ gpio: lynxpoint: Setup correct IRQ handlers MAINTAINERS: Replace my email by one @kernel.org gpiolib: acpi: Make acpi_gpiochip_alloc_event always return AE_OK gpio/mpc8xxx: fix qoriq GPIO reading gpio: mpc8xxx: Don't overwrite default irq_set_type callback gpiolib: acpi: Print pin number on acpi_gpiochip_alloc_event errors gpiolib: fix coding style in gpiod_hog() drm/bridge: ti-tfp410: switch to using fwnode_gpiod_get_index() gpio: merrifield: Pass irqchip when adding gpiochip gpio: merrifield: Add GPIO <-> pin mapping ranges via callback gpiolib: Introduce ->add_pin_ranges() callback gpio: mmio: remove untrue leftover comment gpio: em: Use platform_get_irq() to obtain interrupts gpio: tegra186: Add debounce support gpio: tegra186: Program interrupt route mapping gpio: tegra186: Derive register offsets from bank/port ... commit 3e25dbca8b75d3cc7dbbfd7aaaa0d29c730d45ac Merge: 36a170b1ca0d 3cc44feb9861 Author: Dave Airlie Date: Mon Dec 2 10:23:06 2019 +1000 Merge tag 'drm-intel-next-fixes-2019-11-28' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Important fix to uAPI alignment on query IOCTL - Fixes for the power regression introduced by the previous security patches - Avoid regressing super heavy benchmarks by increasing the default request pre-emption timeout from 100 ms to 640 ms to - Resulting set of smaller fixes done while problem was inspected - Display fixes for EHL voltage level programming and TGL DKL PHY vswing for HDMI Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20191128141524.GA11992@jlahtine-desk.ger.corp.intel.com commit 36a170b1ca0da12641b1d847524f17b4aa2a2283 Merge: acc61b892936 e20c9284c8f2 Author: Dave Airlie Date: Mon Dec 2 10:14:35 2019 +1000 Merge tag 'drm-msm-next-2019-11-05' of https://gitlab.freedesktop.org/drm/msm into drm-next + OCMEM support to enable the couple generations that had shared OCMEM rather than GMEM exclusively for the GPU (late a3xx and I think basically all of a4xx). Bjorn and Brian decided to land this through the drm tree to avoid having to coordinate merge requests. + a510 support, and various associated display support + the usual misc cleanups and fixes Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/ Date: Sun Dec 1 16:16:31 2019 -0800 Merge tag 'mfd-next-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Core Frameworks: - Add support for a "resource managed strongly uncachable ioremap" call - Provide a collection of MFD helper macros - Remove mfd_clone_cell() from MFD core - Add NULL de-reference protection in MFD core - Remove superfluous function fd_platform_add_cell() from MFD core - Honour Device Tree's request to disable a device New Drivers: - Add support for MediaTek MT6323 PMIC New Device Support: - Add support for Gemini Lake to Intel LPSS PCI - Add support for Cherry Trail Crystal Cover PMIC to Intel SoC PMIC CRC - Add support for PM{I}8950 to Qualcomm SPMI PMIC - Add support for U8420 to ST-Ericsson DB8500 - Add support for Comet Lake PCH-H to Intel LPSS PCI New Functionality: - Add support for requested supply clocks; madera-core Fix-ups: - Lower interrupt priority; rk808 - Use provided helpers (macros, group functions, defines); rk808, ipaq-micro, ab8500-core, db8500-prcmu, mt6397-core, cs5535-mfd - Only allocate IRQs on request; max77620 - Use simplified API; arizona-core - Remove redundant and/or duplicated code; wm8998-tables, arizona, syscon - Device Tree binding fix-ups; madera, max77650, max77693 - Remove mfd_cell->id abuse hack; cs5535-mfd - Remove only user of mfd_clone_cell(); cs5535-mfd - Make resources static; rohm-bd70528 Bug Fixes: - Fix product ID for RK818; rk808 - Fix Power Key; rk808 - Fix booting on the BananaPi; mt6397-core - Endian fix-ups; twl.h - Fix static error checker warnings; ti_am335x_tscadc" * tag 'mfd-next-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits) Revert "mfd: syscon: Set name of regmap_config" mfd: ti_am335x_tscadc: Fix static checker warning mfd: bd70528: Staticize bit value definitions mfd: mfd-core: Honour Device Tree's request to disable a child-device dt-bindings: mfd: max77693: Fix missing curly brace mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs mfd: db8500-prcmu: Support U8420-sysclk firmware dt-bindings: mfd: max77650: Convert the binding document to yaml mfd: mfd-core: Move pdev->mfd_cell creation back into mfd_add_device() mfd: mfd-core: Remove usage counting for .{en,dis}able() call-backs x86: olpc-xo1-sci: Remove invocation of MFD's .enable()/.disable() call-backs x86: olpc-xo1-pm: Remove invocation of MFD's .enable()/.disable() call-backs mfd: mfd-core: Remove mfd_clone_cell() mfd: mfd-core: Protect against NULL call-back function pointer mfd: cs5535-mfd: Register clients using their own dedicated MFD cell entries mfd: cs5535-mfd: Request shared IO regions centrally mfd: cs5535-mfd: Remove mfd_cell->id hack mfd: cs5535-mfd: Use PLATFORM_DEVID_* defines and tidy error message mfd: intel_soc_pmic_crc: Add "cht_crystal_cove_pmic" cell to CHT cells mfd: madera: Add support for requesting the supply clocks ... commit 38edc3dff9d2805c48e0a171667e7ca820336ab7 Merge: 8b233da0cc82 102a1b382177 Author: Linus Torvalds Date: Sun Dec 1 16:13:39 2019 -0800 Merge tag 'backlight-next-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Functionality: - Add support for an enable GPIO; lm3630a_bl - Add support for short circuit handling; qcom-wled - Add support for automatic string detection; qcom-wled Fix-ups: - Update Device Tree bindings; lm3630a-backlight, led-backlight, qcom-wled - Constify; ipaq_micro_bl - Optimise for CPU cycles; pwm_bl - Coding style fix-ups; pwm_bl - Trivial fix-ups (white space, comments, renaming); pwm_bl, gpio_backlight, qcom-wled - Kconfig dependency hacking; LCD_HP700 - Rename, refactor and add peripherals; pm8941-wled => qcom-wled - Make use of GPIO look-up tables; tosa_bl, tosa_lcd - Remove superfluous code; gpio_backlight - Adapt GPIO direction handling; gpio_backlight - Remove legacy use of platform data; gpio_backlight Bug Fixes: - Provide modules aliases; lm3630a_bl" * tag 'backlight-next-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: (32 commits) backlight: qcom-wled: Fix spelling mistake "trigged" -> "triggered" backlight: gpio: Pull gpio_backlight_initial_power_state() into probe backlight: gpio: Use a helper variable for &pdev->dev backlight: gpio: Remove unused fields from platform data sh: ecovec24: don't set unused fields in platform data backlight: gpio: Simplify the platform data handling sh: ecovec24: add additional properties to the backlight device backlight: gpio: Explicitly set the direction of the GPIO backlight: gpio: Remove stray newline backlight: gpio: Remove unneeded include video: backlight: tosa: Use GPIO lookup table backlight: qcom-wled: Add auto string detection logic backlight: qcom-wled: Add support for short circuit handling backlight: qcom-wled: Add support for WLED4 peripheral backlight: qcom-wled: Restructure the driver for WLED3 backlight: qcom-wled: Rename PM8941* to WLED3 backlight: qcom-wled: Add new properties for PMI8998 backlight: qcom-wled: Restructure the qcom-wled bindings backlight: qcom-wled: Rename pm8941-wled.c to qcom-wled.c dt-bindings: backlight: lm3630a: Fix missing include ... commit 8b233da0cc825166b5fa06c898517a7477b54388 Merge: 304220b56e8c 6d29032c2cef Author: Linus Torvalds Date: Sun Dec 1 16:12:21 2019 -0800 Merge tag 'pinctrl-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pinctrl fix from Linus Walleij: "A oneliner fix adding the license to the new Intel pin controller, avoiding a build-time warning" * tag 'pinctrl-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: Fix warning by adding missing MODULE_LICENSE commit 304220b56e8c6a99b71832427802221be472247a Merge: ddebe839c601 5f820ed52371 Author: Linus Torvalds Date: Sun Dec 1 16:09:28 2019 -0800 Merge tag 'leds-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds Pull LED updates from Pavel Machek: "This contains usual small updates to drivers, and removal of PAGE_SIZE limits on /sys/class/leds//trigger. We should not be really having that many triggers; but with cpu activity triggers we do, and we'll eventually need to fix it, but... remove the limit for now" * tag 'leds-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds: (26 commits) leds: trigger: netdev: fix handling on interface rename leds: an30259a: add a check for devm_regmap_init_i2c leds: mlxreg: Fix possible buffer overflow leds: pca953x: Use of_device_get_match_data() leds: core: Fix leds.h structure documentation leds: core: Fix devm_classdev_match to reference correct structure leds: core: Remove extern from header leds: lm3601x: Convert class registration to device managed leds: flash: Add devm_* functions to the flash class leds: flash: Remove extern from the header file leds: flash: Convert non extended registration to inline leds: Kconfig: Be consistent with the usage of "LED" leds: remove PAGE_SIZE limit of /sys/class/leds//trigger leds: tlc591xx: update the maximum brightness leds: lm3692x: Use flags from LM3692X_BRT_CTRL leds: lm3692x: Use flags from LM3692X_BOOST_CTRL leds: lm3692x: Handle failure to probe the regulator leds: lm3692x: Don't overwrite return value in error path leds: lm3692x: Print error value on dev_err leds: tlc591xx: use devm_led_classdev_register_ext() ... commit ddebe839c6013ab42f376bdeaaaf66bd0c0d68d6 Merge: ceb307474506 ec16ffe36d80 Author: Linus Torvalds Date: Sun Dec 1 16:06:02 2019 -0800 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "This merge window we have one small clk provider API in the core framework and then a bunch of driver updates and a handful of new drivers. In terms of diffstat the Qualcomm and Amlogic drivers are high up there because of all the clk data introcued by new drivers. The Nvidia Tegra driver had a lot of work done this cycle too to support suspend/resume and memory controllers. And the OMAP clk driver got proper clk and reset handling in place. Rounding out the patches are various updates to remove unused data, mark things static, correct incorrect data in drivers, etc. All the little things that improve drivers and maintain code health. I will point out that there's a patch in here for the GPIO clk driver, that almost nobody uses, which changes behavior and causes clk_set_rate() to try to change the GPIO gate clk's parent. Other than that things are fairly well SoC specific here. Core: - Add a clk provider API to get current parent index - Plug a memory leak in clk_unregister() path New Drivers: - CGU in Ingenix X1000 - Bitmain BM1880 clks - Qualcomm MSM8998 GPU clk controllers - Qualcomm SC7180 GCC and RPMH clk controllers - Qualcomm QCS404 Q6SSTOP clk controllers - Add support for the Renesas R-Car M3-W+ (r8a77961) SoC - Add support for the Renesas RZ/G2N (r8a774b1) SoC - Add Tegra20/30 External Memory Clock (EMC) support Updates: - Make gpio gate clks propagate rate setting up to parent - Prepare Armada 3700 for suspend to RAM by moving PCIe suspend/resume priority - Drop unused variables, enums, etc. in various clk drivers - Convert various drivers to use devm_platform_ioremap_resource() - Use struct_size() some more in various clk drivers - Improve Rockchip px30 clk tree - Add suspend/resume support to Tegra210 clk driver - Reimplement SOR clks on earlier Tegra SoCs, helping HDMI and DP - Allwinner DT exports and H6 clk tree fixes - Proper clk and reset handling for OMAP SoCs - Revamped TI divider clk to clamp max divider - Make 1443X/1416X PLL clock structure common for reusing among i.MX8 SoCs - Drop IMX7ULP_CLK_MIPI_PLL clock, it shouldn't be used - Add VIDEO2_PLL clock for imx8mq - Add missing gate clock for pll1/2 fixed dividers on i.MX8 SoCs - Add sm1 support in the Amlogic audio clock controller - Switch some clocks on R-Car Gen2/3 to .determine_rate() - Remove Renesas R-Car Gen2 legacy DT clock support - Improve arithmetic divisions on Renesas R-Car Gen2 and Gen3 - Improve Renesas R-Car Gen3 SD clock handling - Add rate table for Samsung exynos542x GPU and VPLL clks - Fix potential CPU performance degradation after system suspend/resume cycle on exynos542x SoCs" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (160 commits) clk: aspeed: Add RMII RCLK gates for both AST2500 MACs MAINTAINERS: Add entry for BM1880 SoC clock driver clk: Add common clock driver for BM1880 SoC dt-bindings: clock: Add devicetree binding for BM1880 SoC clk: Add clk_hw_unregister_composite helper function definition clk: Zero init clk_init_data in helpers clk: ingenic: Allow drivers to be built with COMPILE_TEST MAINTAINERS: Update section for Ux500 clock drivers clk: mark clk_disable_unused() as __init clk: Fix memory leak in clk_unregister() clk: Ingenic: Add CGU driver for X1000. dt-bindings: clock: Add X1000 bindings. clk: tegra: Use match_string() helper to simplify the code clk: pxa: fix one of the pxa RTC clocks clk: sprd: Use IS_ERR() to validate the return value of syscon_regmap_lookup_by_phandle() clk: armada-xp: remove unused code clk: tegra: Fix build error without CONFIG_PM_SLEEP clk: tegra: Add missing stubs for the case of !CONFIG_PM_SLEEP clk: tegra: Optimize PLLX restore on Tegra20/30 clk: tegra: Add suspend and resume support on Tegra210 ... commit ceb307474506f888e8f16dab183405ff01dffa08 Merge: 0da522107e5d b111df8447ac Author: Linus Torvalds Date: Sun Dec 1 14:00:59 2019 -0800 Merge tag 'y2038-cleanups-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground Pull y2038 cleanups from Arnd Bergmann: "y2038 syscall implementation cleanups This is a series of cleanups for the y2038 work, mostly intended for namespace cleaning: the kernel defines the traditional time_t, timeval and timespec types that often lead to y2038-unsafe code. Even though the unsafe usage is mostly gone from the kernel, having the types and associated functions around means that we can still grow new users, and that we may be missing conversions to safe types that actually matter. There are still a number of driver specific patches needed to get the last users of these types removed, those have been submitted to the respective maintainers" Link: https://lore.kernel.org/lkml/20191108210236.1296047-1-arnd@arndb.de/ * tag 'y2038-cleanups-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground: (26 commits) y2038: alarm: fix half-second cut-off y2038: ipc: fix x32 ABI breakage y2038: fix typo in powerpc vdso "LOPART" y2038: allow disabling time32 system calls y2038: itimer: change implementation to timespec64 y2038: move itimer reset into itimer.c y2038: use compat_{get,set}_itimer on alpha y2038: itimer: compat handling to itimer.c y2038: time: avoid timespec usage in settimeofday() y2038: timerfd: Use timespec64 internally y2038: elfcore: Use __kernel_old_timeval for process times y2038: make ns_to_compat_timeval use __kernel_old_timeval y2038: socket: use __kernel_old_timespec instead of timespec y2038: socket: remove timespec reference in timestamping y2038: syscalls: change remaining timeval to __kernel_old_timeval y2038: rusage: use __kernel_old_timeval y2038: uapi: change __kernel_time_t to __kernel_old_time_t y2038: stat: avoid 'time_t' in 'struct stat' y2038: ipc: remove __kernel_time_t reference from headers y2038: vdso: powerpc: avoid timespec references ... commit 0da522107e5d9c000a4871d52e570912aa1225a2 Merge: ad0b314e0030 142b2ac82e31 Author: Linus Torvalds Date: Sun Dec 1 13:46:15 2019 -0800 Merge tag 'compat-ioctl-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground Pull removal of most of fs/compat_ioctl.c from Arnd Bergmann: "As part of the cleanup of some remaining y2038 issues, I came to fs/compat_ioctl.c, which still has a couple of commands that need support for time64_t. In completely unrelated work, I spent time on cleaning up parts of this file in the past, moving things out into drivers instead. After Al Viro reviewed an earlier version of this series and did a lot more of that cleanup, I decided to try to completely eliminate the rest of it and move it all into drivers. This series incorporates some of Al's work and many patches of my own, but in the end stops short of actually removing the last part, which is the scsi ioctl handlers. I have patches for those as well, but they need more testing or possibly a rewrite" * tag 'compat-ioctl-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground: (42 commits) scsi: sd: enable compat ioctls for sed-opal pktcdvd: add compat_ioctl handler compat_ioctl: move SG_GET_REQUEST_TABLE handling compat_ioctl: ppp: move simple commands into ppp_generic.c compat_ioctl: handle PPPIOCGIDLE for 64-bit time_t compat_ioctl: move PPPIOCSCOMPRESS to ppp_generic compat_ioctl: unify copy-in of ppp filters tty: handle compat PPP ioctls compat_ioctl: move SIOCOUTQ out of compat_ioctl.c compat_ioctl: handle SIOCOUTQNSD af_unix: add compat_ioctl support compat_ioctl: reimplement SG_IO handling compat_ioctl: move WDIOC handling into wdt drivers fs: compat_ioctl: move FITRIM emulation into file systems gfs2: add compat_ioctl support compat_ioctl: remove unused convert_in_user macro compat_ioctl: remove last RAID handling code compat_ioctl: remove /dev/raw ioctl translation compat_ioctl: remove PCI ioctl translation compat_ioctl: remove joystick ioctl translation ... commit ad0b314e003049292a23dd248d3c3ca4a3d75f55 Merge: b94ae8ad9fe7 61a47c1ad3a4 Author: Linus Torvalds Date: Sun Dec 1 13:26:18 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull sysctl system call removal from Eric Biederman: "As far as I can tell we have reached the point where no one enables the sysctl system call anymore. It still is enabled in a few defconfigs but they are mostly the rarely used one and in asking people about that it was more cut & paste enabled than anything else. This is single commit that just deletes code. Leaving just enough code so that the deprecated sysctl warning continues to be printed. If my analysis turns out to be wrong and someone actually cares it will be easy to revert this commit and have the system call again. There was one new xtensa defconfig in linux-next that enabled the system call this cycle and when asked about it the maintainer of the code replied that it was not enabled on purpose. As of today's linux-next tree that defconfig no longer enables the system call. What we saw in the review discussion was that if we go a step farther than my patch and mess with uapi headers there are pieces of code that won't compile, but nothing minds the system call actually disappearing from the kernel" Link: https://lore.kernel.org/lkml/201910011140.EA0181F13@keescook/ * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: sysctl: Remove the sysctl system call commit c5d728113532c695c894c2a88a10453ac83b0f3b Merge: f3284e014850 8a574f86652a Author: David S. Miller Date: Sun Dec 1 13:21:24 2019 -0800 Merge branch 'openvswitch-remove-a-couple-of-BUG_ON' Paolo Abeni says: ==================== openvswitch: remove a couple of BUG_ON() The openvswitch kernel datapath includes some BUG_ON() statements to check for exceptional/unexpected failures. These patches drop a couple of them, where we can do that without introducing other side effects. v1 -> v2: - avoid memory leaks on error path ==================== Signed-off-by: David S. Miller commit 8a574f86652a4540a2433946ba826ccb87f398cc Author: Paolo Abeni Date: Sun Dec 1 18:41:25 2019 +0100 openvswitch: remove another BUG_ON() If we can't build the flow del notification, we can simply delete the flow, no need to crash the kernel. Still keep a WARN_ON to preserve debuggability. Note: the BUG_ON() predates the Fixes tag, but this change can be applied only after the mentioned commit. v1 -> v2: - do not leak an skb on error Fixes: aed067783e50 ("openvswitch: Minimize ovs_flow_cmd_del critical section.") Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 8ffeb03fbba3b599690b361467bfd2373e8c450f Author: Paolo Abeni Date: Sun Dec 1 18:41:24 2019 +0100 openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() All the callers of ovs_flow_cmd_build_info() already deal with error return code correctly, so we can handle the error condition in a more gracefull way. Still dump a warning to preserve debuggability. v1 -> v2: - clarify the commit message - clean the skb and report the error (DaveM) Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit f3284e014850e45f63fbc74c7382453c876fbc35 Author: Heiner Kallweit Date: Sun Dec 1 10:51:47 2019 +0100 net: phy: realtek: fix using paged operations with RTL8105e / RTL8208 It was reported [0] that since the referenced commit a warning is triggered in phylib that complains about paged operations being used with a PHY driver that doesn't support this. The commit isn't wrong, just for one chip version (RTL8105e) no dedicated PHY driver exists yet. So add the missing PHY driver. [0] https://bugzilla.kernel.org/show_bug.cgi?id=202103 Fixes: 3a129e3f9ac4 ("r8169: switch to phylib functions in more places") Reported-by: jhdskag3 Tested-by: jhdskag3 Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 398fd408ccfb5e44b1cbe73a209d2281d3efa83c Author: Heiner Kallweit Date: Sun Dec 1 10:39:56 2019 +0100 r8169: fix resume on cable plug-in It was reported [0] that network doesn't wake up on cable plug-in with certain chip versions. Reason is that on these chip versions the PHY doesn't detect cable plug-in when being in power-down mode. So prevent the PHY from powering down if WoL is enabled. [0] https://bugzilla.kernel.org/show_bug.cgi?id=202103 Fixes: 95fb8bb3181b ("net: phy: force phy suspend when calling phy_stop") Reported-by: jhdskag3 Tested-by: jhdskag3 Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 14012c9f3bb922b9e0751ba43d15cc580a6049bf Author: Heiner Kallweit Date: Sun Dec 1 10:27:14 2019 +0100 r8169: fix jumbo configuration for RTL8168evl Alan reported [0] that network is broken since the referenced commit when using jumbo frames. This commit isn't wrong, it just revealed another issue that has been existing before. According to the vendor driver the RTL8168e-specific jumbo config doesn't apply for RTL8168evl. [0] https://lkml.org/lkml/2019/11/30/119 Fixes: 4ebcb113edcc ("r8169: fix jumbo packet handling on resume from suspend") Reported-by: Alan J. Wylie Tested-by: Alan J. Wylie Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 937790699be9c8100e5358625e7dfa8b32bd33f2 Author: Minchan Kim Date: Sat Nov 30 17:58:29 2019 -0800 mm/page_io.c: annotate refault stalls from swap_readpage If a block device supports rw_page operation, it doesn't submit bios so the annotation in submit_bio() for refault stall doesn't work. It happens with zram in android, especially swap read path which could consume CPU cycle for decompress. It is also a problem for zswap which uses frontswap. Annotate swap_readpage() to account the synchronous IO overhead to prevent underreport memory pressure. [akpm@linux-foundation.org: add comment, per Johannes] Link: http://lkml.kernel.org/r/20191010152134.38545-1-minchan@kernel.org Signed-off-by: Minchan Kim Acked-by: Johannes Weiner Reviewed-by: Shakeel Butt Cc: Seth Jennings Cc: Dan Streetman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dd33d29a19ad81205bfd1d011674b9ed28327e36 Author: Randy Dunlap Date: Sat Nov 30 17:58:26 2019 -0800 mm/Kconfig: fix trivial help text punctuation End a Kconfig help text sentence with a period (aka full stop). Link: http://lkml.kernel.org/r/c17f2c75-dc2a-42a4-2229-bb6b489addf2@infradead.org Signed-off-by: Randy Dunlap Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 19fa40a0f2f4666be975a2d3f9b1e64816d5b245 Author: Krzysztof Kozlowski Date: Sat Nov 30 17:58:23 2019 -0800 mm/Kconfig: fix indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ / /' -i */Kconfig Link: http://lkml.kernel.org/r/1574306437-28837-1-git-send-email-krzk@kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: David Hildenbrand Cc: Greg Kroah-Hartman Cc: Jiri Kosina Cc: Masahiro Yamada Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 12cc1c7345b6bf34c45ccaa75393e2d6eb707d7b Author: Souptick Joarder Date: Sat Nov 30 17:58:20 2019 -0800 mm/memory_hotplug.c: remove __online_page_set_limits() __online_page_set_limits() is a dummy function - remove it and all callers. Link: http://lkml.kernel.org/r/8e1bc9d3b492f6bde16e95ebc1dee11d6aefabd7.1567889743.git.jrdr.linux@gmail.com Link: http://lkml.kernel.org/r/854db2cf8145d9635249c95584d9a91fd774a229.1567889743.git.jrdr.linux@gmail.com Link: http://lkml.kernel.org/r/9afe6c5a18158f3884a6b302ac2c772f3da49ccc.1567889743.git.jrdr.linux@gmail.com Signed-off-by: Souptick Joarder Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Cc: Juergen Gross Cc: "Kirill A. Shutemov" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f4f5329d453704e2214011ecf00db73cd3196d06 Author: Wei Yang Date: Sat Nov 30 17:58:17 2019 -0800 mm: fix typos in comments when calling __SetPageUptodate() There are several places emphasise the effect of __SetPageUptodate(), while the comment seems to have a typo in two places. Link: http://lkml.kernel.org/r/20190926023705.7226-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 84218b552e0a591ac706a926d5e1e8eaf0d5a03a Author: Hao Lee Date: Sat Nov 30 17:58:14 2019 -0800 mm: fix struct member name in function comments The member in struct zonelist is _zonerefs instead of zones. Link: http://lkml.kernel.org/r/20190927144049.GA29622@haolee.github.io Signed-off-by: Hao Lee Reviewed-by: Andrew Morton Reviewed-by: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa71ecd8d86500da6081a72da6b0b524007e0627 Author: Chen Jun Date: Sat Nov 30 17:58:11 2019 -0800 mm/shmem.c: cast the type of unmap_start to u64 In 64bit system. sb->s_maxbytes of shmem filesystem is MAX_LFS_FILESIZE, which equal LLONG_MAX. If offset > LLONG_MAX - PAGE_SIZE, offset + len < LLONG_MAX in shmem_fallocate, which will pass the checking in vfs_fallocate. /* Check for wrap through zero too */ if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0)) return -EFBIG; loff_t unmap_start = round_up(offset, PAGE_SIZE) in shmem_fallocate causes a overflow. Syzkaller reports a overflow problem in mm/shmem: UBSAN: Undefined behaviour in mm/shmem.c:2014:10 signed integer overflow: '9223372036854775807 + 1' cannot be represented in type 'long long int' CPU: 0 PID:17076 Comm: syz-executor0 Not tainted 4.1.46+ #1 Hardware name: linux, dummy-virt (DT) Call trace: dump_backtrace+0x0/0x2c8 arch/arm64/kernel/traps.c:100 show_stack+0x20/0x30 arch/arm64/kernel/traps.c:238 __dump_stack lib/dump_stack.c:15 [inline] ubsan_epilogue+0x18/0x70 lib/ubsan.c:164 handle_overflow+0x158/0x1b0 lib/ubsan.c:195 shmem_fallocate+0x6d0/0x820 mm/shmem.c:2104 vfs_fallocate+0x238/0x428 fs/open.c:312 SYSC_fallocate fs/open.c:335 [inline] SyS_fallocate+0x54/0xc8 fs/open.c:239 The highest bit of unmap_start will be appended with sign bit 1 (overflow) when calculate shmem_falloc.start: shmem_falloc.start = unmap_start >> PAGE_SHIFT. Fix it by casting the type of unmap_start to u64, when right shifted. This bug is found in LTS Linux 4.1. It also seems to exist in mainline. Link: http://lkml.kernel.org/r/1573867464-5107-1-git-send-email-chenjun102@huawei.com Signed-off-by: Chen Jun Reviewed-by: Andrew Morton Cc: Hugh Dickins Cc: Qian Cai Cc: Kefeng Wang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4afab1cd256e425803374b58702ea86a05b0acf9 Author: Yang Shi Date: Sat Nov 30 17:58:07 2019 -0800 mm: shmem: use proper gfp flags for shmem_writepage() The shmem_writepage() uses GFP_ATOMIC to allocate swap cache. GFP_ATOMIC used to mean __GFP_HIGH, but now it means __GFP_HIGH | __GFP_ATOMIC | __GFP_KSWAPD_RECLAIM. However, shmem_writepage() should write out to swap only in response to memory pressure, so __GFP_KSWAPD_RECLAIM looks useless since the caller may be kswapd itself or in direct reclaim already. In addition, XArray node allocations from PF_MEMALLOC contexts could completely exhaust the page allocator, __GFP_NOMEMALLOC stops emergency reserves from being allocated. Here just copy the gfp flags used by add_to_swap(). Hugh: "a cleanup to make the two calls look the same when they don't need to be different (whereas the call from __read_swap_cache_async() rightly uses a lower priority gfp)". Link: http://lkml.kernel.org/r/1572991351-86061-1-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Acked-by: Hugh Dickins Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 26083eb6b15448e7ec5182e33f9b1ba7ebce3a62 Author: Colin Ian King Date: Sat Nov 30 17:58:04 2019 -0800 mm/shmem.c: make array 'values' static const, makes object smaller Don't populate the array 'values' on the stack but instead make it static const. Makes the object code smaller by 111 bytes. Before: text data bss dec hex filename 108612 11169 512 120293 1d5e5 mm/shmem.o After: text data bss dec hex filename 108437 11233 512 120182 1d576 mm/shmem.o (gcc version 9.2.1, amd64) Link: http://lkml.kernel.org/r/20190906143012.28698-1-colin.king@canonical.com Signed-off-by: Colin Ian King Reviewed-by: Andrew Morton Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3c1c24d91ffd536de0a64688a9df7f49e58fadbc Author: Mike Rapoport Date: Sat Nov 30 17:58:01 2019 -0800 userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK A while ago Andy noticed (http://lkml.kernel.org/r/CALCETrWY+5ynDct7eU_nDUqx=okQvjm=Y5wJvA4ahBja=CQXGw@mail.gmail.com) that UFFD_FEATURE_EVENT_FORK used by an unprivileged user may have security implications. As the first step of the solution the following patch limits the availably of UFFD_FEATURE_EVENT_FORK only for those having CAP_SYS_PTRACE. The usage of CAP_SYS_PTRACE ensures compatibility with CRIU. Yet, if there are other users of non-cooperative userfaultfd that run without CAP_SYS_PTRACE, they would be broken :( Current implementation of UFFD_FEATURE_EVENT_FORK modifies the file descriptor table from the read() implementation of uffd, which may have security implications for unprivileged use of the userfaultfd. Limit availability of UFFD_FEATURE_EVENT_FORK only for callers that have CAP_SYS_PTRACE. Link: http://lkml.kernel.org/r/1572967777-8812-2-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Reviewed-by: Andrea Arcangeli Cc: Daniel Colascione Cc: Jann Horn Cc: Lokesh Gidra Cc: Nick Kralevich Cc: Nosh Minwalla Cc: Pavel Emelyanov Cc: Tim Murray Cc: Aleksa Sarai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9d4678eb170c4c632174d1fec8ecee31c2f314f9 Author: Andrea Arcangeli Date: Sat Nov 30 17:57:58 2019 -0800 fs/userfaultfd.c: wp: clear VM_UFFD_MISSING or VM_UFFD_WP during userfaultfd_register() If the registration is repeated without VM_UFFD_MISSING or VM_UFFD_WP they need to be cleared. Currently setting UFFDIO_REGISTER_MODE_WP returns -EINVAL, so this patch is a noop until the UFFDIO_REGISTER_MODE_WP support is applied. Link: http://lkml.kernel.org/r/20191004232834.GP13922@redhat.com Signed-off-by: Andrea Arcangeli Reported-by: Wei Yang Reviewed-by: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 643aa36eadebdcdcaeecf538f0549a619ad78ea0 Author: Wei Yang Date: Sat Nov 30 17:57:55 2019 -0800 userfaultfd: wrap the common dst_vma check into an inlined function When doing UFFDIO_COPY, it is necessary to find the correct destination vma and make sure fault range is in it. Since there are two places need to do the same task, just wrap those common check into an inlined function. Link: http://lkml.kernel.org/r/20190927070032.2129-3-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Reviewed-by: Mike Kravetz Cc: Andrea Arcangeli Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 53eaa14b62d27f3011feb97e12a80bf61a4b29ab Author: Wei Yang Date: Sat Nov 30 17:57:52 2019 -0800 userfaultfd: remove unnecessary WARN_ON() in __mcopy_atomic_hugetlb() These warning here is to make sure address(dst_addr) and length(len - copied) are huge page size aligned. While this is ensured by: dst_start and len is huge page size aligned dst_addr equals to dst_start and increase huge page size each time copied increase huge page size each time This means these warnings will never be triggered. Link: http://lkml.kernel.org/r/20190927070032.2129-2-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Reviewed-by: Mike Kravetz Cc: Andrea Arcangeli Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4fb07ee6510280219403592e0a70c3b248b588c8 Author: Wei Yang Date: Sat Nov 30 17:57:49 2019 -0800 userfaultfd: use vma_pagesize for all huge page size calculation In __mcopy_atomic_hugetlb() we use two variables to deal with huge page size: vma_hpagesize and huge_page_size. Since they are the same, it is not necessary to use two different mechanism. This patch makes it consistent by all using vma_hpagesize. Link: http://lkml.kernel.org/r/20190927070032.2129-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Reviewed-by: Mike Kravetz Cc: Andrea Arcangeli Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df6c6500b4416baead2a1e17d9a80b675775c1df Author: Wei Yang Date: Sat Nov 30 17:57:46 2019 -0800 mm/madvise.c: use PAGE_ALIGN[ED] for range checking Improve readability, no functional change. Link: http://lkml.kernel.org/r/20191118032857.22683-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d3cd257ce15bad10a86f5064433c9dda4d019697 Author: Yunfeng Ye Date: Sat Nov 30 17:57:42 2019 -0800 mm/madvise.c: replace with page_size() in madvise_inject_error() page_size() is supported after the commit a50b854e073c ("mm: introduce page_size()"). Use page_size() in madvise_inject_error() for readability. [akpm@linux-foundation.org: use ulong for `size', per David] Link: http://lkml.kernel.org/r/29dce60c-38d6-0220-f292-e298f0c78c4d@huawei.com Signed-off-by: Yunfeng Ye Reviewed-by: Andrew Morton Acked-by: David Rientjes Cc: Jason Gunthorpe Cc: Michal Hocko Cc: Minchan Kim Cc: Peter Zijlstra Cc: Jan Kara Cc: Mike Rapoport Cc: Hu Shiyuan Cc: Feilong Lin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5d42ab293f5181609ea18f1f2ab85cd4cfc8efb2 Author: Wei Yang Date: Sat Nov 30 17:57:39 2019 -0800 mm/mmap.c: make vma_merge() comment more easy to understand Case 1/6, 2/7 and 3/8 have the same pattern and we handle them in the same logic. Rearrange the comment to make it a little easy for audience to understand. Link: http://lkml.kernel.org/r/20191030012445.16944-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Cc: Mike Rapoport Cc: Will Deacon Cc: Michal Hocko Cc: Catalin Marinas Cc: Andrea Arcangeli Cc: Jann Horn Cc: Darrick J. Wong Cc: Steve Capper Cc: Michel Lespinasse Cc: Dave Hansen Cc: Yangtao Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 35e3d566df5ff86d19488d2cd9b49b2d9389780e Author: zhong jiang Date: Sat Nov 30 17:57:35 2019 -0800 mm/hwpoison-inject: use DEFINE_DEBUGFS_ATTRIBUTE to define debugfs fops It is more clear to use DEFINE_DEBUGFS_ATTRIBUTE to define debugfs file operation rather than DEFINE_SIMPLE_ATTRIBUTE. Link: http://lkml.kernel.org/r/1572403660-44718-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a818f5363a0eba04bcff986c64c919d3f44b8017 Author: Huang Ying Date: Sat Nov 30 17:57:32 2019 -0800 autonuma: reduce cache footprint when scanning page tables In auto NUMA balancing page table scanning, if the pte_protnone() is true, the PTE needs not to be changed because it's in target state already. So other checking on corresponding struct page is unnecessary too. So, if we check pte_protnone() firstly for each PTE, we can avoid unnecessary struct page accessing, so that reduce the cache footprint of NUMA balancing page table scanning. In the performance test of pmbench memory accessing benchmark with 80:20 read/write ratio and normal access address distribution on a 2 socket Intel server with Optance DC Persistent Memory, perf profiling shows that the autonuma page table scanning time reduces from 1.23% to 0.97% (that is, reduced 21%) with the patch. Link: http://lkml.kernel.org/r/20191101075727.26683-3-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Mel Gorman Cc: Michal Hocko Cc: Rik van Riel Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Dave Hansen Cc: Dan Williams Cc: Fengguang Wu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bfe9d006c971a5daefe7a8b27819ccd497090fd8 Author: Huang Ying Date: Sat Nov 30 17:57:28 2019 -0800 autonuma: fix watermark checking in migrate_balanced_pgdat() When zone_watermark_ok() is called in migrate_balanced_pgdat() to check migration target node, the parameter classzone_idx (for requested zone) is specified as 0 (ZONE_DMA). But when allocating memory for autonuma in alloc_misplaced_dst_page(), the requested zone from GFP flags is ZONE_MOVABLE. That is, the requested zone is different. The size of lowmem_reserve for the different requested zone is different. And this may cause some issues. For example, in the zoneinfo of a test machine as below, Node 0, zone DMA32 pages free 61592 min 29 low 454 high 879 spanned 1044480 present 442306 managed 425921 protection: (0, 0, 62457, 62457, 62457) The free page number of ZONE_DMA32 is greater than "high watermark + lowmem_reserve[ZONE_DMA]", but less than "high watermark + lowmem_reserve[ZONE_MOVABLE]". And because __alloc_pages_node() in alloc_misplaced_dst_page() requests ZONE_MOVABLE, the zone_watermark_ok() on ZONE_DMA32 in migrate_balanced_pgdat() may always return true. So, autonuma may not stop even when memory pressure in node 0 is heavy. To fix the issue, ZONE_MOVABLE is used as parameter to call zone_watermark_ok() in migrate_balanced_pgdat(). This makes it same as requested zone in alloc_misplaced_dst_page(). So that migrate_balanced_pgdat() returns false when memory pressure is heavy. Link: http://lkml.kernel.org/r/20191101075727.26683-2-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Mel Gorman Cc: Michal Hocko Cc: Rik van Riel Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Dave Hansen Cc: Dan Williams Cc: Fengguang Wu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a9ea242a063c62be164338efcf9fefa3aeee7203 Author: zhong jiang Date: Sat Nov 30 17:57:25 2019 -0800 mm/cma_debug.c: use DEFINE_DEBUGFS_ATTRIBUTE to define debugfs fops It is more clear to use DEFINE_DEBUGFS_ATTRIBUTE to define debugfs file operation rather than DEFINE_SIMPLE_ATTRIBUTE. Link: http://lkml.kernel.org/r/1572348687-9951-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Reviewed-by: Andrew Morton Cc: Yue Hu Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2184f9928ab52f26c2ae5e9ba37faf29c78f50b8 Author: Yunfeng Ye Date: Sat Nov 30 17:57:22 2019 -0800 mm/cma.c: switch to bitmap_zalloc() for cma bitmap allocation kzalloc() is used for cma bitmap allocation in cma_activate_area(), switch to bitmap_zalloc() for clarity. Link: http://lkml.kernel.org/r/895d4627-f115-c77a-d454-c0a196116426@huawei.com Signed-off-by: Yunfeng Ye Reviewed-by: Andrew Morton Cc: Mike Rapoport Cc: Yue Hu Cc: Peng Fan Cc: Andrey Ryabinin Cc: Ryohei Suzuki Cc: Andrey Konovalov Cc: Doug Berger Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 75f360696ce9d8ec8b253452b23b3e24c0689b4b Author: Song Liu Date: Sat Nov 30 17:57:19 2019 -0800 mm/thp: flush file for !is_shmem PageDirty() case in collapse_file() For non-shmem file THPs, khugepaged only collapses read only .text mapping (VM_DENYWRITE). These pages should not be dirty except the case where the file hasn't been flushed since first write. Call filemap_flush() in collapse_file() to accelerate the write back in such cases. Link: http://lkml.kernel.org/r/20191106060930.2571389-3-songliubraving@fb.com Signed-off-by: Song Liu Cc: Kirill A. Shutemov Cc: Hugh Dickins Cc: William Kucharski Cc: Johannes Weiner Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f1fe80d4ae3396cf3665bd6dc77f4004c1c2e9f8 Author: Kirill A. Shutemov Date: Sat Nov 30 17:57:15 2019 -0800 mm, thp: do not queue fully unmapped pages for deferred split Adding fully unmapped pages into deferred split queue is not productive: these pages are about to be freed or they are pinned and cannot be split anyway. Link: http://lkml.kernel.org/r/20190913091849.11151-1-kirill.shutemov@linux.intel.com Signed-off-by: Kirill A. Shutemov Reviewed-by: Yang Shi Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 74d4a5797b89048a5b20746da7e80af1e73b8547 Author: Yang Shi Date: Sat Nov 30 17:57:12 2019 -0800 mm/migrate.c: handle freed page at the first place When doing migration if the freed page is met, we just return without migrating it since it is pointless to migrate a freed page. But, the current code allocates target page unconditionally before handling freed page, if the page is freed, the newly allocated will be just freed. It doesn't make too much sense and is just a waste of time although migrating freed page is rare. So, handle freed page at the before that to avoid unnecessary page allocation and free. Link: http://lkml.kernel.org/r/1573755869-106954-1-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Acked-by: Michal Hocko Reviewed-by: Andrew Morton Cc: Mel Gorman Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f1287869e52d00c3da6621c2b5f9b97a34865b05 Author: zhong jiang Date: Sat Nov 30 17:57:09 2019 -0800 mm/huge_memory.c: split_huge_pages_fops should be defined with DEFINE_DEBUGFS_ATTRIBUTE split_huge_pages_fops is used for debugfs file. hence, it is more clear to use DEFINE_DEBUGFS_ATTRIBUTE. Link: http://lkml.kernel.org/r/1572347674-8111-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Reviewed-by: Andrew Morton Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Vlastimil Babka Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit acbfb087e3b19959d6f4b779a9a15bff644b8c9a Author: Zhigang Lu Date: Sat Nov 30 17:57:06 2019 -0800 mm/hugetlb: avoid looping to the same hugepage if !pages and !vmas When mmapping an existing hugetlbfs file with MAP_POPULATE, we find it is very time consuming. For example, mmapping a 128GB file takes about 50 milliseconds. Sampling with perfevent shows it spends 99% time in the same_page loop in follow_hugetlb_page(). samples: 205 of event 'cycles', Event count (approx.): 136686374 - 99.04% test_mmap_huget [kernel.kallsyms] [k] follow_hugetlb_page follow_hugetlb_page __get_user_pages __mlock_vma_pages_range __mm_populate vm_mmap_pgoff sys_mmap_pgoff sys_mmap system_call_fastpath __mmap64 follow_hugetlb_page() is called with pages=NULL and vmas=NULL, so for each hugepage, we run into the same_page loop for pages_per_huge_page() times, but doing nothing. With this change, it takes less then 1 millisecond to mmap a 128GB file in hugetlbfs. Link: http://lkml.kernel.org/r/1567581712-5992-1-git-send-email-totty.lu@gmail.com Signed-off-by: Zhigang Lu Reviewed-by: Haozhong Zhang Reviewed-by: Zongming Zhang Reviewed-by: Mike Kravetz Acked-by: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 188b04a7d93860fd100b2671600b8ad81fb0a842 Author: Wei Yang Date: Sat Nov 30 17:57:02 2019 -0800 hugetlb: remove unused hstate in hugetlb_fault_mutex_hash() The first parameter hstate in function hugetlb_fault_mutex_hash() is not used anymore. This patch removes it. [akpm@linux-foundation.org: various build fixes] [cai@lca.pw: fix a GCC compilation warning] Link: http://lkml.kernel.org/r/1570544108-32331-1-git-send-email-cai@lca.pw Link: http://lkml.kernel.org/r/20191005003302.785-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Signed-off-by: Qian Cai Suggested-by: Andrew Morton Reviewed-by: Andrew Morton Cc: Mike Kravetz Cc: Hugh Dickins Cc: Andrea Arcangeli Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d75c6af9c89ac1fe8b74a5c094ce412ae992efc9 Author: Mina Almasry Date: Sat Nov 30 17:56:59 2019 -0800 hugetlb: remove duplicated code Remove duplicated code between region_chg and region_add, and refactor it into a common function, add_reservation_in_range. This is mostly done because there is a follow up change in another series that disables region coalescing in region_add, and I want to make that change in one place only. It should improve maintainability anyway on its own. [akpm@linux-foundation.org: coding style fixes] Link: http://lkml.kernel.org/r/20190919200428.188797-3-almasrymina@google.com Signed-off-by: Mina Almasry Reviewed-by: Mike Kravetz Cc: David Rientjes Cc: Shakeel Butt Cc: Greg Thelen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5c9119542035dbbc61241ab8dc7feeac11fa82ca Author: Mina Almasry Date: Sat Nov 30 17:56:54 2019 -0800 hugetlb: region_chg provides only cache entry Current behavior is that region_chg provides both a cache entry in resv->region_cache, AND a placeholder entry in resv->regions. region_add first tries to use the placeholder, and if it finds that the placeholder has been deleted by a racing region_del call, it uses the cache entry. This behavior is completely unnecessary and is removed in this patch for a couple of reasons: 1. region_add needs to either find a cached file_region entry in resv->region_cache, or find an entry in resv->regions to expand. It does not need both. 2. region_chg adding a placeholder entry in resv->regions opens up a possible race with region_del, where region_chg adds a placeholder region in resv->regions, and this region is deleted by a racing call to region_del during region_chg execution or before region_add is called. Removing the race makes the code easier to reason about and maintain. In addition, a follow up patch in another series that disables region coalescing, which would be further complicated if the race with region_del exists. Link: http://lkml.kernel.org/r/20190919200428.188797-2-almasrymina@google.com Signed-off-by: Mina Almasry Reviewed-by: Mike Kravetz Cc: David Rientjes Cc: Shakeel Butt Cc: Greg Thelen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 930668c34408ba983049322e04f13f03b6f1fafa Author: Waiman Long Date: Sat Nov 30 17:56:49 2019 -0800 hugetlbfs: take read_lock on i_mmap for PMD sharing A customer with large SMP systems (up to 16 sockets) with application that uses large amount of static hugepages (~500-1500GB) are experiencing random multisecond delays. These delays were caused by the long time it took to scan the VMA interval tree with mmap_sem held. The sharing of huge PMD does not require changes to the i_mmap at all. Therefore, we can just take the read lock and let other threads searching for the right VMA share it in parallel. Once the right VMA is found, either the PMD lock (2M huge page for x86-64) or the mm->page_table_lock will be acquired to perform the actual PMD sharing. Lock contention, if present, will happen in the spinlock. That is much better than contention in the rwsem where the time needed to scan the the interval tree is indeterminate. With this patch applied, the customer is seeing significant performance improvement over the unpatched kernel. Link: http://lkml.kernel.org/r/20191107211809.9539-1-longman@redhat.com Signed-off-by: Waiman Long Suggested-by: Mike Kravetz Reviewed-by: Mike Kravetz Cc: Davidlohr Bueso Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Will Deacon Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1ab5b82f540b31852fbf4a3c975f3c16e0e76b9f Author: Piotr Sarna Date: Sat Nov 30 17:56:43 2019 -0800 hugetlbfs: add O_TMPFILE support With hugetlbfs, a common pattern for mapping anonymous huge pages is to create a temporary file first. Currently libraries like libhugetlbfs and seastar create these with a standard mkstemp+unlink trick, but it would be more robust to be able to simply pass the O_TMPFILE flag to open(). O_TMPFILE is already supported by several file systems like ext4 and xfs. The implementation simply uses the existi= ng d_tmpfile utility function to instantiate the dcache entry for the file. Tested manually by successfully creating a temporary file by opening it with (O_TMPFILE|O_RDWR) on mounted hugetlbfs and successfully mapping 2M huge pages with it. Without the patch, trying to open a file with O_TMPFILE results in -ENOSUP. Link: http://lkml.kernel.org/r/bc9383eff6e1374d79f3a92257ae829ba1e6ae60.1573285189.git.p.sarna@tlen.pl Signed-off-by: Piotr Sarna Reviewed-by: Mike Kravetz Cc: Al Viro Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1f9dccb25b8fb48778149a002bb25d4ac2899633 Author: Mike Kravetz Date: Sat Nov 30 17:56:40 2019 -0800 hugetlbfs: convert macros to static inline, fix sparse warning huge_pte_offset() produced a sparse warning due to an improper return type when the kernel was built with !CONFIG_HUGETLB_PAGE. Fix the bad type and also convert all the macros in this block to static inline wrappers. Two existing wrappers in this block had lines in excess of 80 columns so clean those up as well. No functional change. Link: http://lkml.kernel.org/r/20191112194558.139389-3-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reported-by: Ben Dooks Suggested-by: Jason Gunthorpe Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 997cdcb068eb58d37f9f9b1d219368000066d272 Author: Mike Kravetz Date: Sat Nov 30 17:56:37 2019 -0800 powerpc/mm: remove pmd_huge/pud_huge stubs and include hugetlb.h Patch series "hugetlbfs: convert macros to static inline, fix sparse warning". The definition for huge_pte_offset() in causes a sparse warning in the !CONFIG_HUGETLB_PAGE. Fix this as well as converting all macros in this block of definitions to static inlines for better type checking. When making the above changes, build errors were found in powerpc due to duplicate definitions. A separate powerpc specific patch is included as a requisite to remove the definitions and get them from . This patch (of 2): This removes the power specific stubs created by commit aad71e3928be ("powerpc/mm: Fix build break with RADIX=y & HUGETLBFS=n") used when !CONFIG_HUGETLB_PAGE. Instead, it addresses the build break by getting the definitions from . This allows the macros in to be replaced with static inlines. Link: http://lkml.kernel.org/r/20191112194558.139389-2-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Acked-by: Michael Ellerman Cc: Ben Dooks Cc: Jason Gunthorpe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8fc312b32b25c6b0a8b46fab4df8c68df5af1223 Author: Mike Kravetz Date: Sat Nov 30 17:56:34 2019 -0800 mm/hugetlbfs: fix error handling when setting up mounts It is assumed that the hugetlbfs_vfsmount[] array will contain either a valid vfsmount pointer or NULL for each hstate after initialization. Changes made while converting to use fs_context broke this assumption. While fixing the hugetlbfs_vfsmount issue, it was discovered that init_hugetlbfs_fs never did correctly clean up when encountering a vfs mount error. It was found during code inspection. A small memory allocation failure would be the most likely cause of taking a error path with the bug. This is unlikely to happen as this is early init code. Link: http://lkml.kernel.org/r/94b6244d-2c24-e269-b12c-e3ba694b242d@oracle.com Reported-by: Chengguang Xu Fixes: 32021982a324 ("hugetlbfs: Convert to fs_context") Signed-off-by: Mike Kravetz Cc: David Howells Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 552546366a30d88bd1d6f5efe848b2ab50fd57e5 Author: Mike Kravetz Date: Sat Nov 30 17:56:30 2019 -0800 hugetlbfs: hugetlb_fault_mutex_hash() cleanup A new clang diagnostic (-Wsizeof-array-div) warns about the calculation to determine the number of u32's in an array of unsigned longs. Suppress warning by adding parentheses. While looking at the above issue, noticed that the 'address' parameter to hugetlb_fault_mutex_hash is no longer used. So, remove it from the definition and all callers. No functional change. Link: http://lkml.kernel.org/r/20190919011847.18400-1-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reported-by: Nathan Chancellor Reviewed-by: Nathan Chancellor Reviewed-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Nick Desaulniers Cc: Ilie Halip Cc: David Bolvansky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0ac398b171aacd0f0c132d989ec4efb5de94f34a Author: Yunfeng Ye Date: Sat Nov 30 17:56:27 2019 -0800 mm: support memblock alloc on the exact node for sparse_buffer_init() sparse_buffer_init() use memblock_alloc_try_nid_raw() to allocate memory for page management structure, if memory allocation fails from specified node, it will fall back to allocate from other nodes. Normally, the page management structure will not exceed 2% of the total memory, but a large continuous block of allocation is needed. In most cases, memory allocation from the specified node will succeed, but a node memory become highly fragmented will fail. we expect to allocate memory base section rather than by allocating a large block of memory from other NUMA nodes Add memblock_alloc_exact_nid_raw() for this situation, which allocate boot memory block on the exact node. If a large contiguous block memory allocate fail in sparse_buffer_init(), it will fall back to allocate small block memory base section. Link: http://lkml.kernel.org/r/66755ea7-ab10-8882-36fd-3e02b03775d5@huawei.com Signed-off-by: Yunfeng Ye Reviewed-by: Mike Rapoport Cc: Wei Yang Cc: Oscar Salvador Cc: Dan Williams Cc: David Hildenbrand Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 95830666be2aef81a2963135822ab92f4902a06b Author: Cao jin Date: Sat Nov 30 17:56:24 2019 -0800 mm/memblock: correct doc for function Change "max_addr" to "end" for less confusion in memblock_alloc_range_nid comments. Link: http://lkml.kernel.org/r/20191113051822.3296-1-ruansy.fnst@cn.fujitsu.com Signed-off-by: Cao jin Signed-off-by: Shiyang Ruan Reviewed-by: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6e5af9a8e8b0d29e881caf5b440a9c284698c154 Author: Cao jin Date: Sat Nov 30 17:56:21 2019 -0800 mm/memblock.c: cleanup doc fix typos for: elaboarte -> elaborate architecure -> architecture compltes -> completes And, convert the markup :c:func:`foo` to foo() as kernel documentation toolchain can recognize foo() as a function. Link: http://lkml.kernel.org/r/20190912123127.8694-1-caoj.fnst@cn.fujitsu.com Signed-off-by: Cao jin Suggested-by: Mike Rapoport Reviewed-by: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f18da660c095e3fff1690ea3d752f7b7188b35fb Author: Li Xinhai Date: Sat Nov 30 17:56:18 2019 -0800 mm/mempolicy.c: fix checking unmapped holes for mbind mbind() is required to report EFAULT if range, specified by addr and len, contains unmapped holes. In current implementation, below rules are applied for this checking: 1: Unmapped holes at any part of the specified range should be reported as EFAULT if mbind() for none MPOL_DEFAULT cases; 2: Unmapped holes at any part of the specified range should be ignored (do not reprot EFAULT) if mbind() for MPOL_DEFAULT case; 3: The whole range in an unmapped hole should be reported as EFAULT; Note that rule 2 does not fullfill the mbind() API definition, but since that behavior has existed for long days (the internal flag MPOL_MF_DISCONTIG_OK is for this purpose), this patch does not plan to change it. In current code, application observed inconsistent behavior on rule 1 and rule 2 respectively. That inconsistency is fixed as below details. Cases of rule 1: - Hole at head side of range. Current code reprot EFAULT, no change by this patch. [ vma ][ hole ][ vma ] [ range ] - Hole at middle of range. Current code report EFAULT, no change by this patch. [ vma ][ hole ][ vma ] [ range ] - Hole at tail side of range. Current code do not report EFAULT, this patch fixes it. [ vma ][ hole ][ vma ] [ range ] Cases of rule 2: - Hole at head side of range. Current code reports EFAULT, this patch fixes it. [ vma ][ hole ][ vma ] [ range ] - Hole at middle of range. Current code does not report EFAULT, no change by this patch. [ vma ][ hole ][ vma] [ range ] - Hole at tail side of range. Current code does not report EFAULT, no change by this patch. [ vma ][ hole ][ vma] [ range ] This patch has no changes to rule 3. The unmapped hole checking can also be handled by using .pte_hole(), instead of .test_walk(). But .pte_hole() is called for holes inside and outside vma, which causes more cost, so this patch keeps the original design with .test_walk(). Link: http://lkml.kernel.org/r/1573218104-11021-3-git-send-email-lixinhai.lxh@gmail.com Fixes: 6f4576e3687b ("mempolicy: apply page table walker on queue_pages_range()") Signed-off-by: Li Xinhai Reviewed-by: Naoya Horiguchi Cc: Michal Hocko Cc: Vlastimil Babka Cc: Hugh Dickins Cc: linux-man Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a18b3ac25bb7be4781cb9e6d31f3e57b3ba01b06 Author: Li Xinhai Date: Sat Nov 30 17:56:15 2019 -0800 mm/mempolicy.c: check range first in queue_pages_test_walk Patch series "mm: Fix checking unmapped holes for mbind", v4. This patchset fix checking unmapped holes for mbind(). First patch makes sure the vma been correctly tracked in .test_walk(), so each time when .test_walk() is called, the neighborhood of two vma is correct. Current problem is that the !vma_migratable() check could cause return immediately without update tracking to vma. Second patch fix the inconsistent report of EFAULT when mbind() is called for MPOL_DEFAULT and non MPOL_DEFAULT cases, so application do not need to have workaround code to handle this special behavior. Currently there are two problems, one is that the .test_walk() can not know there is hole at tail side of range, because .test_walk() only call for vma not for hole. The other one is that mbind_range() checks for hole at head side of range but do not consider the MPOL_MF_DISCONTIG_OK flag as done in .test_walk(). This patch (of 2): Checking unmapped hole and updating the previous vma must be handled first, otherwise the unmapped hole could be calculated from a wrong previous vma. Several commits were relevant to this error: - commit 6f4576e3687b ("mempolicy: apply page table walker on queue_pages_range()") This commit was correct, the VM_PFNMAP check was after updating previous vma - commit 48684a65b4e3 ("mm: pagewalk: fix misbehavior of walk_page_range for vma(VM_PFNMAP)") This commit added VM_PFNMAP check before updating previous vma. Then, there were two VM_PFNMAP check did same thing twice. - commit acda0c334028 ("mm/mempolicy.c: get rid of duplicated check for vma(VM_PFNMAP) in queue_page s_range()") This commit tried to fix the duplicated VM_PFNMAP check, but it wrongly removed the one which was after updating vma. Link: http://lkml.kernel.org/r/1573218104-11021-2-git-send-email-lixinhai.lxh@gmail.com Fixes: acda0c334028 (mm/mempolicy.c: get rid of duplicated check for vma(VM_PFNMAP) in queue_pages_range()) Signed-off-by: Li Xinhai Reviewed-by: Naoya Horiguchi Cc: Michal Hocko Cc: Vlastimil Babka Cc: Hugh Dickins Cc: linux-man Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4a3ac9311dac3850d1fbaa8bcad4cf10c4fc6296 Author: Vitaly Wool Date: Sat Nov 30 17:56:11 2019 -0800 mm/z3fold.c: add inter-page compaction For each page scheduled for compaction (e. g. by z3fold_free()), try to apply inter-page compaction before running the traditional/ existing intra-page compaction. That means, if the page has only one buddy, we treat that buddy as a new object that we aim to place into an existing z3fold page. If such a page is found, that object is transferred and the old page is freed completely. The transferred object is named "foreign" and treated slightly differently thereafter. Namely, we increase "foreign handle" counter for the new page. Pages with non-zero "foreign handle" count become unmovable. This patch implements "foreign handle" detection when a handle is freed to decrement the foreign handle counter accordingly, so a page may as well become movable again as the time goes by. As a result, we almost always have exactly 3 objects per page and significantly better average compression ratio. [cai@lca.pw: fix -Wunused-but-set-variable warnings] Link: http://lkml.kernel.org/r/1570542062-29144-1-git-send-email-cai@lca.pw [vitalywool@gmail.com: avoid subtle race when freeing slots] Link: http://lkml.kernel.org/r/20191127152118.6314b99074b0626d4c5a8835@gmail.com [vitalywool@gmail.com: compact objects more accurately] Link: http://lkml.kernel.org/r/20191127152216.6ad33745a21ba71c53606acb@gmail.com [vitalywool@gmail.com: protect handle reads] Link: http://lkml.kernel.org/r/20191127152345.8059852f60947686674d726d@gmail.com Link: http://lkml.kernel.org/r/20191006041457.24113-1-vitalywool@gmail.com Signed-off-by: Vitaly Wool Cc: Dan Streetman Cc: Henry Burns Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 204cb79ad42f015312a5bbd7012d09c93d9b46fb Author: Johannes Weiner Date: Sat Nov 30 17:56:08 2019 -0800 kernel: sysctl: make drop_caches write-only Currently, the drop_caches proc file and sysctl read back the last value written, suggesting this is somehow a stateful setting instead of a one-time command. Make it write-only, like e.g. compact_memory. While mitigating a VM problem at scale in our fleet, there was confusion about whether writing to this file will permanently switch the kernel into a non-caching mode. This influences the decision making in a tense situation, where tens of people are trying to fix tens of thousands of affected machines: Do we need a rollback strategy? What are the performance implications of operating in a non-caching state for several days? It also caused confusion when the kernel team said we may need to write the file several times to make sure it's effective ("But it already reads back 3?"). Link: http://lkml.kernel.org/r/20191031221602.9375-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Chris Down Acked-by: Vlastimil Babka Acked-by: David Hildenbrand Acked-by: Michal Hocko Acked-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 178821b8979c48f20e4b0f7a36b8eaf1809f8038 Author: Xianting Tian Date: Sat Nov 30 17:56:05 2019 -0800 mm/vmscan.c: fix typo in comment Fix the typo "resheduled" -> "rescheduled" in comment Link: http://lkml.kernel.org/r/1573486327-9591-1-git-send-email-xianting_tian@126.com Signed-off-by: Xianting Tian Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b91ac374346ba206cfd568bb0ab830af6b205cfd Author: Johannes Weiner Date: Sat Nov 30 17:56:02 2019 -0800 mm: vmscan: enforce inactive:active ratio at the reclaim root We split the LRU lists into inactive and an active parts to maximize workingset protection while allowing just enough inactive cache space to faciltate readahead and writeback for one-off file accesses (e.g. a linear scan through a file, or logging); or just enough inactive anon to maintain recent reference information when reclaim needs to swap. With cgroups and their nested LRU lists, we currently don't do this correctly. While recursive cgroup reclaim establishes a relative LRU order among the pages of all involved cgroups, inactive:active size decisions are done on a per-cgroup level. As a result, we'll reclaim a cgroup's workingset when it doesn't have cold pages, even when one of its siblings has plenty of it that should be reclaimed first. For example: workload A has 50M worth of hot cache but doesn't do any one-off file accesses; meanwhile, parallel workload B scans files and rarely accesses the same page twice. If these workloads were to run in an uncgrouped system, A would be protected from the high rate of cache faults from B. But if they were put in parallel cgroups for memory accounting purposes, B's fast cache fault rate would push out the hot cache pages of A. This is unexpected and undesirable - the "scan resistance" of the page cache is broken. This patch moves inactive:active size balancing decisions to the root of reclaim - the same level where the LRU order is established. It does this by looking at the recursive size of the inactive and the active file sets of the cgroup subtree at the beginning of the reclaim cycle, and then making a decision - scan or skip active pages - that applies throughout the entire run and to every cgroup involved. With that in place, in the test above, the VM will recognize that there are plenty of inactive pages in the combined cache set of workloads A and B and prefer the one-off cache in B over the hot pages in A. The scan resistance of the cache is restored. [cai@lca.pw: fix some -Wenum-conversion warnings] Link: http://lkml.kernel.org/r/1573848697-29262-1-git-send-email-cai@lca.pw Link: http://lkml.kernel.org/r/20191107205334.158354-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Suren Baghdasaryan Reviewed-by: Shakeel Butt Cc: Andrey Ryabinin Cc: Rik van Riel Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b910718a948a9120d90faf632b33ed23c70e266a Author: Johannes Weiner Date: Sat Nov 30 17:55:59 2019 -0800 mm: vmscan: detect file thrashing at the reclaim root We use refault information to determine whether the cache workingset is stable or transitioning, and dynamically adjust the inactive:active file LRU ratio so as to maximize protection from one-off cache during stable periods, and minimize IO during transitions. With cgroups and their nested LRU lists, we currently don't do this correctly. While recursive cgroup reclaim establishes a relative LRU order among the pages of all involved cgroups, refaults only affect the local LRU order in the cgroup in which they are occuring. As a result, cache transitions can take longer in a cgrouped system as the active pages of sibling cgroups aren't challenged when they should be. [ Right now, this is somewhat theoretical, because the siblings, under continued regular reclaim pressure, should eventually run out of inactive pages - and since inactive:active *size* balancing is also done on a cgroup-local level, we will challenge the active pages eventually in most cases. But the next patch will move that relative size enforcement to the reclaim root as well, and then this patch here will be necessary to propagate refault pressure to siblings. ] This patch moves refault detection to the root of reclaim. Instead of remembering the cgroup owner of an evicted page, remember the cgroup that caused the reclaim to happen. When refaults later occur, they'll correctly influence the cross-cgroup LRU order that reclaim follows. I.e. if global reclaim kicked out pages in some subgroup A/B/C, the refault of those pages will challenge the global LRU order, and not just the local order down inside C. [hannes@cmpxchg.org: use page_memcg() instead of another lookup] Link: http://lkml.kernel.org/r/20191115160722.GA309754@cmpxchg.org Link: http://lkml.kernel.org/r/20191107205334.158354-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Suren Baghdasaryan Cc: Andrey Ryabinin Cc: Michal Hocko Cc: Rik van Riel Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 53138cea7f398d2cdd0fa22adeec7e16093e1ebd Author: Johannes Weiner Date: Sat Nov 30 17:55:56 2019 -0800 mm: vmscan: move file exhaustion detection to the node level Patch series "mm: fix page aging across multiple cgroups". When applications are put into unconfigured cgroups for memory accounting purposes, the cgrouping itself should not change the behavior of the page reclaim code. We expect the VM to reclaim the coldest pages in the system. But right now the VM can reclaim hot pages in one cgroup while there is eligible cold cache in others. This is because one part of the reclaim algorithm isn't truly cgroup hierarchy aware: the inactive/active list balancing. That is the part that is supposed to protect hot cache data from one-off streaming IO. The recursive cgroup reclaim scheme will scan and rotate the physical LRU lists of each eligible cgroup at the same rate in a round-robin fashion, thereby establishing a relative order among the pages of all those cgroups. However, the inactive/active balancing decisions are made locally within each cgroup, so when a cgroup is running low on cold pages, its hot pages will get reclaimed - even when sibling cgroups have plenty of cold cache eligible in the same reclaim run. For example: [root@ham ~]# head -n1 /proc/meminfo MemTotal: 1016336 kB [root@ham ~]# ./reclaimtest2.sh Establishing 50M active files in cgroup A... Hot pages cached: 12800/12800 workingset-a Linearly scanning through 18G of file data in cgroup B: real 0m4.269s user 0m0.051s sys 0m4.182s Hot pages cached: 134/12800 workingset-a The streaming IO in B, which doesn't benefit from caching at all, pushes out most of the workingset in A. Solution This series fixes the problem by elevating inactive/active balancing decisions to the toplevel of the reclaim run. This is either a cgroup that hit its limit, or straight-up global reclaim if there is physical memory pressure. From there, it takes a recursive view of the cgroup subtree to decide whether page deactivation is necessary. In the test above, the VM will then recognize that cgroup B has plenty of eligible cold cache, and that the hot pages in A can be spared: [root@ham ~]# ./reclaimtest2.sh Establishing 50M active files in cgroup A... Hot pages cached: 12800/12800 workingset-a Linearly scanning through 18G of file data in cgroup B: real 0m4.244s user 0m0.064s sys 0m4.177s Hot pages cached: 12800/12800 workingset-a Implementation Whether active pages can be deactivated or not is influenced by two factors: the inactive list dropping below a minimum size relative to the active list, and the occurence of refaults. This patch series first moves refault detection to the reclaim root, then enforces the minimum inactive size based on a recursive view of the cgroup tree's LRUs. History Note that this actually never worked correctly in Linux cgroups. In the past it worked for global reclaim and leaf limit reclaim only (we used to have two physical LRU linkages per page), but it never worked for intermediate limit reclaim over multiple leaf cgroups. We're noticing this now because 1) we're putting everything into cgroups for accounting, not just the things we want to control and 2) we're moving away from leaf limits that invoke reclaim on individual cgroups, toward large tree reclaim, triggered by high-level limits, or physical memory pressure that is influenced by local protections such as memory.low and memory.min instead. This patch (of 3): When file pages are lower than the watermark on a node, we try to force scan anonymous pages to counter-act the balancing algorithms preference for new file pages when they are likely thrashing. This is a node-level decision, but it's currently made each time we look at an lruvec. This is unnecessarily expensive and also a layering violation that makes the code harder to understand. Clean this up by making the check once per node and setting a flag in the scan_control. Link: http://lkml.kernel.org/r/20191107205334.158354-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Shakeel Butt Reviewed-by: Suren Baghdasaryan Cc: Andrey Ryabinin Cc: Michal Hocko Cc: Rik van Riel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1b05117df78e035afb5f66ef50bf8750d976ef08 Author: Johannes Weiner Date: Sat Nov 30 17:55:52 2019 -0800 mm: vmscan: harmonize writeback congestion tracking for nodes & memcgs The current writeback congestion tracking has separate flags for kswapd reclaim (node level) and cgroup limit reclaim (memcg-node level). This is unnecessarily complicated: the lruvec is an existing abstraction layer for that node-memcg intersection. Introduce lruvec->flags and LRUVEC_CONGESTED. Then track that at the reclaim root level, which is either the NUMA node for global reclaim, or the cgroup-node intersection for cgroup reclaim. Link: http://lkml.kernel.org/r/20191022144803.302233-9-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Roman Gushchin Reviewed-by: Shakeel Butt Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0f6a5cff43d3bcd6aa54c9af267737249d02aa21 Author: Johannes Weiner Date: Sat Nov 30 17:55:49 2019 -0800 mm: vmscan: split shrink_node() into node part and memcgs part This function is getting long and unwieldy, split out the memcg bits. The updated shrink_node() handles the generic (node) reclaim aspects: - global vmpressure notifications - writeback and congestion throttling - reclaim/compaction management - kswapd giving up on unreclaimable nodes It then calls a new shrink_node_memcgs() which handles cgroup specifics: - the cgroup tree traversal - memory.low considerations - per-cgroup slab shrinking callbacks - per-cgroup vmpressure notifications [hannes@cmpxchg.org: rename "root" to "target_memcg", per Roman] Link: http://lkml.kernel.org/r/20191025143640.GA386981@cmpxchg.org Link: http://lkml.kernel.org/r/20191022144803.302233-8-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Roman Gushchin Reviewed-by: Shakeel Butt Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit afaf07a65ddbdd70871cc3b81463f2a8f3884b6f Author: Johannes Weiner Date: Sat Nov 30 17:55:46 2019 -0800 mm: vmscan: turn shrink_node_memcg() into shrink_lruvec() An lruvec holds LRU pages owned by a certain NUMA node and cgroup. Instead of awkwardly passing around a combination of a pgdat and a memcg pointer, pass down the lruvec as soon as we can look it up. Nested callers that need to access node or cgroup properties can look them them up if necessary, but there are only a few cases. Link: http://lkml.kernel.org/r/20191022144803.302233-7-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Roman Gushchin Reviewed-by: Shakeel Butt Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d2af339706be318dadcbe14c8935426ff401d7b1 Author: Johannes Weiner Date: Sat Nov 30 17:55:43 2019 -0800 mm: vmscan: replace shrink_node() loop with a retry jump Most of the function body is inside a loop, which imposes an additional indentation and scoping level that makes the code a bit hard to follow and modify. The looping only happens in case of reclaim-compaction, which isn't the common case. So rather than adding yet another function level to the reclaim path and have every reclaim invocation go through a level that only exists for one specific cornercase, use a retry goto. Link: http://lkml.kernel.org/r/20191022144803.302233-6-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Roman Gushchin Reviewed-by: Shakeel Butt Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b5ead35e7e1d3434ce436dfcb2af32820ce54589 Author: Johannes Weiner Date: Sat Nov 30 17:55:40 2019 -0800 mm: vmscan: naming fixes: global_reclaim() and sane_reclaim() Seven years after introducing the global_reclaim() function, I still have to double take when reading a callsite. I don't know how others do it, this is a terrible name. Invert the meaning and rename it to cgroup_reclaim(). [ After all, "global reclaim" is just regular reclaim invoked from the page allocator. It's reclaim on behalf of a cgroup limit that is a special case of reclaim, and should be explicit - not the reverse. ] sane_reclaim() isn't very descriptive either: it tests whether we can use the regular writeback throttling - available during regular page reclaim or cgroup2 limit reclaim - or need to use the broken wait_on_page_writeback() method. Use "writeback_throttling_sane()". Link: http://lkml.kernel.org/r/20191022144803.302233-5-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Roman Gushchin Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a108629149cc63cfb6fd446184e3e578e04bcfd1 Author: Johannes Weiner Date: Sat Nov 30 17:55:37 2019 -0800 mm: vmscan: move inactive_list_is_low() swap check to the caller inactive_list_is_low() should be about one thing: checking the ratio between inactive and active list. Kitchensink checks like the one for swap space makes the function hard to use and modify its callsites. Luckly, most callers already have an understanding of the swap situation, so it's easy to clean up. get_scan_count() has its own, memcg-aware swap check, and doesn't even get to the inactive_list_is_low() check on the anon list when there is no swap space available. shrink_list() is called on the results of get_scan_count(), so that check is redundant too. age_active_anon() has its own totalswap_pages check right before it checks the list proportions. The shrink_node_memcg() site is the only one that doesn't do its own swap check. Add it there. Then delete the swap check from inactive_list_is_low(). Link: http://lkml.kernel.org/r/20191022144803.302233-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Roman Gushchin Reviewed-by: Shakeel Butt Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 867e5e1de14b2b2bde324cdfeec3f3f83eb21424 Author: Johannes Weiner Date: Sat Nov 30 17:55:34 2019 -0800 mm: clean up and clarify lruvec lookup procedure There is a per-memcg lruvec and a NUMA node lruvec. Which one is being used is somewhat confusing right now, and it's easy to make mistakes - especially when it comes to global reclaim. How it works: when memory cgroups are enabled, we always use the root_mem_cgroup's per-node lruvecs. When memory cgroups are not compiled in or disabled at runtime, we use pgdat->lruvec. Document that in a comment. Due to the way the reclaim code is generalized, all lookups use the mem_cgroup_lruvec() helper function, and nobody should have to find the right lruvec manually right now. But to avoid future mistakes, rename the pgdat->lruvec member to pgdat->__lruvec and delete the convenience wrapper that suggests it's a commonly accessed member. While in this area, swap the mem_cgroup_lruvec() argument order. The name suggests a memcg operation, yet it takes a pgdat first and a memcg second. I have to double take every time I call this. Fix that. Link: http://lkml.kernel.org/r/20191022144803.302233-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Michal Hocko Reviewed-by: Shakeel Butt Cc: Roman Gushchin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit de3b01506ea494b46aab05dc143b69adbf2aaa9d Author: Johannes Weiner Date: Sat Nov 30 17:55:31 2019 -0800 mm: vmscan: simplify lruvec_lru_size() Patch series "mm: vmscan: cgroup-related cleanups". Here are 8 patches that clean up the reclaim code's interaction with cgroups a bit. They're not supposed to change any behavior, just make the implementation easier to understand and work with. This patch (of 8): This function currently takes the node or lruvec size and subtracts the zones that are excluded by the classzone index of the allocation. It uses four different types of counters to do this. Just add up the eligible zones. [cai@lca.pw: fix an undefined behavior for zone id] Link: http://lkml.kernel.org/r/20191108204407.1435-1-cai@lca.pw [akpm@linux-foundation.org: deal with the MAX_NR_ZONES special case. per Qian Cai] Link: http://lkml.kernel.org/r/64E60F6F-7582-427B-8DD5-EF97B1656F5A@lca.pw Link: http://lkml.kernel.org/r/20191022144803.302233-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Roman Gushchin Reviewed-by: Shakeel Butt Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb16556d913f2b12feffc8a56fe184df1e76d6d5 Author: Yang Shi Date: Sat Nov 30 17:55:28 2019 -0800 mm/vmscan.c: remove unused scan_control parameter from pageout() Since lumpy reclaim was removed in v3.5 scan_control is not used by may_write_to_{queue|inode} and pageout() anymore, remove the unused parameter. Link: http://lkml.kernel.org/r/1570124498-19300-1-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Acked-by: David Rientjes Acked-by: Michal Hocko Cc: Mel Gorman Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f87bccde6a7dd1bdb219a4045e8ac111590c9314 Author: Andrey Ryabinin Date: Sat Nov 30 17:55:24 2019 -0800 mm/vmscan: remove unused lru_pages argument Since 9092c71bb724 ("mm: use sc->priority for slab shrink targets") the argument 'unsigned long *lru_pages' passed around with no purpose. Remove it. Link: http://lkml.kernel.org/r/20190228083329.31892-4-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Acked-by: Johannes Weiner Acked-by: Vlastimil Babka Acked-by: Mel Gorman Cc: Michal Hocko Cc: Rik van Riel Cc: William Kucharski Cc: John Hubbard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e47b346aba0873529bf5130d599e4d91197cdd52 Author: lijiazi Date: Sat Nov 30 17:55:21 2019 -0800 mm/page_alloc.c: print reserved_highatomic info Print nr_reserved_highatomic in show_free_areas, because when alloc_harder is false, this value will be subtracted from the free_pages in __zone_watermark_ok. Printing this value can help analyze memory allocaction failure issues. Link: http://lkml.kernel.org/r/19515f3de2fb6abe66b52e03e4b676a21e82beda.1573634806.git.lijiazi@xiaomi.com Signed-off-by: lijiazi Reviewed-by: Andrew Morton Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 653e003d7f37716f84c17edcad3c228497888bfc Author: Hao Lee Date: Sat Nov 30 17:55:18 2019 -0800 include/linux/mmzone.h: fix comment for ISOLATE_UNMAPPED macro Both file-backed pages and anonymous pages can be unmapped. ISOLATE_UNMAPPED is not just for file-backed pages. Link: http://lkml.kernel.org/r/20191024151621.GA20400@haolee.github.io Signed-off-by: Hao Lee Reviewed-by: Andrew Morton Cc: Vlastimil Babka Cc: Dan Williams Cc: Michal Hocko Cc: Wei Yang Cc: Mel Gorman Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 68265390f9aa625e2ce94ed1bcff8906db702d79 Author: Mel Gorman Date: Sat Nov 30 17:55:15 2019 -0800 mm, pcpu: make zone pcp updates and reset internal to the mm Memory hotplug needs to be able to reset and reinit the pcpu allocator batch and high limits but this action is internal to the VM. Move the declaration to internal.h Link: http://lkml.kernel.org/r/20191021094808.28824-4-mgorman@techsingularity.net Signed-off-by: Mel Gorman Acked-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Borislav Petkov Cc: Matt Fleming Cc: Qian Cai Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb1ef534ceb745f237eafb72ff5555d74fa49235 Author: Mel Gorman Date: Sat Nov 30 17:55:11 2019 -0800 mm, pcp: share common code between memory hotplug and percpu sysctl handler Both the percpu_pagelist_fraction sysctl handler and memory hotplug have a common requirement of updating the pcpu page allocation batch and high values. Split the relevant helper to share common code. No functional change. Link: http://lkml.kernel.org/r/20191021094808.28824-3-mgorman@techsingularity.net Signed-off-by: Mel Gorman Acked-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Borislav Petkov Cc: Matt Fleming Cc: Qian Cai Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5e27a2df03b8933aa7c1579816ecb6a071bb0e0d Author: Anshuman Khandual Date: Sat Nov 30 17:55:06 2019 -0800 mm/page_alloc: add alloc_contig_pages() HugeTLB helper alloc_gigantic_page() implements fairly generic allocation method where it scans over various zones looking for a large contiguous pfn range before trying to allocate it with alloc_contig_range(). Other than deriving the requested order from 'struct hstate', there is nothing HugeTLB specific in there. This can be made available for general use to allocate contiguous memory which could not have been allocated through the buddy allocator. alloc_gigantic_page() has been split carving out actual allocation method which is then made available via new alloc_contig_pages() helper wrapped under CONFIG_CONTIG_ALLOC. All references to 'gigantic' have been replaced with more generic term 'contig'. Allocated pages here should be freed with free_contig_range() or by calling __free_page() on each allocated page. Link: http://lkml.kernel.org/r/1571300646-32240-1-git-send-email-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: David Hildenbrand Acked-by: Michal Hocko Cc: Mike Kravetz Cc: Vlastimil Babka Cc: Michal Hocko Cc: David Rientjes Cc: Andrea Arcangeli Cc: Oscar Salvador Cc: Mel Gorman Cc: Mike Rapoport Cc: Dan Williams Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0609ae011deb41c9629b7f5fd626dfa1ac9d16b0 Author: Daniel Axtens Date: Sat Nov 30 17:55:00 2019 -0800 x86/kasan: support KASAN_VMALLOC In the case where KASAN directly allocates memory to back vmalloc space, don't map the early shadow page over it. We prepopulate pgds/p4ds for the range that would otherwise be empty. This is required to get it synced to hardware on boot, allowing the lower levels of the page tables to be filled dynamically. Link: http://lkml.kernel.org/r/20191031093909.9228-5-dja@axtens.net Signed-off-by: Daniel Axtens Acked-by: Dmitry Vyukov Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Christophe Leroy Cc: Mark Rutland Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eafb149ed73a8bb8359c0ce027b98acd4e95b070 Author: Daniel Axtens Date: Sat Nov 30 17:54:57 2019 -0800 fork: support VMAP_STACK with KASAN_VMALLOC Supporting VMAP_STACK with KASAN_VMALLOC is straightforward: - clear the shadow region of vmapped stacks when swapping them in - tweak Kconfig to allow VMAP_STACK to be turned on with KASAN Link: http://lkml.kernel.org/r/20191031093909.9228-4-dja@axtens.net Signed-off-by: Daniel Axtens Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Christophe Leroy Cc: Mark Rutland Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 06513916930125cdb4d0662f8b675d719abe7f32 Author: Daniel Axtens Date: Sat Nov 30 17:54:53 2019 -0800 kasan: add test for vmalloc Test kasan vmalloc support by adding a new test to the module. Link: http://lkml.kernel.org/r/20191031093909.9228-3-dja@axtens.net Signed-off-by: Daniel Axtens Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Christophe Leroy Cc: Dmitry Vyukov Cc: Mark Rutland Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3c5c3cfb9ef4da957e3357a2bd36f76ee34c0862 Author: Daniel Axtens Date: Sat Nov 30 17:54:50 2019 -0800 kasan: support backing vmalloc space with real shadow memory Patch series "kasan: support backing vmalloc space with real shadow memory", v11. Currently, vmalloc space is backed by the early shadow page. This means that kasan is incompatible with VMAP_STACK. This series provides a mechanism to back vmalloc space with real, dynamically allocated memory. I have only wired up x86, because that's the only currently supported arch I can work with easily, but it's very easy to wire up other architectures, and it appears that there is some work-in-progress code to do this on arm64 and s390. This has been discussed before in the context of VMAP_STACK: - https://bugzilla.kernel.org/show_bug.cgi?id=202009 - https://lkml.org/lkml/2018/7/22/198 - https://lkml.org/lkml/2019/7/19/822 In terms of implementation details: Most mappings in vmalloc space are small, requiring less than a full page of shadow space. Allocating a full shadow page per mapping would therefore be wasteful. Furthermore, to ensure that different mappings use different shadow pages, mappings would have to be aligned to KASAN_SHADOW_SCALE_SIZE * PAGE_SIZE. Instead, share backing space across multiple mappings. Allocate a backing page when a mapping in vmalloc space uses a particular page of the shadow region. This page can be shared by other vmalloc mappings later on. We hook in to the vmap infrastructure to lazily clean up unused shadow memory. Testing with test_vmalloc.sh on an x86 VM with 2 vCPUs shows that: - Turning on KASAN, inline instrumentation, without vmalloc, introuduces a 4.1x-4.2x slowdown in vmalloc operations. - Turning this on introduces the following slowdowns over KASAN: * ~1.76x slower single-threaded (test_vmalloc.sh performance) * ~2.18x slower when both cpus are performing operations simultaneously (test_vmalloc.sh sequential_test_order=1) This is unfortunate but given that this is a debug feature only, not the end of the world. The benchmarks are also a stress-test for the vmalloc subsystem: they're not indicative of an overall 2x slowdown! This patch (of 4): Hook into vmalloc and vmap, and dynamically allocate real shadow memory to back the mappings. Most mappings in vmalloc space are small, requiring less than a full page of shadow space. Allocating a full shadow page per mapping would therefore be wasteful. Furthermore, to ensure that different mappings use different shadow pages, mappings would have to be aligned to KASAN_SHADOW_SCALE_SIZE * PAGE_SIZE. Instead, share backing space across multiple mappings. Allocate a backing page when a mapping in vmalloc space uses a particular page of the shadow region. This page can be shared by other vmalloc mappings later on. We hook in to the vmap infrastructure to lazily clean up unused shadow memory. To avoid the difficulties around swapping mappings around, this code expects that the part of the shadow region that covers the vmalloc space will not be covered by the early shadow page, but will be left unmapped. This will require changes in arch-specific code. This allows KASAN with VMAP_STACK, and may be helpful for architectures that do not have a separate module space (e.g. powerpc64, which I am currently working on). It also allows relaxing the module alignment back to PAGE_SIZE. Testing with test_vmalloc.sh on an x86 VM with 2 vCPUs shows that: - Turning on KASAN, inline instrumentation, without vmalloc, introuduces a 4.1x-4.2x slowdown in vmalloc operations. - Turning this on introduces the following slowdowns over KASAN: * ~1.76x slower single-threaded (test_vmalloc.sh performance) * ~2.18x slower when both cpus are performing operations simultaneously (test_vmalloc.sh sequential_test_order=3D1) This is unfortunate but given that this is a debug feature only, not the end of the world. The full benchmark results are: Performance No KASAN KASAN original x baseline KASAN vmalloc x baseline x KASAN fix_size_alloc_test 662004 11404956 17.23 19144610 28.92 1.68 full_fit_alloc_test 710950 12029752 16.92 13184651 18.55 1.10 long_busy_list_alloc_test 9431875 43990172 4.66 82970178 8.80 1.89 random_size_alloc_test 5033626 23061762 4.58 47158834 9.37 2.04 fix_align_alloc_test 1252514 15276910 12.20 31266116 24.96 2.05 random_size_align_alloc_te 1648501 14578321 8.84 25560052 15.51 1.75 align_shift_alloc_test 147 830 5.65 5692 38.72 6.86 pcpu_alloc_test 80732 125520 1.55 140864 1.74 1.12 Total Cycles 119240774314 763211341128 6.40 1390338696894 11.66 1.82 Sequential, 2 cpus No KASAN KASAN original x baseline KASAN vmalloc x baseline x KASAN fix_size_alloc_test 1423150 14276550 10.03 27733022 19.49 1.94 full_fit_alloc_test 1754219 14722640 8.39 15030786 8.57 1.02 long_busy_list_alloc_test 11451858 52154973 4.55 107016027 9.34 2.05 random_size_alloc_test 5989020 26735276 4.46 68885923 11.50 2.58 fix_align_alloc_test 2050976 20166900 9.83 50491675 24.62 2.50 random_size_align_alloc_te 2858229 17971700 6.29 38730225 13.55 2.16 align_shift_alloc_test 405 6428 15.87 26253 64.82 4.08 pcpu_alloc_test 127183 151464 1.19 216263 1.70 1.43 Total Cycles 54181269392 308723699764 5.70 650772566394 12.01 2.11 fix_size_alloc_test 1420404 14289308 10.06 27790035 19.56 1.94 full_fit_alloc_test 1736145 14806234 8.53 15274301 8.80 1.03 long_busy_list_alloc_test 11404638 52270785 4.58 107550254 9.43 2.06 random_size_alloc_test 6017006 26650625 4.43 68696127 11.42 2.58 fix_align_alloc_test 2045504 20280985 9.91 50414862 24.65 2.49 random_size_align_alloc_te 2845338 17931018 6.30 38510276 13.53 2.15 align_shift_alloc_test 472 3760 7.97 9656 20.46 2.57 pcpu_alloc_test 118643 132732 1.12 146504 1.23 1.10 Total Cycles 54040011688 309102805492 5.72 651325675652 12.05 2.11 [dja@axtens.net: fixups] Link: http://lkml.kernel.org/r/20191120052719.7201-1-dja@axtens.net Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D202009 Link: http://lkml.kernel.org/r/20191031093909.9228-2-dja@axtens.net Signed-off-by: Mark Rutland [shadow rework] Signed-off-by: Daniel Axtens Co-developed-by: Mark Rutland Acked-by: Vasily Gorbik Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Christophe Leroy Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e36176be1c3920a487681e37158849b9f50189c4 Author: Uladzislau Rezki (Sony) Date: Sat Nov 30 17:54:47 2019 -0800 mm/vmalloc: rework vmap_area_lock With the new allocation approach introduced in the 5.2 kernel, it becomes possible to get rid of one global spinlock. By doing that we can further improve the KVA from the performance point of view. Basically we can have two independent locks, one for allocation part and another one for deallocation, because of two different entities: "free data structures" and "busy data structures". As a result, allocation/deallocation operations can still interfere between each other in case of running simultaneously on different CPUs, it means there is still dependency, but with two locks it becomes lower. Summarizing: - it reduces the high lock contention - it allows to perform operations on "free" and "busy" trees in parallel on different CPUs. Please note it does not solve scalability issue. Test results: In order to evaluate this patch, we can run "vmalloc test driver" to see how many CPU cycles it takes to complete all test cases running sequentially. All online CPUs run it so it will cause a high lock contention. HiKey 960, ARM64, 8xCPUs, big.LITTLE: sudo ./test_vmalloc.sh sequential_test_order=1 [ 390.950557] All test took CPU0=457126382 cycles [ 391.046690] All test took CPU1=454763452 cycles [ 391.128586] All test took CPU2=454539334 cycles [ 391.222669] All test took CPU3=455649517 cycles [ 391.313946] All test took CPU4=388272196 cycles [ 391.410425] All test took CPU5=384036264 cycles [ 391.492219] All test took CPU6=387432964 cycles [ 391.578433] All test took CPU7=387201996 cycles [ 304.721224] All test took CPU0=391521310 cycles [ 304.821219] All test took CPU1=393533002 cycles [ 304.917120] All test took CPU2=392243032 cycles [ 305.008986] All test took CPU3=392353853 cycles [ 305.108944] All test took CPU4=297630721 cycles [ 305.196406] All test took CPU5=297548736 cycles [ 305.288602] All test took CPU6=297092392 cycles [ 305.381088] All test took CPU7=297293597 cycles ~14%-23% patched variant is better. Link: http://lkml.kernel.org/r/20191022155800.20468-1-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Andrew Morton Cc: Hillf Danton Cc: Michal Hocko Cc: Matthew Wilcox Cc: Oleksiy Avramchenko Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 746dd4012d215b53152f0001a48856e41ea31730 Author: Anders Roxell Date: Sat Nov 30 17:54:43 2019 -0800 selftests: vm: add fragment CONFIG_TEST_VMALLOC When running test_vmalloc.sh smoke the following print out states that the fragment is missing. # ./test_vmalloc.sh: You must have the following enabled in your kernel: # CONFIG_TEST_VMALLOC=m Rework to add the fragment 'CONFIG_TEST_VMALLOC=m' to the config file. Link: http://lkml.kernel.org/r/20190916095217.19665-1-anders.roxell@linaro.org Fixes: a05ef00c9790 ("selftests/vm: add script helper for CONFIG_TEST_VMALLOC_MODULE") Signed-off-by: Anders Roxell Cc: Shuah Khan Cc: "Uladzislau Rezki (Sony)" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 060650a2a0598d61bac6ce64578b176cb0e18b06 Author: Uladzislau Rezki (Sony) Date: Sat Nov 30 17:54:40 2019 -0800 mm/vmalloc: add more comments to the adjust_va_to_fit_type() When fit type is NE_FIT_TYPE there is a need in one extra object. Usually the "ne_fit_preload_node" per-CPU variable has it and there is no need in GFP_NOWAIT allocation, but there are exceptions. This commit just adds more explanations, as a result giving answers on questions like when it can occur, how often, under which conditions and what happens if GFP_NOWAIT gets failed. Link: http://lkml.kernel.org/r/20191016095438.12391-3-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Michal Hocko Cc: Daniel Wagner Cc: Sebastian Andrzej Siewior Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Uladzislau Rezki Cc: Hillf Danton Cc: Michal Hocko Cc: Matthew Wilcox Cc: Oleksiy Avramchenko Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f07116d77b5b9a4fecdcb470fc6ea08378b98ff7 Author: Uladzislau Rezki (Sony) Date: Sat Nov 30 17:54:37 2019 -0800 mm/vmalloc: respect passed gfp_mask when doing preloading Allocation functions should comply with the given gfp_mask as much as possible. The preallocation code in alloc_vmap_area doesn't follow that pattern and it is using a hardcoded GFP_KERNEL. Although this doesn't really make much difference because vmalloc is not GFP_NOWAIT compliant in general (e.g. page table allocations are GFP_KERNEL) there is no reason to spread that bad habit and it is good to fix the antipattern. [mhocko@suse.com: rewrite changelog] Link: http://lkml.kernel.org/r/20191016095438.12391-2-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Michal Hocko Cc: Daniel Wagner Cc: Hillf Danton Cc: Matthew Wilcox Cc: Oleksiy Avramchenko Cc: Peter Zijlstra Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 81f1ba586e393ad43350bded96d1ec3c48674b00 Author: Uladzislau Rezki (Sony) Date: Sat Nov 30 17:54:33 2019 -0800 mm/vmalloc: remove preempt_disable/enable when doing preloading Some background. The preemption was disabled before to guarantee that a preloaded object is available for a CPU, it was stored for. That was achieved by combining the disabling the preemption and taking the spin lock while the ne_fit_preload_node is checked. The aim was to not allocate in atomic context when spinlock is taken later, for regular vmap allocations. But that approach conflicts with CONFIG_PREEMPT_RT philosophy. It means that calling spin_lock() with disabled preemption is forbidden in the CONFIG_PREEMPT_RT kernel. Therefore, get rid of preempt_disable() and preempt_enable() when the preload is done for splitting purpose. As a result we do not guarantee now that a CPU is preloaded, instead we minimize the case when it is not, with this change, by populating the per cpu preload pointer under the vmap_area_lock. This implies that at least each caller that has done the preallocation will not fallback to an atomic allocation later. It is possible that the preallocation would be pointless or that no preallocation is done because of the race but the data shows that this is really rare. For example i run the special test case that follows the preload pattern and path. 20 "unbind" threads run it and each does 1000000 allocations. Only 3.5 times among 1000000 a CPU was not preloaded. So it can happen but the number is negligible. [mhocko@suse.com: changelog additions] Link: http://lkml.kernel.org/r/20191016095438.12391-1-urezki@gmail.com Fixes: 82dd23e84be3 ("mm/vmalloc.c: preload a CPU with one object for split purpose") Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Steven Rostedt (VMware) Acked-by: Sebastian Andrzej Siewior Acked-by: Daniel Wagner Acked-by: Michal Hocko Cc: Hillf Danton Cc: Matthew Wilcox Cc: Oleksiy Avramchenko Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dcf61ff06d1738f66f89a54c25469df346214d75 Author: Liu Xiang Date: Sat Nov 30 17:54:30 2019 -0800 mm/vmalloc.c: remove unnecessary highmem_mask from parameter of gfpflags_allow_blocking() gfpflags_allow_blocking() does not care about __GFP_HIGHMEM, so highmem_mask can be removed. Link: http://lkml.kernel.org/r/1568812319-3467-1-git-send-email-liuxiang_1999@126.com Signed-off-by: Liu Xiang Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 09dbcf422e9b791d2d43cad8c283d9bdaef019a9 Author: Michal Hocko Date: Sat Nov 30 17:54:27 2019 -0800 mm/sparse.c: do not waste pre allocated memmap space Vincent has noticed [1] that there is something unusual with the memmap allocations going on on his platform : I noticed this because on my ARM64 platform, with 1 GiB of memory the : first [and only] section is allocated from the zeroing path while with : 2 GiB of memory the first 1 GiB section is allocated from the : non-zeroing path. The underlying problem is that although sparse_buffer_init allocates enough memory for all sections on the node sparse_buffer_alloc is not able to consume them due to mismatch in the expected allocation alignement. While sparse_buffer_init preallocation uses the PAGE_SIZE alignment the real memmap has to be aligned to section_map_size() this results in a wasted initial chunk of the preallocated memmap and unnecessary fallback allocation for a section. While we are at it also change __populate_section_memmap to align to the requested size because at least VMEMMAP has constrains to have memmap properly aligned. [1] http://lkml.kernel.org/r/20191030131122.8256-1-vincent.whitchurch@axis.com [akpm@linux-foundation.org: tweak layout, per David] Link: http://lkml.kernel.org/r/20191119092642.31799-1-mhocko@kernel.org Fixes: 35fd1eb1e821 ("mm/sparse: abstract sparse buffer allocations") Signed-off-by: Michal Hocko Reported-by: Vincent Whitchurch Debugged-by: Vincent Whitchurch Acked-by: David Hildenbrand Cc: Pavel Tatashin Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 030eab4f9ffb469344c10a46bc02c5149db0a2a9 Author: Ilya Leoshkevich Date: Sat Nov 30 17:54:24 2019 -0800 mm/sparse.c: mark populate_section_memmap as __meminit Building the kernel on s390 with -Og produces the following warning: WARNING: vmlinux.o(.text+0x28dabe): Section mismatch in reference from the function populate_section_memmap() to the function .meminit.text:__populate_section_memmap() The function populate_section_memmap() references the function __meminit __populate_section_memmap(). This is often because populate_section_memmap lacks a __meminit annotation or the annotation of __populate_section_memmap is wrong. While -Og is not supported, in theory this might still happen with another compiler or on another architecture. So fix this by using the correct section annotations. [iii@linux.ibm.com: v2] Link: http://lkml.kernel.org/r/20191030151639.41486-1-iii@linux.ibm.com Link: http://lkml.kernel.org/r/20191028165549.14478-1-iii@linux.ibm.com Signed-off-by: Ilya Leoshkevich Acked-by: David Hildenbrand Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4c29700ed9908c15feeb84a40a415f4e921c5a66 Author: Vincent Whitchurch Date: Sat Nov 30 17:54:20 2019 -0800 mm/sparse: consistently do not zero memmap sparsemem without VMEMMAP has two allocation paths to allocate the memory needed for its memmap (done in sparse_mem_map_populate()). In one allocation path (sparse_buffer_alloc() succeeds), the memory is not zeroed (since it was previously allocated with memblock_alloc_try_nid_raw()). In the other allocation path (sparse_buffer_alloc() fails and sparse_mem_map_populate() falls back to memblock_alloc_try_nid()), the memory is zeroed. AFAICS this difference does not appear to be on purpose. If the code is supposed to work with non-initialized memory (__init_single_page() takes care of zeroing the struct pages which are actually used), we should consistently not zero the memory, to avoid masking bugs. ( I noticed this because on my ARM64 platform, with 1 GiB of memory the first [and only] section is allocated from the zeroing path while with 2 GiB of memory the first 1 GiB section is allocated from the non-zeroing path. ) Michal: "the main user visible problem is a memory wastage. The overal amount of memory should be small. I wouldn't call it stable material." Link: http://lkml.kernel.org/r/20191030131122.8256-1-vincent.whitchurch@axis.com Signed-off-by: Vincent Whitchurch Acked-by: Michal Hocko Acked-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c5e79ef561b0292fa4448d3ea5de6430143b9f70 Author: David Hildenbrand Date: Sat Nov 30 17:54:17 2019 -0800 mm/memory_hotplug.c: don't allow to online/offline memory blocks with holes Our onlining/offlining code is unnecessarily complicated. Only memory blocks added during boot can have holes (a range that is not IORESOURCE_SYSTEM_RAM). Hotplugged memory never has holes (e.g., see add_memory_resource()). All memory blocks that belong to boot memory are already online. Note that boot memory can have holes and the memmap of the holes is marked PG_reserved. However, also memory allocated early during boot is PG_reserved - basically every page of boot memory that is not given to the buddy is PG_reserved. Therefore, when we stop allowing to offline memory blocks with holes, we implicitly no longer have to deal with onlining memory blocks with holes. E.g., online_pages() will do a walk_system_ram_range(..., online_pages_range), whereby online_pages_range() will effectively only free the memory holes not falling into a hole to the buddy. The other pages (holes) are kept PG_reserved (via move_pfn_range_to_zone()->memmap_init_zone()). This allows to simplify the code. For example, we no longer have to worry about marking pages that fall into memory holes PG_reserved when onlining memory. We can stop setting pages PG_reserved completely in memmap_init_zone(). Offlining memory blocks added during boot is usually not guaranteed to work either way (unmovable data might have easily ended up on that memory during boot). So stopping to do that should not really hurt. Also, people are not even aware of a setup where onlining/offlining of memory blocks with holes used to work reliably (see [1] and [2] especially regarding the hotplug path) - I doubt it worked reliably. For the use case of offlining memory to unplug DIMMs, we should see no change. (holes on DIMMs would be weird). Please note that hardware errors (PG_hwpoison) are not memory holes and are not affected by this change when offlining. [1] https://lkml.org/lkml/2019/10/22/135 [2] https://lkml.org/lkml/2019/8/14/1365 Link: http://lkml.kernel.org/r/20191119115237.6662-1-david@redhat.com Reviewed-by: Dan Williams Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Dan Williams Cc: Anshuman Khandual Cc: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 848e19ad3c3352b6e0906f05b282a3e22c67c98f Author: David Hildenbrand Date: Sat Nov 30 17:54:14 2019 -0800 drivers/base/memory.c: drop the mem_sysfs_mutex The mem_sysfs_mutex isn't really helpful. Also, it's not really clear what the mutex protects at all. The device lists of the memory subsystem are protected separately. We don't need that mutex when looking up. creating, or removing independent devices. find_memory_block_by_id() will perform locking on its own and grab a reference of the returned device. At the time memory_dev_init() is called, we cannot have concurrent hot(un)plug operations yet - we're still fairly early during boot. We don't need any locking. The creation/removal of memory block devices should be protected on a higher level - especially using the device hotplug lock to avoid documented issues (see Documentation/core-api/memory-hotplug.rst) - or if that is reworked, using similar locking. Protecting in the context of these functions only doesn't really make sense. Especially, if we would have a situation where the same memory blocks are created/deleted at the same time, there is something horribly going wrong (imagining adding/removing a DIMM at the same time from two call paths) - after the functions succeeded something else in the callers would blow up (e.g., create_memory_block_devices() succeeded but there are no memory block devices anymore). All relevant call paths (except when adding memory early during boot via ACPI, which is now documented) hold the device hotplug lock when adding memory, and when removing memory. Let's document that instead. Add a simple safety net to create_memory_block_devices() in case we would actually remove memory blocks while adding them, so we'll never dereference a NULL pointer. Simplify memory_dev_init() now that the lock is gone. Link: http://lkml.kernel.org/r/20190925082621.4927-1-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Andrew Morton Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Michal Hocko Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aba9817da150e9dcf4c599c0508c38d1971d66e1 Author: Ben Dooks (Codethink) Date: Sat Nov 30 17:54:10 2019 -0800 include/linux/memory_hotplug.h: move definitions of {set,clear}_zone_contiguous The {set,clear}_zone_contiguous are built whatever the configuratoon so move the definitions outside the current ifdef to avoid the following compiler warnings: mm/page_alloc.c:1550:6: warning: no previous prototype for 'set_zone_contiguous' [-Wmissing-prototypes] mm/page_alloc.c:1571:6: warning: no previous prototype for 'clear_zone_contiguous' [-Wmissing-prototypes] Link: http://lkml.kernel.org/r/20191106123911.7435-1-ben.dooks@codethink.co.uk Signed-off-by: Ben Dooks (Codethink) Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 756d25be457fc5497da0ceee0f3d0c9eb4d8535d Author: David Hildenbrand Date: Sat Nov 30 17:54:07 2019 -0800 mm/page_isolation.c: convert SKIP_HWPOISON to MEMORY_OFFLINE We have two types of users of page isolation: 1. Memory offlining: Offline memory so it can be unplugged. Memory won't be touched. 2. Memory allocation: Allocate memory (e.g., alloc_contig_range()) to become the owner of the memory and make use of it. For example, in case we want to offline memory, we can ignore (skip over) PageHWPoison() pages, as the memory won't get used. We can allow to offline memory. In contrast, we don't want to allow to allocate such memory. Let's generalize the approach so we can special case other types of pages we want to skip over in case we offline memory. While at it, also pass the same flags to test_pages_isolated(). Link: http://lkml.kernel.org/r/20191021172353.3056-3-david@redhat.com Signed-off-by: David Hildenbrand Suggested-by: Michal Hocko Acked-by: Michal Hocko Cc: Oscar Salvador Cc: Anshuman Khandual Cc: David Hildenbrand Cc: Pingfan Liu Cc: Qian Cai Cc: Pavel Tatashin Cc: Dan Williams Cc: Vlastimil Babka Cc: Mel Gorman Cc: Mike Rapoport Cc: Alexander Duyck Cc: Mike Rapoport Cc: Pavel Tatashin Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0ee5f4f31d365ff9867a8002a8b37f9aa61b21d2 Author: David Hildenbrand Date: Sat Nov 30 17:54:03 2019 -0800 mm/page_alloc.c: don't set pages PageReserved() when offlining Patch series "mm: Memory offlining + page isolation cleanups", v2. This patch (of 2): We call __offline_isolated_pages() from __offline_pages() after all pages were isolated and are either free (PageBuddy()) or PageHWPoison. Nothing can stop us from offlining memory at this point. In __offline_isolated_pages() we first set all affected memory sections offline (offline_mem_sections(pfn, end_pfn)), to mark the memmap as invalid (pfn_to_online_page() will no longer succeed), and then walk over all pages to pull the free pages from the free lists (to the isolated free lists, to be precise). Note that re-onlining a memory block will result in the whole memmap getting reinitialized, overwriting any old state. We already poision the memmap when offlining is complete to find any access to stale/uninitialized memmaps. So, setting the pages PageReserved() is not helpful. The memap is marked offline and all pageblocks are isolated. As soon as offline, the memmap is stale either way. This looks like a leftover from ancient times where we initialized the memmap when adding memory and not when onlining it (the pages were set PageReserved so re-onling would work as expected). Link: http://lkml.kernel.org/r/20191021172353.3056-2-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Cc: Vlastimil Babka Cc: Oscar Salvador Cc: Mel Gorman Cc: Mike Rapoport Cc: Dan Williams Cc: Wei Yang Cc: Alexander Duyck Cc: Anshuman Khandual Cc: Pavel Tatashin Cc: Mike Rapoport Cc: Pavel Tatashin Cc: Pingfan Liu Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0ec47097434847c0c3a3bb7287feb46386a62720 Author: David Hildenbrand Date: Sat Nov 30 17:54:00 2019 -0800 mm/memory_hotplug: remove __online_page_free() and __online_page_increment_counters() Let's drop the now unused functions. Link: http://lkml.kernel.org/r/20190909114830.662-4-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Wei Yang Cc: Dan Williams Cc: Qian Cai Cc: Haiyang Zhang Cc: "K. Y. Srinivasan" Cc: Sasha Levin Cc: Stephen Hemminger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 30a9c246b9f6fe0591e8afb05758a3e3b096fabe Author: David Hildenbrand Date: Sat Nov 30 17:53:55 2019 -0800 hv_balloon: use generic_online_page() Let's use the generic onlining function - which will now also take care of calling kernel_map_pages(). Link: http://lkml.kernel.org/r/20190909114830.662-3-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Stephen Hemminger Cc: Sasha Levin Cc: Dan Williams Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Qian Cai Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 18db149120c106cf2b1a2595f82f3229f9d223b8 Author: David Hildenbrand Date: Sat Nov 30 17:53:51 2019 -0800 mm/memory_hotplug: export generic_online_page() Patch series "mm/memory_hotplug: Export generic_online_page()". Let's replace the __online_page...() functions by generic_online_page(). Hyper-V only wants to delay the actual onlining of un-backed pages, so we can simpy re-use the generic function. This patch (of 3): Let's expose generic_online_page() so online_page_callback users can simply fall back to the generic implementation when actually deciding to online the pages. Link: http://lkml.kernel.org/r/20190909114830.662-2-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Dan Williams Cc: Wei Yang Cc: Qian Cai Cc: Haiyang Zhang Cc: "K. Y. Srinivasan" Cc: Sasha Levin Cc: Stephen Hemminger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dca4436d1cf9e0d237c8ed2af72ed6b78fc7c099 Author: Alastair D'Silva Date: Sat Nov 30 17:53:48 2019 -0800 mm/memory_hotplug.c: add a bounds check to __add_pages() On PowerPC, the address ranges allocated to OpenCAPI LPC memory are allocated from firmware. These address ranges may be higher than what older kernels permit, as we increased the maximum permissable address in commit 4ffe713b7587 ("powerpc/mm: Increase the max addressable memory to 2PB"). It is possible that the addressable range may change again in the future. In this scenario, we end up with a bogus section returned from __section_nr (see the discussion on the thread "mm: Trigger bug on if a section is not found in __section_nr"). Adding a check here means that we fail early and have an opportunity to handle the error gracefully, rather than rumbling on and potentially accessing an incorrect section. Further discussion is also on the thread ("powerpc: Perform a bounds check in arch_add_memory") http://lkml.kernel.org/r/20190827052047.31547-1-alastair@au1.ibm.com Link: http://lkml.kernel.org/r/20191001004617.7536-2-alastair@au1.ibm.com Signed-off-by: Alastair D'Silva Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 32d1fe8fcb32130733b59fc447e35753dc87fd40 Author: Anshuman Khandual Date: Sat Nov 30 17:53:44 2019 -0800 mm/hotplug: reorder memblock_[free|remove]() calls in try_remove_memory() Currently during memory hot add procedure, memory gets into memblock before calling arch_add_memory() which creates its linear mapping. add_memory_resource() { .................. memblock_add_node() .................. arch_add_memory() .................. } But during memory hot remove procedure, removal from memblock happens first before its linear mapping gets teared down with arch_remove_memory() which is not consistent. Resource removal should happen in reverse order as they were added. However this does not pose any problem for now, unless there is an assumption regarding linear mapping. One example was a subtle failure on arm64 platform [1]. Though this has now found a different solution. try_remove_memory() { .................. memblock_free() memblock_remove() .................. arch_remove_memory() .................. } This changes the sequence of resource removal including memblock and linear mapping tear down during memory hot remove which will now be the reverse order in which they were added during memory hot add. The changed removal order looks like the following. try_remove_memory() { .................. arch_remove_memory() .................. memblock_free() memblock_remove() .................. } [1] https://patchwork.kernel.org/patch/11127623/ Memory hot remove now works on arm64 without this because a recent commit 60bb462fc7ad ("drivers/base/node.c: simplify unregister_memory_block_under_nodes()"). This does not fix a serious problem. It just removes an inconsistency while freeing resources during memory hot remove which for now does not pose a real problem. David mentioned that re-ordering should still make sense for consistency purpose (removing stuff in the reverse order they were added). This patch is now detached from arm64 hot-remove series. Michal: : I would just a note that the inconsistency doesn't pose any problem now : but if somebody makes any assumptions about linear mappings then it could : get subtly broken like your example for arm64 which has found a different : solution in the meantime. Link: http://lkml.kernel.org/r/1569380273-7708-1-git-send-email-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7506851837350e112685ddf4d13ba03a558f9e20 Author: Yunfeng Ye Date: Sat Nov 30 17:53:41 2019 -0800 mm/memory-failure.c: use page_shift() in add_to_kill() page_shift() is supported after the commit 94ad9338109f ("mm: introduce page_shift()"). So replace with page_shift() in add_to_kill() for readability. Link: http://lkml.kernel.org/r/543d8bc9-f2e7-3023-7c35-2e7ed67c0e82@huawei.com Signed-off-by: Yunfeng Ye Reviewed-by: David Hildenbrand Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit feec24a6139d4640c6ef344e0271a8cd4d509e60 Author: Naoya Horiguchi Date: Sat Nov 30 17:53:38 2019 -0800 mm, soft-offline: convert parameter to pfn Currently soft_offline_page() receives struct page, and its sibling memory_failure() receives pfn. This discrepancy looks weird and makes precheck on pfn validity tricky. So let's align them. Link: http://lkml.kernel.org/r/20191016234706.GA5493@www9186uo.sakura.ne.jp Signed-off-by: Naoya Horiguchi Acked-by: Andrew Morton Cc: David Hildenbrand Cc: Michal Hocko Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 996ff7a08dae591f5e87852281477d26a83b393c Author: Jane Chu Date: Sat Nov 30 17:53:35 2019 -0800 mm/memory-failure.c clean up around tk pre-allocation add_to_kill() expects the first 'tk' to be pre-allocated, it makes subsequent allocations on need basis, this makes the code a bit difficult to read. Move all the allocation internal to add_to_kill() and drop the **tk argument. Link: http://lkml.kernel.org/r/1565112345-28754-2-git-send-email-jane.chu@oracle.com Signed-off-by: Jane Chu Reviewed-by: Dan Williams Acked-by: Naoya Horiguchi Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e53c4e1c807d91dc7241c2104e69ad9d2c71e48 Author: Joel Fernandes (Google) Date: Sat Nov 30 17:53:31 2019 -0800 memfd: add test for COW on MAP_PRIVATE and F_SEAL_FUTURE_WRITE mappings In this test, the parent and child both have writable private mappings. The test shows that without the patch in this series, the parent and child shared the same memory which is incorrect. In other words, COW needs to be triggered so any writes to child's copy stays local to the child. Link: http://lkml.kernel.org/r/20191107195355.80608-2-joel@joelfernandes.org Signed-off-by: Joel Fernandes (Google) Cc: Hugh Dickins Cc: Nicolas Geoffray Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 05d351102dbe4e103d6bdac18b1122cd3cd04925 Author: Nicolas Geoffray Date: Sat Nov 30 17:53:28 2019 -0800 mm, memfd: fix COW issue on MAP_PRIVATE and F_SEAL_FUTURE_WRITE mappings F_SEAL_FUTURE_WRITE has unexpected behavior when used with MAP_PRIVATE: A private mapping created after the memfd file that gets sealed with F_SEAL_FUTURE_WRITE loses the copy-on-write at fork behavior, meaning children and parent share the same memory, even though the mapping is private. The reason for this is due to the code below: static int shmem_mmap(struct file *file, struct vm_area_struct *vma) { struct shmem_inode_info *info = SHMEM_I(file_inode(file)); if (info->seals & F_SEAL_FUTURE_WRITE) { /* * New PROT_WRITE and MAP_SHARED mmaps are not allowed when * "future write" seal active. */ if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_WRITE)) return -EPERM; /* * Since the F_SEAL_FUTURE_WRITE seals allow for a MAP_SHARED * read-only mapping, take care to not allow mprotect to revert * protections. */ vma->vm_flags &= ~(VM_MAYWRITE); } ... } And for the mm to know if a mapping is copy-on-write: static inline bool is_cow_mapping(vm_flags_t flags) { return (flags & (VM_SHARED | VM_MAYWRITE)) == VM_MAYWRITE; } The patch fixes the issue by making the mprotect revert protection happen only for shared mappings. For private mappings, using mprotect will have no effect on the seal behavior. The F_SEAL_FUTURE_WRITE feature was introduced in v5.1 so v5.3.x stable kernels would need a backport. [akpm@linux-foundation.org: reflow comment, per Christoph] Link: http://lkml.kernel.org/r/20191107195355.80608-1-joel@joelfernandes.org Fixes: ab3948f58ff84 ("mm/memfd: add an F_SEAL_FUTURE_WRITE seal to memfd") Signed-off-by: Nicolas Geoffray Signed-off-by: Joel Fernandes (Google) Cc: Hugh Dickins Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 91298f1a302dad0f0f630413c812818636faa8a0 Author: Ingo Molnar Date: Sun Dec 1 15:49:47 2019 +0100 x86/mm/pat: Fix off-by-one bugs in interval tree search There's a bug in the new PAT code, the conversion of memtype_check_conflict() is buggy: 8d04a5f97a5f: ("x86/mm/pat: Convert the PAT tree to a generic interval tree") dprintk("Overlap at 0x%Lx-0x%Lx\n", match->start, match->end); found_type = match->type; - node = rb_next(&match->rb); - while (node) { - match = rb_entry(node, struct memtype, rb); - - if (match->start >= end) /* Checked all possible matches */ - goto success; - - if (is_node_overlap(match, start, end) && - match->type != found_type) { + match = memtype_interval_iter_next(match, start, end); + while (match) { + if (match->type != found_type) goto failure; - } - node = rb_next(&match->rb); + match = memtype_interval_iter_next(match, start, end); } Note how the '>= end' condition to end the interval check, got converted into: + match = memtype_interval_iter_next(match, start, end); This is subtly off by one, because the interval trees interfaces require closed interval parameters: include/linux/interval_tree_generic.h /* \ * Iterate over intervals intersecting [start;last] \ * \ * Note that a node's interval intersects [start;last] iff: \ * Cond1: ITSTART(node) <= last \ * and \ * Cond2: start <= ITLAST(node) \ */ \ ... if (ITSTART(node) <= last) { /* Cond1 */ \ if (start <= ITLAST(node)) /* Cond2 */ \ return node; /* node is leftmost match */ \ [start;last] is a closed interval (note that '<= last' check) - while the PAT 'end' parameter is 1 byte beyond the end of the range, because ioremap() and the other mapping APIs usually use the [start,end) half-open interval, derived from 'size'. This is what ioremap() does for example: /* * Mappings have to be page-aligned */ offset = phys_addr & ~PAGE_MASK; phys_addr &= PHYSICAL_PAGE_MASK; size = PAGE_ALIGN(last_addr+1) - phys_addr; retval = reserve_memtype(phys_addr, (u64)phys_addr + size, pcm, &new_pcm); phys_addr+size will be on a page boundary, after the last byte of the mapped interval. So the correct parameter to use in the interval tree searches is not 'end' but 'end-1'. This could have relevance if conflicting PAT ranges are exactly adjacent, for example a future WC region is followed immediately by an already mapped UC- region - in this case memtype_check_conflict() would incorrectly deny the WC memtype region and downgrade the memtype to UC-. BTW., rather annoyingly this downgrading is done silently in memtype_check_insert(): int memtype_check_insert(struct memtype *new, enum page_cache_mode *ret_type) { int err = 0; err = memtype_check_conflict(new->start, new->end, new->type, ret_type); if (err) return err; if (ret_type) new->type = *ret_type; memtype_interval_insert(new, &memtype_rbroot); return 0; } So on such a conflict we'd just silently get UC- in *ret_type, and write it into the new region, never the wiser ... So assuming that the patch below fixes the primary bug the diagnostics side of ioremap() cache attribute downgrades would be another thing to fix. Anyway, I checked all the interval-tree iterations, and most of them are off by one - but I think the one related to memtype_check_conflict() is the one causing this particular performance regression. The only correct interval-tree searches were these two: arch/x86/mm/pat_interval.c: match = memtype_interval_iter_first(&memtype_rbroot, 0, ULONG_MAX); arch/x86/mm/pat_interval.c: match = memtype_interval_iter_next(match, 0, ULONG_MAX); The ULONG_MAX was hiding the off-by-one in plain sight. :-) Note that the bug was probably benign in the sense of implementing a too strict cache attribute conflict policy and downgrading cache attributes, so AFAICS the worst outcome of this bug would be a performance regression, not any instabilities. Reported-by: kernel test robot Reported-by: Kenneth R. Crudup Reported-by: Mariusz Ceier Tested-by: Mariusz Ceier Tested-by: Kenneth R. Crudup Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Dave Hansen Cc: Davidlohr Bueso Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Rik van Riel Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191201144947.GA4167@gmail.com Signed-off-by: Ingo Molnar commit e1608f3fa857b600045b6df7f7dadc70eeaa4496 Author: Daniel Borkmann Date: Fri Nov 29 23:29:11 2019 +0100 bpf: Avoid setting bpf insns pages read-only when prog is jited For the case where the interpreter is compiled out or when the prog is jited it is completely unnecessary to set the BPF insn pages as read-only. In fact, on frequent churn of BPF programs, it could lead to performance degradation of the system over time since it would break the direct map down to 4k pages when calling set_memory_ro() for the insn buffer on x86-64 / arm64 and there is no reverse operation. Thus, avoid breaking up large pages for data maps, and only limit this to the module range used by the JIT where it is necessary to set the image read-only and executable. Suggested-by: Peter Zijlstra Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191129222911.3710-1-daniel@iogearbox.net commit 36bb9778fd11173f2dd1484e4f6797365e18c1d8 Author: Jonathan Corbet Date: Sun Dec 1 08:45:54 2019 -0700 docs: remove a bunch of stray CRs A pair of documentation patches introduced a bunch of unwanted carriage-return characters into the docs. Remove them, and chase away the ghost of DOS for another day. Fixes: a016e092940f ("docs: admin-guide: dell_rbu: Improve formatting and spelling") Fixes: bdd68860a044 ("Documentation: networking: device drivers: Remove stray asterisks") Signed-off-by: Jonathan Corbet commit 625110b5e9dae9074d8a7e67dd07f821a053eed7 Author: Thomas Hellstrom Date: Sat Nov 30 17:51:32 2019 -0800 mm/memory.c: fix a huge pud insertion race during faulting A huge pud page can theoretically be faulted in racing with pmd_alloc() in __handle_mm_fault(). That will lead to pmd_alloc() returning an invalid pmd pointer. Fix this by adding a pud_trans_unstable() function similar to pmd_trans_unstable() and check whether the pud is really stable before using the pmd pointer. Race: Thread 1: Thread 2: Comment create_huge_pud() Fallback - not taken. create_huge_pud() Taken. pmd_alloc() Returns an invalid pointer. This will result in user-visible huge page data corruption. Note that this was caught during a code audit rather than a real experienced problem. It looks to me like the only implementation that currently creates huge pud pagetable entries is dev_dax_huge_fault() which doesn't appear to care much about private (COW) mappings or write-tracking which is, I believe, a prerequisite for create_huge_pud() falling back on thread 1, but not in thread 2. Link: http://lkml.kernel.org/r/20191115115808.21181-2-thomas_os@shipmail.org Fixes: a00cc7d9dd93 ("mm, x86: add support for PUD-sized transparent hugepages") Signed-off-by: Thomas Hellstrom Acked-by: Kirill A. Shutemov Cc: Arnd Bergmann Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bf1a12a8095615c9486f5463ca473d2d69ff6952 Author: Thomas Hellstrom Date: Sat Nov 30 17:51:29 2019 -0800 mm: move the backup x_devmap() functions to asm-generic/pgtable.h The asm-generic/pgtable.h include file appears to be the correct place for the backup x_devmap() inline functions. Moving them here is also necessary if we want to include x_devmap() in the [pmd|pud]_unstable functions. So move the x_devmap() functions to asm-generic/pgtable.h Link: http://lkml.kernel.org/r/20191115115808.21181-1-thomas_os@shipmail.org Signed-off-by: Thomas Hellstrom Cc: Arnd Bergmann Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 30c46382855e0e1b8a5c21331076feb190524546 Author: Yang Shi Date: Sat Nov 30 17:51:26 2019 -0800 mm/rmap.c: use VM_BUG_ON_PAGE() in __page_check_anon_rmap() The __page_check_anon_rmap() just calls two BUG_ON()s protected by CONFIG_DEBUG_VM, the #ifdef could be eliminated by using VM_BUG_ON_PAGE(). Link: http://lkml.kernel.org/r/1573157346-111316-1-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Acked-by: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 091e4299544f8658a4b10815da9e4e603e070121 Author: Miles Chen Date: Sat Nov 30 17:51:23 2019 -0800 mm/rmap.c: fix outdated comment in page_get_anon_vma() Replace DESTROY_BY_RCU with SLAB_TYPESAFE_BY_RCU because SLAB_DESTROY_BY_RCU has been renamed to SLAB_TYPESAFE_BY_RCU by commit 5f0d5a3ae7cf ("mm: Rename SLAB_DESTROY_BY_RCU to SLAB_TYPESAFE_BY_RCU") Link: http://lkml.kernel.org/r/20191017093554.22562-1-miles.chen@mediatek.com Signed-off-by: Miles Chen Cc: Paul E. McKenney Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f2400abc782dc38a1fee9cfc13589d31f1a0404f Author: Vineet Gupta Date: Sat Nov 30 17:51:20 2019 -0800 asm-generic/mm: stub out p{4,u}d_clear_bad() if __PAGETABLE_P{4,U}D_FOLDED This came up when removing __ARCH_HAS_5LEVEL_HACK for ARC as code bloat. With this patch we see the following code reduction. | bloat-o-meter2 vmlinux-D-elide-p4d_free_tlb vmlinux-E-elide-p?d_clear_bad | add/remove: 0/2 grow/shrink: 0/0 up/down: 0/-40 (-40) | function old new delta | pud_clear_bad 20 - -20 | p4d_clear_bad 20 - -20 | Total: Before=4136930, After=4136890, chg -1.000000% Link: http://lkml.kernel.org/r/20191016162400.14796-6-vgupta@synopsys.com Signed-off-by: Vineet Gupta Acked-by: Kirill A. Shutemov Cc: Arnd Bergmann Cc: Will Deacon Cc: "Aneesh Kumar K . V" Cc: Nick Piggin Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3d14f1110a5c015e816e8e78ccec6b5c90d2d44e Author: Vineet Gupta Date: Sat Nov 30 17:51:16 2019 -0800 asm-generic/tlb: stub out pmd_free_tlb() if nopmd This came up when removing __ARCH_HAS_5LEVEL_HACK for ARC as code bloat. With this patch we see the following code reduction. | bloat-o-meter2 vmlinux-E-elide-p?d_clear_bad vmlinux-F-elide-pmd_free_tlb | add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-112 (-112) | function old new delta | free_pgd_range 422 310 -112 | Total: Before=4137042, After=4136930, chg -1.000000% Note that pmd folding can be tricky: In 2-level setup (where pmd is conceptually folded) most pmd routines are valid and refer to upper levels. In this patch we can, but see next patch for example where we can't Link: http://lkml.kernel.org/r/20191016162400.14796-5-vgupta@synopsys.com Signed-off-by: Vineet Gupta Acked-by: Kirill A. Shutemov Cc: "Aneesh Kumar K . V" Cc: Arnd Bergmann Cc: Nick Piggin Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bffd9723477a8459eb7cbdd7f1a82fde83df46e6 Author: Vineet Gupta Date: Sat Nov 30 17:51:13 2019 -0800 asm-generic/tlb: stub out p4d_free_tlb() if nop4d ... ... independent of __ARCH_HAS_5LEVEL_HACK This came up when removing __ARCH_HAS_5LEVEL_HACK for ARC as code bloat. With this patch we see the following code reduction | bloat-o-meter2 vmlinux-C-elide-pud_free_tlb vmlinux-D-elide-p4d_free_tlb | add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-104 (-104) | function old new delta | free_pgd_range 552 422 -130 | Total: Before=4137172, After=4137042, chg -1.000000% Link: http://lkml.kernel.org/r/20191016162400.14796-4-vgupta@synopsys.com Signed-off-by: Vineet Gupta Acked-by: Kirill A. Shutemov Acked-by: Linus Torvalds Cc: "Aneesh Kumar K . V" Cc: Arnd Bergmann Cc: Nick Piggin Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b08861d10bbeaae4d592d5cc00b2420e2e7ba3ac Author: Vineet Gupta Date: Sat Nov 30 17:51:10 2019 -0800 asm-generic/tlb: stub out pud_free_tlb() if nopud ... ... independent of __ARCH_HAS_4LEVEL_HACK This came up when removing __ARCH_HAS_5LEVEL_HACK for ARC as code bloat. With this patch we see the following code reduction | bloat-o-meter2 vmlinux-B-elide-ARCH_USE_5LEVEL_HACK vmlinux-C-elide-pud_free_tlb | add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-104 (-104) | function old new delta | free_pgd_range 656 552 -104 | Total: Before=4137276, After=4137172, chg -1.000000% Note: The primary change is alternate defintion for pud_free_tlb() but while there also removed empty stubs for __pud_free_tlb, which is anyhow called only from pud_free_tlb() Link: http://lkml.kernel.org/r/20191016162400.14796-3-vgupta@synopsys.com Signed-off-by: Vineet Gupta Acked-by: Kirill A. Shutemov Acked-by: Linus Torvalds Cc: "Aneesh Kumar K . V" Cc: Arnd Bergmann Cc: Nick Piggin Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6aae3425aa9ca776e8201a93494a4a482353d2c3 Author: Vineet Gupta Date: Sat Nov 30 17:51:06 2019 -0800 ARC: mm: remove __ARCH_USE_5LEVEL_HACK Patch series "elide extraneous generated code for folded p4d/pud/pmd", v3. This series came out of seemingly benign excursion into understanding/removing __ARCH_USE_5LEVEL_HACK from ARC port showing some extraneous code being generated despite folded p4d/pud/pmd | bloat-o-meter2 vmlinux-[AB]* | add/remove: 0/0 grow/shrink: 3/0 up/down: 130/0 (130) | function old new delta | free_pgd_range 548 660 +112 | p4d_clear_bad 2 20 +18 The patches here address that | bloat-o-meter2 vmlinux-[BF]* | add/remove: 0/2 grow/shrink: 0/1 up/down: 0/-386 (-386) | function old new delta | pud_clear_bad 20 - -20 | p4d_clear_bad 20 - -20 | free_pgd_range 660 314 -346 The code savings are not a whole lot, but still worthwhile IMHO. This patch (of 5): With paging code made 5-level compliant, this is no longer needed. ARC has software page walker with 2 lookup levels (pgd -> pte) This was expected to be non functional change but ended with slight code bloat due to needless inclusions of p*d_free_tlb() macros which will be addressed in further patches. | bloat-o-meter2 vmlinux-[AB]* | add/remove: 0/0 grow/shrink: 2/0 up/down: 128/0 (128) | function old new delta | free_pgd_range 546 656 +110 | p4d_clear_bad 2 20 +18 | Total: Before=4137148, After=4137276, chg 0.000000% Link: http://lkml.kernel.org/r/20191016162400.14796-2-vgupta@synopsys.com Signed-off-by: Vineet Gupta Acked-by: Kirill A. Shutemov Cc: "Aneesh Kumar K . V" Cc: Arnd Bergmann Cc: Nick Piggin Cc: Peter Zijlstra Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ff68dac6d65cd1347dad5d780dd8c90f29dc1b0b Author: Gaowei Pu Date: Sat Nov 30 17:51:03 2019 -0800 mm/mmap.c: use IS_ERR_VALUE to check return value of get_unmapped_area get_unmapped_area() returns an address or -errno on failure. Historically we have checked for the failure by offset_in_page() which is correct but quite hard to read. Newer code started using IS_ERR_VALUE which is much easier to read. Convert remaining users of offset_in_page as well. [mhocko@suse.com: rewrite changelog] [mhocko@kernel.org: fix mremap.c and uprobes.c sites also] Link: http://lkml.kernel.org/r/20191012102512.28051-1-pugaowei@gmail.com Signed-off-by: Gaowei Pu Reviewed-by: Andrew Morton Acked-by: Michal Hocko Cc: Vlastimil Babka Cc: Wei Yang Cc: Konstantin Khlebnikov Cc: Kirill A. Shutemov Cc: "Jérôme Glisse" Cc: Mike Kravetz Cc: Rik van Riel Cc: Qian Cai Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4e4a9eb921332b9d1edd99f76998f99f36b195f7 Author: Wei Yang Date: Sat Nov 30 17:50:59 2019 -0800 mm/rmap.c: reuse mergeable anon_vma as parent when fork In __anon_vma_prepare(), we will try to find anon_vma if it is possible to reuse it. While on fork, the logic is different. Since commit 5beb49305251 ("mm: change anon_vma linking to fix multi-process server scalability issue"), function anon_vma_clone() tries to allocate new anon_vma for child process. But the logic here will allocate a new anon_vma for each vma, even in parent this vma is mergeable and share the same anon_vma with its sibling. This may do better for scalability issue, while it is not necessary to do so especially after interval tree is used. Commit 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy") tries to reuse some anon_vma by counting child anon_vma and attached vmas. While for those mergeable anon_vmas, we can just reuse it and not necessary to go through the logic. After this change, kernel build test reduces 20% anon_vma allocation. Do the same kernel build test, it shows run time in sys reduced 11.6%. Origin: real 2m50.467s user 17m52.002s sys 1m51.953s real 2m48.662s user 17m55.464s sys 1m50.553s real 2m51.143s user 17m59.687s sys 1m53.600s Patched: real 2m39.933s user 17m1.835s sys 1m38.802s real 2m39.321s user 17m1.634s sys 1m39.206s real 2m39.575s user 17m1.420s sys 1m38.845s Link: http://lkml.kernel.org/r/20191011072256.16275-2-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Acked-by: Konstantin Khlebnikov Cc: Kirill A. Shutemov Cc: "Jérôme Glisse" Cc: Mike Kravetz Cc: Rik van Riel Cc: Qian Cai Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 47b390d23bf81894395c8773acf6f73c66465dc4 Author: Wei Yang Date: Sat Nov 30 17:50:56 2019 -0800 mm/rmap.c: don't reuse anon_vma if we just want a copy Before commit 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy"), anon_vma_clone() doesn't change dst->anon_vma. While after this commit, anon_vma_clone() will try to reuse an exist one on forking. But this commit go a little bit further for the case not forking. anon_vma_clone() is called from __vma_split(), __split_vma(), copy_vma() and anon_vma_fork(). For the first three places, the purpose here is get a copy of src and we don't expect to touch dst->anon_vma even it is NULL. While after that commit, it is possible to reuse an anon_vma when dst->anon_vma is NULL. This is not we intend to have. This patch stops reuse of anon_vma for non-fork cases. Link: http://lkml.kernel.org/r/20191011072256.16275-1-richardw.yang@linux.intel.com Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy") Signed-off-by: Wei Yang Acked-by: Konstantin Khlebnikov Cc: Kirill A. Shutemov Cc: "Jérôme Glisse" Cc: Mike Kravetz Cc: Rik van Riel Cc: Qian Cai Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aba6dfb75fe15650991442efd137c32fbf2e2b85 Author: Wei Yang Date: Sat Nov 30 17:50:53 2019 -0800 mm/mmap.c: rb_parent is not necessary in __vma_link_list() Now we use rb_parent to get next, while this is not necessary. When prev is NULL, this means vma should be the first element in the list. Then next should be current first one (mm->mmap), no matter whether we have parent or not. After removing it, the code shows the beauty of symmetry. Link: http://lkml.kernel.org/r/20190813032656.16625-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Acked-by: Andrew Morton Cc: Mel Gorman Cc: Vlastimil Babka Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1b9fc5b24fa2e7c0e67778cda77ac231fb4bcac7 Author: Wei Yang Date: Sat Nov 30 17:50:49 2019 -0800 mm/mmap.c: extract __vma_unlink_list() as counterpart for __vma_link_list() Just make the code a little easier to read. Link: http://lkml.kernel.org/r/20191006012636.31521-3-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Cc: Christoph Hellwig Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Oscar Salvador Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9d81fbe09a5669acf28fccd4f51f00b43534a0c9 Author: Wei Yang Date: Sat Nov 30 17:50:46 2019 -0800 mm/mmap.c: __vma_unlink_prev() is not necessary now The third parameter of __vma_unlink_common() could differentiate these two types. __vma_unlink_prev() is not necessary now. Link: http://lkml.kernel.org/r/20191006012636.31521-2-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Cc: Christoph Hellwig Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Oscar Salvador Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 93b343ab2d2fc9a22767f6eeb95c78420bfedf4a Author: Wei Yang Date: Sat Nov 30 17:50:43 2019 -0800 mm/mmap.c: prev could be retrieved from vma->vm_prev Currently __vma_unlink_common handles two cases: * has_prev * or not When has_prev is false, it is obvious prev is calculated from vma->vm_prev in __vma_unlink_common. When has_prev is true, the prev is passed through from __vma_unlink_prev in __vma_adjust for non-case 8. And at the beginning next is calculated from vma->vm_next, which implies vma is next->vm_prev. The above statement sounds a little complicated, while to think in another point of view, no matter whether vma and next is swapped, the mmap link list still preserves its property. It is proper to access vma->vm_prev. Link: http://lkml.kernel.org/r/20191006012636.31521-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Cc: Mel Gorman Cc: Vlastimil Babka Cc: Oscar Salvador Cc: Christoph Hellwig Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eef1a429f234f8f50e89226705bb47d7d3f1b840 Author: Konstantin Khlebnikov Date: Sat Nov 30 17:50:40 2019 -0800 mm/swap.c: piggyback lru_add_drain_all() calls This is a very slow operation. Right now POSIX_FADV_DONTNEED is the top user because it has to freeze page references when removing it from the cache. invalidate_bdev() calls it for the same reason. Both are triggered from userspace, so it's easy to generate a storm. mlock/mlockall no longer calls lru_add_drain_all - I've seen here serious slowdown on older kernels. There are some less obvious paths in memory migration/CMA/offlining which shouldn't call frequently. The worst case requires a non-trivial workload because lru_add_drain_all() skips cpus where vectors are empty. Something must constantly generate a flow of pages for each cpu. Also cpus must be busy to make scheduling per-cpu works slower. And the machine must be big enough (64+ cpus in our case). In our case that was a massive series of mlock calls in map-reduce while other tasks write logs (and generates flows of new pages in per-cpu vectors). Mlock calls were serialized by mutex and accumulated latency up to 10 seconds or more. The kernel does not call lru_add_drain_all on mlock paths since 4.15, but the same scenario could be triggered by fadvise(POSIX_FADV_DONTNEED) or any other remaining user. There is no reason to do the drain again if somebody else already drained all the per-cpu vectors while we waited for the lock. Piggyback on a drain starting and finishing while we wait for the lock: all pages pending at the time of our entry were drained from the vectors. Callers like POSIX_FADV_DONTNEED retry their operations once after draining per-cpu vectors when pages have unexpected references. Link: http://lkml.kernel.org/r/157019456205.3142.3369423180908482020.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Andrew Morton Cc: Michal Hocko Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 408a60eddd206134fd306dfbc53bbde093b8deb0 Author: Wei Yang Date: Sat Nov 30 17:50:37 2019 -0800 mm/mmap.c: remove a never-triggered warning in __vma_adjust() The upper level of "if" makes sure (end >= next->vm_end), which means there are only two possibilities: 1) end == next->vm_end 2) end > next->vm_end remove_next is assigned to be (1 + end > next->vm_end). This means if remove_next is 1, end must equal to next->vm_end. The VM_WARN_ON will never trigger. Link: http://lkml.kernel.org/r/20190912063126.13250-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Reviewed-by: Andrew Morton Cc: Vlastimil Babka Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e4dcad204d3a281be6f8573e0a82648a4ad84e69 Author: Joel Fernandes (Google) Date: Sat Nov 30 17:50:33 2019 -0800 rss_stat: add support to detect RSS updates of external mm When a process updates the RSS of a different process, the rss_stat tracepoint appears in the context of the process doing the update. This can confuse userspace that the RSS of process doing the update is updated, while in reality a different process's RSS was updated. This issue happens in reclaim paths such as with direct reclaim or background reclaim. This patch adds more information to the tracepoint about whether the mm being updated belongs to the current process's context (curr field). We also include a hash of the mm pointer so that the process who the mm belongs to can be uniquely identified (mm_id field). Also vsprintf.c is refactored a bit to allow reuse of hashing code. [akpm@linux-foundation.org: remove unused local `str'] [joelaf@google.com: inline call to ptr_to_hashval] Link: http://lore.kernel.org/r/20191113153816.14b95acd@gandalf.local.home Link: http://lkml.kernel.org/r/20191114164622.GC233237@google.com Link: http://lkml.kernel.org/r/20191106024452.81923-1-joel@joelfernandes.org Signed-off-by: Joel Fernandes (Google) Reported-by: Ioannis Ilkos Acked-by: Petr Mladek [lib/vsprintf.c] Cc: Tim Murray Cc: Michal Hocko Cc: Carmen Jackson Cc: Mayank Gupta Cc: Daniel Colascione Cc: Steven Rostedt (VMware) Cc: Minchan Kim Cc: "Aneesh Kumar K.V" Cc: Dan Williams Cc: Jerome Glisse Cc: Matthew Wilcox Cc: Ralph Campbell Cc: Vlastimil Babka Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b3d1411b6726ea6930222f8f12587d89762477c6 Author: Joel Fernandes (Google) Date: Sat Nov 30 17:50:30 2019 -0800 mm: emit tracepoint when RSS changes Useful to track how RSS is changing per TGID to detect spikes in RSS and memory hogs. Several Android teams have been using this patch in various kernel trees for half a year now. Many reported to me it is really useful so I'm posting it upstream. Initial patch developed by Tim Murray. Changes I made from original patch: o Prevent any additional space consumed by mm_struct. Regarding the fact that the RSS may change too often thus flooding the traces - note that, there is some "hysterisis" with this already. That is - We update the counter only if we receive 64 page faults due to SPLIT_RSS_ACCOUNTING. However, during zapping or copying of pte range, the RSS is updated immediately which can become noisy/flooding. In a previous discussion, we agreed that BPF or ftrace can be used to rate limit the signal if this becomes an issue. Also note that I added wrappers to trace_rss_stat to prevent compiler errors where linux/mm.h is included from tracing code, causing errors such as: CC kernel/trace/power-traces.o In file included from ./include/trace/define_trace.h:102, from ./include/trace/events/kmem.h:342, from ./include/linux/mm.h:31, from ./include/linux/ring_buffer.h:5, from ./include/linux/trace_events.h:6, from ./include/trace/events/power.h:12, from kernel/trace/power-traces.c:15: ./include/trace/trace_events.h:113:22: error: field `ent' has incomplete type struct trace_entry ent; \ Link: http://lore.kernel.org/r/20190903200905.198642-1-joel@joelfernandes.org Link: http://lkml.kernel.org/r/20191001172817.234886-1-joel@joelfernandes.org Co-developed-by: Tim Murray Signed-off-by: Tim Murray Signed-off-by: Joel Fernandes (Google) Acked-by: Michal Hocko Cc: Carmen Jackson Cc: Mayank Gupta Cc: Daniel Colascione Cc: Steven Rostedt (VMware) Cc: Minchan Kim Cc: "Aneesh Kumar K.V" Cc: Dan Williams Cc: Jerome Glisse Cc: Matthew Wilcox Cc: Ralph Campbell Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8897c1b1a1795cab23d5ac13e4e23bf0b5f4e0c6 Author: Kirill A. Shutemov Date: Sat Nov 30 17:50:26 2019 -0800 shmem: pin the file in shmem_fault() if mmap_sem is dropped syzbot found the following crash: BUG: KASAN: use-after-free in perf_trace_lock_acquire+0x401/0x530 include/trace/events/lock.h:13 Read of size 8 at addr ffff8880a5cf2c50 by task syz-executor.0/26173 CPU: 0 PID: 26173 Comm: syz-executor.0 Not tainted 5.3.0-rc6 #146 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: perf_trace_lock_acquire+0x401/0x530 include/trace/events/lock.h:13 trace_lock_acquire include/trace/events/lock.h:13 [inline] lock_acquire+0x2de/0x410 kernel/locking/lockdep.c:4411 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] shmem_fault+0x5ec/0x7b0 mm/shmem.c:2034 __do_fault+0x111/0x540 mm/memory.c:3083 do_shared_fault mm/memory.c:3535 [inline] do_fault mm/memory.c:3613 [inline] handle_pte_fault mm/memory.c:3840 [inline] __handle_mm_fault+0x2adf/0x3f20 mm/memory.c:3964 handle_mm_fault+0x1b5/0x6b0 mm/memory.c:4001 do_user_addr_fault arch/x86/mm/fault.c:1441 [inline] __do_page_fault+0x536/0xdd0 arch/x86/mm/fault.c:1506 do_page_fault+0x38/0x590 arch/x86/mm/fault.c:1530 page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1202 It happens if the VMA got unmapped under us while we dropped mmap_sem and inode got freed. Pinning the file if we drop mmap_sem fixes the issue. Link: http://lkml.kernel.org/r/20190927083908.rhifa4mmaxefc24r@box Signed-off-by: Kirill A. Shutemov Reported-by: syzbot+03ee87124ee05af991bd@syzkaller.appspotmail.com Acked-by: Johannes Weiner Reviewed-by: Matthew Wilcox (Oracle) Cc: Hillf Danton Cc: Hugh Dickins Cc: Josef Bacik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 89b15332af7c0312a41e50846819ca6613b58b4c Author: Johannes Weiner Date: Sat Nov 30 17:50:22 2019 -0800 mm: drop mmap_sem before calling balance_dirty_pages() in write fault One of our services is observing hanging ps/top/etc under heavy write IO, and the task states show this is an mmap_sem priority inversion: A write fault is holding the mmap_sem in read-mode and waiting for (heavily cgroup-limited) IO in balance_dirty_pages(): balance_dirty_pages+0x724/0x905 balance_dirty_pages_ratelimited+0x254/0x390 fault_dirty_shared_page.isra.96+0x4a/0x90 do_wp_page+0x33e/0x400 __handle_mm_fault+0x6f0/0xfa0 handle_mm_fault+0xe4/0x200 __do_page_fault+0x22b/0x4a0 page_fault+0x45/0x50 Somebody tries to change the address space, contending for the mmap_sem in write-mode: call_rwsem_down_write_failed_killable+0x13/0x20 do_mprotect_pkey+0xa8/0x330 SyS_mprotect+0xf/0x20 do_syscall_64+0x5b/0x100 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 The waiting writer locks out all subsequent readers to avoid lock starvation, and several threads can be seen hanging like this: call_rwsem_down_read_failed+0x14/0x30 proc_pid_cmdline_read+0xa0/0x480 __vfs_read+0x23/0x140 vfs_read+0x87/0x130 SyS_read+0x42/0x90 do_syscall_64+0x5b/0x100 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 To fix this, do what we do for cache read faults already: drop the mmap_sem before calling into anything IO bound, in this case the balance_dirty_pages() function, and return VM_FAULT_RETRY. Link: http://lkml.kernel.org/r/20190924194238.GA29030@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Kirill A. Shutemov Cc: Josef Bacik Cc: Hillf Danton Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1603c8d1b1fbfbc20dcb363543b690de862849c0 Author: Chris Down Date: Sat Nov 30 17:50:19 2019 -0800 Documentation/admin-guide/cgroup-v2.rst: document why inactive_X + active_X may not equal X This has confused a significant number of people using cgroups inside Facebook, and some of those outside as well judging by posts like this[0] (although it's not a problem unique to cgroup v2). If shmem handling in particular becomes more coherent at some point in the future -- although that seems unlikely now -- we can change the wording here. [0]: https://unix.stackexchange.com/q/525092/10762 Link: http://lkml.kernel.org/r/20191111144958.GA11914@chrisdown.name Signed-off-by: Chris Down Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Tejun Heo Cc: Roman Gushchin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fa40d1ee9f156624658ca409a04a78882ca5b3c5 Author: Shakeel Butt Date: Sat Nov 30 17:50:16 2019 -0800 mm: vmscan: memcontrol: remove mem_cgroup_select_victim_node() Since commit 1ba6fc9af35b ("mm: vmscan: do not share cgroup iteration between reclaimers"), the memcg reclaim does not bail out earlier based on sc->nr_reclaimed and will traverse all the nodes. All the reclaimable pages of the memcg on all the nodes will be scanned relative to the reclaim priority. So, there is no need to maintain state regarding which node to start the memcg reclaim from. This patch effectively reverts the commit 889976dbcb12 ("memcg: reclaim memory from nodes in round-robin order") and commit 453a9bf347f1 ("memcg: fix numa scan information update to be triggered by memory event"). [shakeelb@google.com: v2] Link: http://lkml.kernel.org/r/20191030204232.139424-1-shakeelb@google.com Link: http://lkml.kernel.org/r/20191029234753.224143-1-shakeelb@google.com Signed-off-by: Shakeel Butt Acked-by: Roman Gushchin Acked-by: Michal Hocko Acked-by: Johannes Weiner Cc: Greg Thelen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 242c37b459ce9ea1be53b75bdb76a7d9268a0791 Author: Hao Lee Date: Sat Nov 30 17:50:12 2019 -0800 include/linux/memcontrol.h: fix comments based on per-node memcg These comments should be updated as memcg limit enforcement has been moved from zones to nodes. Link: http://lkml.kernel.org/r/20191022150618.GA15519@haolee.github.io Signed-off-by: Hao Lee Acked-by: Roman Gushchin Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8c8c383c04f6cbcda38e38b2430cb245da4d7e5a Author: Johannes Weiner Date: Sat Nov 30 17:50:09 2019 -0800 mm: memcontrol: try harder to set a new memory.high Setting a memory.high limit below the usage makes almost no effort to shrink the cgroup to the new target size. While memory.high is a "soft" limit that isn't supposed to cause OOM situations, we should still try harder to meet a user request through persistent reclaim. For example, after setting a 10M memory.high on an 800M cgroup full of file cache, the usage shrinks to about 350M: + cat /cgroup/workingset/memory.current 841568256 + echo 10M + cat /cgroup/workingset/memory.current 355729408 This isn't exactly what the user would expect to happen. Setting the value a few more times eventually whittles the usage down to what we are asking for: + echo 10M + cat /cgroup/workingset/memory.current 104181760 + echo 10M + cat /cgroup/workingset/memory.current 31801344 + echo 10M + cat /cgroup/workingset/memory.current 10440704 To improve this, add reclaim retry loops to the memory.high write() callback, similar to what we do for memory.max, to make a reasonable effort that the usage meets the requested size after the call returns. Afterwards, a single write() to memory.high is enough in all but extreme cases: + cat /cgroup/workingset/memory.current 841609216 + echo 10M + cat /cgroup/workingset/memory.current 10182656 790M is not a reasonable reclaim target to ask of a single reclaim invocation. And it wouldn't be reasonable to optimize the reclaim code for it. So asking for the full size but retrying is not a bad choice here: we express our intent, and benefit if reclaim becomes better at handling larger requests, but we also acknowledge that some of the deltas we can encounter in memory_high_write() are just too ridiculously big for a single reclaim invocation to manage. Link: http://lkml.kernel.org/r/20191022201518.341216-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Michal Hocko Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7249c9f01da30ae5cd1843a54a8fab9b35dd979d Author: Johannes Weiner Date: Sat Nov 30 17:50:06 2019 -0800 mm: memcontrol: remove dead code from memory_max_write() When the reclaim loop in memory_max_write() is ^C'd or similar, we set err to -EINTR. But we don't return err. Once the limit is set, we always return success (nbytes). Delete the dead code. Link: http://lkml.kernel.org/r/20191022201518.341216-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Michal Hocko Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9da83f3fc74b806ee419a29977ef0239454bd8ec Author: Yafang Shao Date: Sat Nov 30 17:50:03 2019 -0800 mm, memcg: clean up reclaim iter array The mem_cgroup_reclaim_cookie is only used in memcg softlimit reclaim now, and the priority of the reclaim is always 0. We don't need to define the iter in struct mem_cgroup_per_node as an array any more. That could make the code more clear and save some space. Link: http://lkml.kernel.org/r/1569897728-1686-1-git-send-email-laoar.shao@gmail.com Signed-off-by: Yafang Shao Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a1100a74065e6454fa06a0f7ac287daee4cc1bf6 Author: Fengguang Wu Date: Sat Nov 30 17:50:00 2019 -0800 mm/swap.c: trivial mark_page_accessed() cleanup This avoids duplicated PageReferenced() calls. No behavior change. Link: http://lkml.kernel.org/r/20191016225326.GB12497@wfg-t540p.sh.intel.com Signed-off-by: Fengguang Wu Reviewed-by: Andrew Morton Acked-by: Vlastimil Babka Cc: Dave Hansen Cc: Liu Jingqi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 12d2966d854bb0be1433032cedcb71b6b620bfc7 Author: Naohiro Aota Date: Sat Nov 30 17:49:56 2019 -0800 mm, swap: disallow swapon() on zoned block devices A zoned block device consists of a number of zones. Zones are either conventional and accepting random writes or sequential and requiring that writes be issued in LBA order from each zone write pointer position. For the write restriction, zoned block devices are not suitable for a swap device. Disallow swapon on them. [akpm@linux-foundation.org: reflow and reword comment, per Christoph] Link: http://lkml.kernel.org/r/20191015085814.637837-1-naohiro.aota@wdc.com Signed-off-by: Naohiro Aota Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Cc: "Theodore Y. Ts'o" Cc: Hannes Reinecke Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d2dfbe47fa0e9753f560b75cfcd4654e40ab903b Author: Liu Xiang Date: Sat Nov 30 17:49:53 2019 -0800 mm/gup.c: fix comments of __get_user_pages() and get_user_pages_remote() Fix comments of __get_user_pages() and get_user_pages_remote(), make them more clear. Link: http://lkml.kernel.org/r/1572443533-3118-1-git-send-email-liuxiang_1999@126.com Signed-off-by: Liu Xiang Suggested-by: John Hubbard Reviewed-by: David Hildenbrand Reviewed-by: John Hubbard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b96cc65515bb16f90a361c01da088ce09ad3cf92 Author: zhong jiang Date: Sat Nov 30 17:49:50 2019 -0800 mm/gup.c: allow CMA migration to propagate errors back to caller check_and_migrate_cma_pages() was recording the result of __get_user_pages_locked() in an unsigned "nr_pages" variable. Because __get_user_pages_locked() returns a signed value that can include negative errno values, this had the effect of hiding errors. Change check_and_migrate_cma_pages() implementation so that it uses a signed variable instead, and propagates the results back to the caller just as other gup internal functions do. This was discovered with the help of unsigned_lesser_than_zero.cocci. Link: http://lkml.kernel.org/r/1571671030-58029-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Suggested-by: John Hubbard Acked-by: Vlastimil Babka Reviewed-by: John Hubbard Reviewed-by: Ira Weiny Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9266a14033a81b3096feccd10542c20b3f47fe8e Author: Konstantin Khlebnikov Date: Sat Nov 30 17:49:47 2019 -0800 mm/filemap.c: warn if stale pagecache is left after direct write generic_file_direct_write() tries to invalidate pagecache after O_DIRECT write. Unlike to similar code in dio_complete() this silently ignores error returned from invalidate_inode_pages2_range(). According to comment this code here because not all filesystems call dio_complete() to do proper invalidation after O_DIRECT write. Noticeable example is a blkdev_direct_IO(). This patch calls dio_warn_stale_pagecache() if invalidation fails. Link: http://lkml.kernel.org/r/157270038294.4812.2238891109785106069.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Andrew Morton Reviewed-by: Jan Kara Cc: Jens Axboe Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a92853b6746fe5ffef20a7c30addf6320561e669 Author: Konstantin Khlebnikov Date: Sat Nov 30 17:49:44 2019 -0800 fs/direct-io.c: keep dio_warn_stale_pagecache() when CONFIG_BLOCK=n This helper prints warning if direct I/O write failed to invalidate cache, and set EIO at inode to warn usersapce about possible data corruption. See also commit 5a9d929d6e13 ("iomap: report collisions between directio and buffered writes to userspace"). Direct I/O is supported by non-disk filesystems, for example NFS. Thus generic code needs this even in kernel without CONFIG_BLOCK. Link: http://lkml.kernel.org/r/157270038074.4812.7980855544557488880.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Andrew Morton Reviewed-by: Jan Kara Cc: Jens Axboe Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 80c1fe902691d3ef4786f9e62e47a0aa0deb8b54 Author: Konstantin Khlebnikov Date: Sat Nov 30 17:49:41 2019 -0800 mm/filemap.c: remove redundant cache invalidation after async direct-io write generic_file_direct_write() invalidates cache at entry. Second time this should be done when request completes. But this function calls second invalidation at exit unconditionally even for async requests. This patch skips second invalidation for async requests (-EIOCBQUEUED). Link: http://lkml.kernel.org/r/157270037850.4812.15036239021726025572.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Andrew Morton Reviewed-by: Jan Kara Cc: Jens Axboe Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dd98afd4d606a674809b6f9fc44c22347457b9fa Author: Yu Zhao Date: Sat Nov 30 17:49:37 2019 -0800 mm/slub.c: clean up validate_slab() The function doesn't need to return any value, and the check can be done in one pass. There is a behavior change: before the patch, we stop at the first invalid free object; after the patch, we stop at the first invalid object, free or in use. This shouldn't matter because the original behavior isn't intended anyway. Link: http://lkml.kernel.org/r/20191108193958.205102-1-yuzhao@google.com Signed-off-by: Yu Zhao Acked-by: Kirill A. Shutemov Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Tetsuo Handa Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aed6814894323cc059224fec47841bf7b0d94774 Author: Yu Zhao Date: Sat Nov 30 17:49:34 2019 -0800 mm/slub.c: update comments Slub doesn't use PG_active and PG_error anymore. Link: http://lkml.kernel.org/r/20191007222023.162256-1-yuzhao@google.com Signed-off-by: Yu Zhao Reviewed-by: Andrew Morton Acked-by: David Rientjes Cc: Christoph Lameter Cc: Pekka Enberg Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e1b70dd1e6429f82675c5dbcc3044f92c6ef05d6 Author: Miles Chen Date: Sat Nov 30 17:49:31 2019 -0800 mm: slub: print the offset of fault addresses With commit ad67b74d2469 ("printk: hash addresses printed with %p"), it is a little bit harder to match the fault addresses printed by check_bytes_and_report() or slab_pad_check() in the dump because the fault addresses may not show up in the dump. Print the offset of the fault addresses to make it easier to match the incorrect poison or padding values in the dump. Before: We have to search the "63" in the dump. If we want to get the offset of 63, we have to count it from the start of Object dump. ============================================================= BUG kmalloc-128 (Not tainted): Poison overwritten ------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: 0x00000000570da294-0x00000000570da294. First byte 0x63 instead of 0x6b ... INFO: Object 0x000000006ebb3b9e @offset=14208 fp=0x0000000065862488 Redzone 00000000a6abccff: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 00000000741c16f0: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 0000000061ad278f: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 000000000467c1bd: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 000000008812766b: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 000000003d9b8f25: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 0000000000d80c33: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 00000000867b0d90: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Object 000000006ebb3b9e: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 000000005ea59a9f: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 000000003ef8bddc: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 000000008190375d: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 000000006df7fb32: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 0000000069474eae: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 0000000008073b7d: 6b 6b 6b 6b 63 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 00000000b45ae74d: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 After: We know the fault address is at @offset=1508, and the Object is at @offset=1408, so we know the fault address is at offset=100 within the object. ========================================================= BUG kmalloc-128 (Not tainted): Poison overwritten --------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: 0x00000000638ec1d1-0x00000000638ec1d1 @offset=1508. First byte 0x63 instead of 0x6b ... INFO: Object 0x000000008171818d @offset=1408 fp=0x0000000066dae230 Redzone 00000000e2697ab6: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 0000000064b6a381: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 00000000e413a234: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 0000000004c1dfeb: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 000000009ad24d42: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 000000002a196a23: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 00000000a7b8468a: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Redzone 0000000088db6da3: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb Object 000000008171818d: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 000000007c4035d4: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 000000004dd281a4: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 0000000079121dff: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 00000000756682a9: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 0000000053b7e541: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 0000000091f8d530: 6b 6b 6b 6b 63 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b Object 000000009c76035c: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 Link: http://lkml.kernel.org/r/20190925140807.20490-1-miles.chen@mediatek.com Signed-off-by: Miles Chen Reviewed-by: Andrew Morton Cc: Christoph Lameter Cc: Matthew Wilcox Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 13657d0ad90c2cbcfc6fd8d48ca52432004a8f9b Author: Pengfei Li Date: Sat Nov 30 17:49:28 2019 -0800 mm, slab_common: use enum kmalloc_cache_type to iterate over kmalloc caches The type of local variable *type* of new_kmalloc_cache() should be enum kmalloc_cache_type instead of int, so correct it. Link: http://lkml.kernel.org/r/1569241648-26908-4-git-send-email-lpf.vector@gmail.com Signed-off-by: Pengfei Li Acked-by: Vlastimil Babka Acked-by: Roman Gushchin Acked-by: David Rientjes Cc: Christoph Lameter Cc: Joonsoo Kim Cc: Pekka Enberg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dc0a7f7558dd52e972408ebb535b0153c06d08c2 Author: Pengfei Li Date: Sat Nov 30 17:49:25 2019 -0800 mm, slab: remove unused kmalloc_size() The size of kmalloc can be obtained from kmalloc_info[], so remove kmalloc_size() that will not be used anymore. Link: http://lkml.kernel.org/r/1569241648-26908-3-git-send-email-lpf.vector@gmail.com Signed-off-by: Pengfei Li Acked-by: Vlastimil Babka Acked-by: Roman Gushchin Acked-by: David Rientjes Cc: Christoph Lameter Cc: Joonsoo Kim Cc: Pekka Enberg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb5d9fb38c3434ab6276bac500dfffe78649400b Author: Pengfei Li Date: Sat Nov 30 17:49:21 2019 -0800 mm, slab: make kmalloc_info[] contain all types of names Patch series "mm, slab: Make kmalloc_info[] contain all types of names", v6. There are three types of kmalloc, KMALLOC_NORMAL, KMALLOC_RECLAIM and KMALLOC_DMA. The name of KMALLOC_NORMAL is contained in kmalloc_info[].name, but the names of KMALLOC_RECLAIM and KMALLOC_DMA are dynamically generated by kmalloc_cache_name(). Patch1 predefines the names of all types of kmalloc to save the time spent dynamically generating names. These changes make sense, and the time spent by new_kmalloc_cache() has been reduced by approximately 36.3%. Time spent by new_kmalloc_cache() (CPU cycles) 5.3-rc7 66264 5.3-rc7+patch 42188 This patch (of 3): There are three types of kmalloc, KMALLOC_NORMAL, KMALLOC_RECLAIM and KMALLOC_DMA. The name of KMALLOC_NORMAL is contained in kmalloc_info[].name, but the names of KMALLOC_RECLAIM and KMALLOC_DMA are dynamically generated by kmalloc_cache_name(). This patch predefines the names of all types of kmalloc to save the time spent dynamically generating names. Besides, remove the kmalloc_cache_name() that is no longer used. Link: http://lkml.kernel.org/r/1569241648-26908-2-git-send-email-lpf.vector@gmail.com Signed-off-by: Pengfei Li Acked-by: Vlastimil Babka Acked-by: Roman Gushchin Acked-by: David Rientjes Cc: Christoph Lameter Cc: Pekka Enberg Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2b211dc04cb7fa4a8f591c7f8f4ba5243d8733d9 Author: Ben Dooks Date: Sat Nov 30 17:49:18 2019 -0800 fs/buffer.c: include internal.h for missing declarations The declarations of __block_write_begin_int and guard_bio_eod are needed from internal.h so include it to fix the following sparse warnings: fs/buffer.c:1930:5: warning: symbol '__block_write_begin_int' was not declared. Should it be static? fs/buffer.c:2994:6: warning: symbol 'guard_bio_eod' was not declared. Should it be static? Link: http://lkml.kernel.org/r/20191011170039.16100-1-ben.dooks@codethink.co.uk Signed-off-by: Ben Dooks Reviewed-by: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1d706679733634fc32a308f2201e6765b0c63c74 Author: Saurav Girepunje Date: Sat Nov 30 17:49:15 2019 -0800 fs/buffer.c: fix use true/false for bool type Use true/false for bool return type of has_bh_in_lru(). Link: http://lkml.kernel.org/r/20191029040529.GA7625@saurav Signed-off-by: Saurav Girepunje Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 188c523e1c271d537f3c9f55b6b65bf4476de32f Author: Ding Xiang Date: Sat Nov 30 17:49:12 2019 -0800 ocfs2: fix passing zero to 'PTR_ERR' warning Fix a static code checker warning: fs/ocfs2/acl.c:331 ocfs2_acl_chmod() warn: passing zero to 'PTR_ERR' Link: http://lkml.kernel.org/r/1dee278b-6c96-eec2-ce76-fe6e07c6e20f@linux.alibaba.com Fixes: 5ee0fbd50fd ("ocfs2: revert using ocfs2_acl_chmod to avoid inode cluster lock hang") Signed-off-by: Ding Xiang Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2d216b2318a7a825177579ae27ac77b87959477f Author: Colin Ian King Date: Sat Nov 30 17:49:08 2019 -0800 scripts/spelling.txt: add more spellings to spelling.txt Here are some of the more common spelling mistakes and typos that I've found while fixing up spelling mistakes in the kernel since July 2019. Link: http://lkml.kernel.org/r/20191112092142.97989-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2115fbf7210bd053ba55a95e7ebc366df41aa9cf Author: Heiko Carstens Date: Mon Nov 18 13:59:25 2019 +0100 s390: remove compat vdso code Remove compat vdso code, since there is hardly any compat user space left. Still existing compat user space will have to use system calls instead. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit d21b7e6b985c15ff75e8668b0282ec5104391901 Author: Masahiro Yamada Date: Sun Dec 1 16:08:46 2019 +0900 MAINTAINERS: update Kbuild/Kconfig maintainer's email address Signed-off-by: Masahiro Yamada commit c6c6bc6ea9fce31baaca053befc31215cfcb3dd9 Author: Richard Zhu Date: Wed Oct 9 16:07:21 2019 +0800 mailbox: imx: add support for imx v1 mu There is a version 1.0 MU on i.MX7ULP platform. One new version ID register is added, and it's offset is 0. TRn registers are defined at the offset 0x20 ~ 0x2C. RRn registers are defined at the offset 0x40 ~ 0x4C. SR/CR registers are defined at 0x60/0x64. Extend this driver to support it. Signed-off-by: Richard Zhu Suggested-by: Oleksij Rempel Reviewed-by: Dong Aisheng Reviewed-by: Oleksij Rempel Reviewed-by: Daniel Baluta Signed-off-by: Jassi Brar commit 58340e7d779ef849efaca664a50f225a53b27a2c Author: Richard Zhu Date: Wed Oct 9 16:07:20 2019 +0800 dt-bindings: mailbox: imx-mu: add imx7ulp MU support There is a version 1.0 MU on imx7ulp, use "fsl,imx7ulp-mu" compatible to support it. Signed-off-by: Richard Zhu Reviewed-by: Dong Aisheng Signed-off-by: Jassi Brar commit 5f0af07e89199ac51cdd4f25bc303bdc703f4e9c Author: Daniel Baluta Date: Wed Oct 9 16:07:19 2019 +0800 mailbox: imx: Clear the right interrupts at shutdown Make sure to only clear enabled interrupts keeping count of the connection type. Suggested-by: Oleksij Rempel Signed-off-by: Daniel Baluta Signed-off-by: Richard Zhu Reviewed-by: Dong Aisheng Signed-off-by: Jassi Brar commit bf159d151a0b844be28882f39e316b5800acaa2b Author: Daniel Baluta Date: Wed Oct 9 16:07:18 2019 +0800 mailbox: imx: Fix Tx doorbell shutdown path Tx doorbell is handled by txdb_tasklet and doesn't have an associated IRQ. Anyhow, imx_mu_shutdown ignores this and tries to free an IRQ that wasn't requested for Tx DB resulting in the following warning: [ 1.967644] Trying to free already-free IRQ 26 [ 1.972108] WARNING: CPU: 2 PID: 157 at kernel/irq/manage.c:1708 __free_irq+0xc0/0x358 [ 1.980024] Modules linked in: [ 1.983088] CPU: 2 PID: 157 Comm: kworker/2:1 Tainted: G [ 1.993524] Hardware name: Freescale i.MX8QXP MEK (DT) [ 1.998668] Workqueue: events deferred_probe_work_func [ 2.003812] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 2.008607] pc : __free_irq+0xc0/0x358 [ 2.012364] lr : __free_irq+0xc0/0x358 [ 2.016111] sp : ffff00001179b7e0 [ 2.019422] x29: ffff00001179b7e0 x28: 0000000000000018 [ 2.024736] x27: ffff000011233000 x26: 0000000000000004 [ 2.030053] x25: 000000000000001a x24: ffff80083bec74d4 [ 2.035369] x23: 0000000000000000 x22: ffff80083bec7588 [ 2.040686] x21: ffff80083b1fe8d8 x20: ffff80083bec7400 [ 2.046003] x19: 0000000000000000 x18: ffffffffffffffff [ 2.051320] x17: 0000000000000000 x16: 0000000000000000 [ 2.056637] x15: ffff0000111296c8 x14: ffff00009179b517 [ 2.061953] x13: ffff00001179b525 x12: ffff000011142000 [ 2.067270] x11: ffff000011129f20 x10: ffff0000105da970 [ 2.072587] x9 : 00000000ffffffd0 x8 : 0000000000000194 [ 2.077903] x7 : 612065657266206f x6 : ffff0000111e7b09 [ 2.083220] x5 : 0000000000000003 x4 : 0000000000000000 [ 2.088537] x3 : 0000000000000000 x2 : 00000000ffffffff [ 2.093854] x1 : 28b70f0a2b60a500 x0 : 0000000000000000 [ 2.099173] Call trace: [ 2.101618] __free_irq+0xc0/0x358 [ 2.105021] free_irq+0x38/0x98 [ 2.108170] imx_mu_shutdown+0x90/0xb0 [ 2.111921] mbox_free_channel.part.2+0x24/0xb8 [ 2.116453] mbox_free_channel+0x18/0x28 This bug is present from the beginning of times. Cc: Oleksij Rempel Signed-off-by: Daniel Baluta Signed-off-by: Richard Zhu Reviewed-by: Dong Aisheng Signed-off-by: Jassi Brar commit 69269446ccbf2b44fd2595ecfa57e29fb656788d Author: Fabien Dessenne Date: Wed Oct 30 14:57:01 2019 +0100 mailbox: stm32-ipcc: Update wakeup management The wakeup specific IRQ management is no more needed to wake up the stm32 platform. A relationship has been established between the EXTI and the RX IRQ, just need to declare the EXTI interrupt instead of the IPCC RX IRQ. Signed-off-by: Alexandre Torgue Signed-off-by: Fabien Dessenne Signed-off-by: Jassi Brar commit b94ae8ad9fe79da61231999f347f79645b909bda Merge: 3b805ca177a2 23b2c96fad21 Author: Linus Torvalds Date: Sat Nov 30 17:23:16 2019 -0800 Merge tag 'seccomp-v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp updates from Kees Cook: "Mostly this is implementing the new flag SECCOMP_USER_NOTIF_FLAG_CONTINUE, but there are cleanups as well. - implement SECCOMP_USER_NOTIF_FLAG_CONTINUE (Christian Brauner) - fixes to selftests (Christian Brauner) - remove secure_computing() argument (Christian Brauner)" * tag 'seccomp-v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: seccomp: rework define for SECCOMP_USER_NOTIF_FLAG_CONTINUE seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test seccomp: simplify secure_computing() seccomp: test SECCOMP_USER_NOTIF_FLAG_CONTINUE seccomp: add SECCOMP_USER_NOTIF_FLAG_CONTINUE seccomp: avoid overflow in implicit constant conversion commit 3b805ca177a24ff78b466ca73febe8466c67ea61 Merge: ba75082efc18 c34c78dfc1fc Author: Linus Torvalds Date: Sat Nov 30 17:01:48 2019 -0800 Merge tag 'audit-pr-20191126' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: "Audit is back for v5.5, albeit with only two patches: - Allow for the auditing of suspicious O_CREAT usage via the new AUDIT_ANOM_CREAT record. - Remove a redundant if-conditional check found during code analysis. It's a minor change, but when the pull request is only two patches long, you need filler in the pull request email" [ Heh on the pull request filler. I wish more people tried to write better pull request messages, even if maybe it's not worth it for the trivial cases ;^) - Linus ] * tag 'audit-pr-20191126' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: remove redundant condition check in kauditd_thread() audit: Report suspicious O_CREAT usage commit ba75082efc18ced6def42e8f85c494aa2578760e Merge: 8a99117f6e87 42345b68c2e3 Author: Linus Torvalds Date: Sat Nov 30 16:55:37 2019 -0800 Merge tag 'selinux-pr-20191126' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: "Only three SELinux patches for v5.5: - Remove the size limit on SELinux policies, the limitation was a lingering vestige and no longer necessary. - Allow file labeling before the policy is loaded. This should ease some of the burden when the policy is initially loaded (no need to relabel files), but it should also help enable some new system concepts which dynamically create the root filesystem in the initrd. - Add support for the "greatest lower bound" policy construct which is defined as the intersection of the MLS range of two SELinux labels" * tag 'selinux-pr-20191126' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: default_range glblub implementation selinux: allow labeling before policy is loaded selinux: remove load size limit commit 8a99117f6e8793ab945d85db038f09e85703b97b Merge: 0dd0c8f7db03 c58ff643763c Author: Linus Torvalds Date: Sat Nov 30 16:41:55 2019 -0800 Merge tag 'kgdb-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "The major change here is the work from Douglas Anderson that reworks the way kdb stack traces are handled on SMP systems. The effect is to allow all CPUs to issue their stack trace which reduced the need for architecture specific code to support stack tracing. Also included are general of clean ups from Doug and myself: - Remove some unused variables or arguments. - Tidy up the kdb escape handling code and fix a couple of odd corner cases. - Better ignore escape characters that do not form part of an escape sequence. This mostly benefits vi users since they are most likely to press escape as a nervous habit but it won't harm anyone else" * tag 'kgdb-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kdb: Tweak escape handling for vi users kdb: Improve handling of characters from different input sources kdb: Remove special case logic from kdb_read() kdb: Simplify code to fetch characters from console kdb: Tidy up code to handle escape sequences kdb: Avoid array subscript warnings on non-SMP builds kdb: Fix stack crawling on 'running' CPUs that aren't the master kdb: Fix "btc " crash if the CPU didn't round up kdb: Remove unused "argcount" param from kdb_bt1(); make btaprompt bool kgdb: Remove unused DCPU_SSTEP definition commit 0dd0c8f7db036b9aa61b70fa9fac423493cd5d17 Merge: 8fa91bfa9ba4 7a1323b5dfe4 Author: Linus Torvalds Date: Sat Nov 30 14:50:51 2019 -0800 Merge tag 'hyperv-next-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V updates from Sasha Levin: - support for new VMBus protocols (Andrea Parri) - hibernation support (Dexuan Cui) - latency testing framework (Branden Bonaby) - decoupling Hyper-V page size from guest page size (Himadri Pandya) * tag 'hyperv-next-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: (22 commits) Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic drivers/hv: Replace binary semaphore with mutex drivers: iommu: hyperv: Make HYPERV_IOMMU only available on x86 HID: hyperv: Add the support of hibernation hv_balloon: Add the support of hibernation x86/hyperv: Implement hv_is_hibernation_supported() Drivers: hv: balloon: Remove dependencies on guest page size Drivers: hv: vmbus: Remove dependencies on guest page size x86: hv: Add function to allocate zeroed page for Hyper-V Drivers: hv: util: Specify ring buffer size using Hyper-V page size Drivers: hv: Specify receive buffer size using Hyper-V page size tools: hv: add vmbus testing tool drivers: hv: vmbus: Introduce latency testing video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host hv_netvsc: Add the support of hibernation hv_sock: Add the support of hibernation video: hyperv_fb: Add the support of hibernation scsi: storvsc: Add the support of hibernation Drivers: hv: vmbus: Add module parameter to cap the VMBus version ... commit 8fa91bfa9ba4060347c45673f8ee990a2a1d760e Merge: 738d5fabff86 5a43b87b3c62 Author: Linus Torvalds Date: Sat Nov 30 14:49:08 2019 -0800 Merge branch 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS fix from Borislav Petkov: "One urgent fix for the thermal throttling machinery: the recent change reworking the thermal notifications forgot to mask out read-only and reserved bits in the thermal status MSRs, leading to exceptions while writing those MSRs. The fix takes care of masking out those bits first" * 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce/therm_throt: Mask out read-only and reserved MSR bits commit 738d5fabff864a6b4a8b67f589a8f28f6cca808f Merge: 7794b1d4185e e9c837c6ab07 Author: Linus Torvalds Date: Sat Nov 30 14:45:32 2019 -0800 Merge branch 'parisc-5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Just trivial small updates: An assembler register optimization in the inlined networking checksum functions, a compiler warning fix and don't unneccesary print a runtime warning on machines which wouldn't be affected anyway" * 'parisc-5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Avoid spurious inequivalent alias kernel error messages kexec: Fix pointer-to-int-cast warnings parisc: Do not hardcode registers in checksum functions commit 7794b1d4185e2587af46435e3e2f6696dae314c7 Merge: 9dd0013824fc 2807273f5e88 Author: Linus Torvalds Date: Sat Nov 30 14:35:43 2019 -0800 Merge tag 'powerpc-5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: "Highlights: - Infrastructure for secure boot on some bare metal Power9 machines. The firmware support is still in development, so the code here won't actually activate secure boot on any existing systems. - A change to xmon (our crash handler / pseudo-debugger) to restrict it to read-only mode when the kernel is lockdown'ed, otherwise it's trivial to drop into xmon and modify kernel data, such as the lockdown state. - Support for KASLR on 32-bit BookE machines (Freescale / NXP). - Fixes for our flush_icache_range() and __kernel_sync_dicache() (VDSO) to work with memory ranges >4GB. - Some reworks of the pseries CMM (Cooperative Memory Management) driver to make it behave more like other balloon drivers and enable some cleanups of generic mm code. - A series of fixes to our hardware breakpoint support to properly handle unaligned watchpoint addresses. Plus a bunch of other smaller improvements, fixes and cleanups. Thanks to: Alastair D'Silva, Andrew Donnellan, Aneesh Kumar K.V, Anthony Steinhauser, Cédric Le Goater, Chris Packham, Chris Smart, Christophe Leroy, Christopher M. Riedl, Christoph Hellwig, Claudio Carvalho, Daniel Axtens, David Hildenbrand, Deb McLemore, Diana Craciun, Eric Richter, Geert Uytterhoeven, Greg Kroah-Hartman, Greg Kurz, Gustavo L. F. Walbon, Hari Bathini, Harish, Jason Yan, Krzysztof Kozlowski, Leonardo Bras, Mathieu Malaterre, Mauro S. M. Rodrigues, Michal Suchanek, Mimi Zohar, Nathan Chancellor, Nathan Lynch, Nayna Jain, Nick Desaulniers, Oliver O'Halloran, Qian Cai, Rasmus Villemoes, Ravi Bangoria, Sam Bobroff, Santosh Sivaraj, Scott Wood, Thomas Huth, Tyrel Datwyler, Vaibhav Jain, Valentin Longchamp, YueHaibing" * tag 'powerpc-5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (144 commits) powerpc/fixmap: fix crash with HIGHMEM x86/efi: remove unused variables powerpc: Define arch_is_kernel_initmem_freed() for lockdep powerpc/prom_init: Use -ffreestanding to avoid a reference to bcmp powerpc: Avoid clang warnings around setjmp and longjmp powerpc: Don't add -mabi= flags when building with Clang powerpc: Fix Kconfig indentation powerpc/fixmap: don't clear fixmap area in paging_init() selftests/powerpc: spectre_v2 test must be built 64-bit powerpc/powernv: Disable native PCIe port management powerpc/kexec: Move kexec files into a dedicated subdir. powerpc/32: Split kexec low level code out of misc_32.S powerpc/sysdev: drop simple gpio powerpc/83xx: map IMMR with a BAT. powerpc/32s: automatically allocate BAT in setbat() powerpc/ioremap: warn on early use of ioremap() powerpc: Add support for GENERIC_EARLY_IOREMAP powerpc/fixmap: Use __fix_to_virt() instead of fix_to_virt() powerpc/8xx: use the fixmapped IMMR in cpm_reset() powerpc/8xx: add __init to cpm1 init functions ... commit 9dd0013824fc29e618db7a5b0bac5545285b946a Merge: 2309d0768237 1a70cf0e7ee6 Author: Linus Torvalds Date: Sat Nov 30 14:29:19 2019 -0800 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: - improve ARM implementation of pfn_valid() - various sparse fixes - spelling fixes - add further ARMv8 debug architecture versions - clang fix for decompressor - update to generic vDSO - remove Brahma-B53 from spectre hardening - initialise broadcast hrtimer device - use correct nm executable in decompressor - remove old mcount et.al. * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: (26 commits) ARM: 8940/1: ftrace: remove mcount(),ftrace_caller_old() and ftrace_call_old() ARM: 8939/1: kbuild: use correct nm executable ARM: 8938/1: kernel: initialize broadcast hrtimer based clock event device ARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening ARM: 8933/1: replace Sun/Solaris style flag on section directive ARM: 8932/1: Add clock_gettime64 entry point ARM: 8931/1: Add clock_getres entry point ARM: 8930/1: Add support for generic vDSO ARM: 8929/1: use APSR_nzcv instead of r15 as mrc operand ARM: 8927/1: ARM/hw_breakpoint: add more ARMv8 debug architecture versions support ARM: 8918/2: only build return_address() if needed ARM: 8928/1: ARM_ERRATA_775420: Spelling s/date/data/ ARM: 8925/1: tcm: include for missing declarations ARM: 8924/1: tcm: make dtcm_end and itcm_end static ARM: 8923/1: mm: include for vga_base ARM: 8922/1: parse_dt_topology() rate is pointer to __be32 ARM: 8920/1: share get_signal_page from signal.c to process.c ARM: 8919/1: make unexported functions static ARM: 8917/1: mm: include ARM: 8916/1: mm: make set_section_perms() static ... commit 2309d0768237476c3144aa296264ad9e19598461 Merge: 6a965666b7e7 a7f96fce201c Author: Linus Torvalds Date: Sat Nov 30 14:28:11 2019 -0800 Merge tag 'nds32-for-linus-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/greentime/linux Pull nds32 updates from Greentime Hu: - code clean up - add a nds32 maintainer * tag 'nds32-for-linus-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/greentime/linux: MAINTAINERS: add nds32 maintainer nds32: Move static keyword to the front of declaration nds32: Fix typo in Kconfig.cpu nds32: remove unneeded clean-files for DTB commit 6a965666b7e7475c2f8c8e724703db58b8a8a445 Merge: 32ef9553635a 3c0edea9b29f Author: Linus Torvalds Date: Sat Nov 30 14:12:13 2019 -0800 Merge tag 'notifications-pipe-prep-20191115' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull pipe rework from David Howells: "This is my set of preparatory patches for building a general notification queue on top of pipes. It makes a number of significant changes: - It removes the nr_exclusive argument from __wake_up_sync_key() as this is always 1. This prepares for the next step: - Adds wake_up_interruptible_sync_poll_locked() so that poll can be woken up from a function that's holding the poll waitqueue spinlock. - Change the pipe buffer ring to be managed in terms of unbounded head and tail indices rather than bounded index and length. This means that reading the pipe only needs to modify one index, not two. - A selection of helper functions are provided to query the state of the pipe buffer, plus a couple to apply updates to the pipe indices. - The pipe ring is allowed to have kernel-reserved slots. This allows many notification messages to be spliced in by the kernel without allowing userspace to pin too many pages if it writes to the same pipe. - Advance the head and tail indices inside the pipe waitqueue lock and use wake_up_interruptible_sync_poll_locked() to poke poll without having to take the lock twice. - Rearrange pipe_write() to preallocate the buffer it is going to write into and then drop the spinlock. This allows kernel notifications to then be added the ring whilst it is filling the buffer it allocated. The read side is stalled because the pipe mutex is still held. - Don't wake up readers on a pipe if there was already data in it when we added more. - Don't wake up writers on a pipe if the ring wasn't full before we removed a buffer" * tag 'notifications-pipe-prep-20191115' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: pipe: Remove sync on wake_ups pipe: Increase the writer-wakeup threshold to reduce context-switch count pipe: Check for ring full inside of the spinlock in pipe_write() pipe: Remove redundant wakeup from pipe_write() pipe: Rearrange sequence in pipe_write() to preallocate slot pipe: Conditionalise wakeup in pipe_read() pipe: Advance tail pointer inside of wait spinlock in pipe_read() pipe: Allow pipes to have kernel-reserved slots pipe: Use head and tail pointers for the ring, not cursor and length Add wake_up_interruptible_sync_poll_locked() Remove the nr_exclusive argument from __wake_up_sync_key() pipe: Reduce #inclusion of pipe_fs_i.h commit 9bd19c63a4bcfa0fd18f3bc0de30675fe2addea6 Author: Randy Dunlap Date: Thu Nov 28 14:17:59 2019 -0800 net: emulex: benet: indent a Kconfig depends continuation line Indent a Kconfig continuation line to improve readability. Signed-off-by: Randy Dunlap Cc: Sathya Perla Cc: Ajit Khaparde Cc: Sriharsha Basavapatna Cc: Somnath Kotur Cc: netdev@vger.kernel.org Signed-off-by: David S. Miller commit 408469d31e9106878d2b3e428dcca9984664dfc9 Author: Jiri Pirko Date: Thu Nov 28 13:38:57 2019 +0100 selftests: forwarding: fix race between packet receive and tc check It is possible that tc stats get checked before the packet we check for actually arrived into the interface and accounted for. Fix it by checking for the expected result in a loop until timeout is reached (by default 1 second). Fixes: 07e5c75184a1 ("selftests: forwarding: Introduce tc flower matching tests") Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit 466e16f0920f3ffdfa49713212fa334fb3dc08f1 Author: NeilBrown Date: Thu Nov 28 13:56:43 2019 +1100 nfsd: check for EBUSY from vfs_rmdir/vfs_unink. vfs_rmdir and vfs_unlink can return -EBUSY if the target is a mountpoint. This currently gets passed to nfserrno() by nfsd_unlink(), and that results in a WARNing, which is not user-friendly. Possibly the best NFSv4 error is NFS4ERR_FILE_OPEN, because there is a sense in which the object is currently in use by some other task. The Linux NFSv4 client will map this back to EBUSY, which is an added benefit. For NFSv3, the best we can do is probably NFS3ERR_ACCES, which isn't true, but is not less true than the other options. Signed-off-by: NeilBrown Signed-off-by: J. Bruce Fields commit a25e3726b32c746c0098125d4c7463bb84df72bb Author: Trond Myklebust Date: Wed Nov 27 17:05:51 2019 -0500 nfsd: Ensure CLONE persists data and metadata changes to the target file The NFSv4.2 CLONE operation has implicit persistence requirements on the target file, since there is no protocol requirement that the client issue a separate operation to persist data. For that reason, we should call vfs_fsync_range() on the destination file after a successful call to vfs_clone_file_range(). Fixes: ffa0160a1039 ("nfsd: implement the NFSv4.2 CLONE operation") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.5+ Signed-off-by: J. Bruce Fields commit 32ef9553635ab1236c33951a8bd9b5af1c3b1646 Merge: b8072d5b3cdd 67e6b4ef8496 Author: Linus Torvalds Date: Sat Nov 30 11:34:33 2019 -0800 Merge tag 'fsnotify_for_v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "Three fsnotify cleanups" * tag 'fsnotify_for_v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: Add git tree reference to MAINTAINERS fsnotify/fdinfo: exportfs_encode_inode_fh() takes pointer as 4th argument fsnotify: move declaration of fsnotify_mark_connector_cachep to fsnotify.h commit b8072d5b3cdd596c999f6e3f312ce7e4858ca356 Merge: e2d73c302b6b 545886fead7a Author: Linus Torvalds Date: Sat Nov 30 11:16:07 2019 -0800 Merge tag 'for_v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2, quota, reiserfs cleanups and fixes from Jan Kara: - Refactor the quota on/off kernel internal interfaces (mostly for ubifs quota support as ubifs does not want to have inodes holding quota information) - A few other small quota fixes and cleanups - Various small ext2 fixes and cleanups - Reiserfs xattr fix and one cleanup * tag 'for_v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: (28 commits) ext2: code cleanup for descriptor_loc() fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long ext2: fix improper function comment ext2: code cleanup for ext2_try_to_allocate() ext2: skip unnecessary operations in ext2_try_to_allocate() ext2: Simplify initialization in ext2_try_to_allocate() ext2: code cleanup by calling ext2_group_last_block_no() ext2: introduce new helper ext2_group_last_block_no() reiserfs: replace open-coded atomic_dec_and_mutex_lock() ext2: check err when partial != NULL quota: Handle quotas without quota inodes in dquot_get_state() quota: Make dquot_disable() work without quota inodes quota: Drop dquot_enable() fs: Use dquot_load_quota_inode() from filesystems quota: Rename vfs_load_quota_inode() to dquot_load_quota_inode() quota: Simplify dquot_resume() quota: Factor out setup of quota inode quota: Check that quota is not dirty before release quota: fix livelock in dquot_writeback_dquots ext2: don't set *count in the case of failure in ext2_try_to_allocate() ... commit e2d73c302b6b0a8379a679120590073b813d5e7f Merge: 21b26d267958 3dcb5fa23e16 Author: Linus Torvalds Date: Sat Nov 30 11:13:33 2019 -0800 Merge tag 'erofs-for-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "No major kernel updates for this round since I'm fully diving into LZMA algorithm internals now to provide high CR XZ algorihm support. That needs more work and time for me to get a better compression time. Summary: - Introduce superblock checksum support - Set iowait when waiting I/O for sync decompression path - Several code cleanups" * tag 'erofs-for-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: remove unnecessary output in erofs_show_options() erofs: drop all vle annotations for runtime names erofs: support superblock checksum erofs: set iowait for sync decompression erofs: clean up decompress queue stuffs erofs: get rid of __stagingpage_alloc helper erofs: remove dead code since managed cache is now built-in erofs: clean up collection handling routines commit 21b26d2679584c6a60e861aa3e5ca09a6bab0633 Merge: 8f45533e9db9 68464b88cc0a Author: Linus Torvalds Date: Sat Nov 30 11:10:39 2019 -0800 Merge tag '5.5-rc-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs updates from Steve French: "Various smb3 fixes (including 12 for stable) and also features (addition of multichannel support)" * tag '5.5-rc-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: (41 commits) CIFS: fix a white space issue in cifs_get_inode_info() cifs: update internal module version number cifs: Always update signing key of first channel cifs: Fix retrieval of DFS referrals in cifs_mount() cifs: Fix potential softlockups while refreshing DFS cache cifs: Fix lookup of root ses in DFS referral cache cifs: Fix use-after-free bug in cifs_reconnect() cifs: dump channel info in DebugData smb3: dump in_send and num_waiters stats counters by default cifs: try harder to open new channels CIFS: Properly process SMB3 lease breaks cifs: move cifsFileInfo_put logic into a work-queue cifs: try opening channels after mounting CIFS: refactor cifs_get_inode_info() cifs: switch servers depending on binding state cifs: add server param cifs: add multichannel mount options and data structs cifs: sort interface list by speed CIFS: Fix SMB2 oplock break processing cifs: don't use 'pre:' for MODULE_SOFTDEP ... commit 8f45533e9db917147066b24903a0d03a5adb50e1 Merge: 4a55d362ffe7 803e74be04b3 Author: Linus Torvalds Date: Sat Nov 30 11:02:30 2019 -0800 Merge tag 'f2fs-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, we've introduced fairly small number of patches as below. Enhancements: - improve the in-place-update IO flow - allocate segment to guarantee no GC for pinned files Bug fixes: - fix updatetime in lazytime mode - potential memory leak in f2fs_listxattr - record parent inode number in rename2 correctly - fix deadlock in f2fs_gc along with atomic writes - avoid needless data migration in GC" * tag 'f2fs-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: f2fs: stop GC when the victim becomes fully valid f2fs: expose main_blkaddr in sysfs f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project() f2fs: Fix deadlock in f2fs_gc() context during atomic files handling f2fs: show f2fs instance in printk_ratelimited f2fs: fix potential overflow f2fs: fix to update dir's i_pino during cross_rename f2fs: support aligned pinned file f2fs: avoid kernel panic on corruption test f2fs: fix wrong description in document f2fs: cache global IPU bio f2fs: fix to avoid memory leakage in f2fs_listxattr f2fs: check total_segments from devices in raw_super f2fs: update multi-dev metadata in resize_fs f2fs: mark recovery flag correctly in read_raw_super_block() f2fs: fix to update time in lazytime mode commit 4a55d362ffe7caf099a01f6d2ed49a6ea03a4a88 Merge: 50b8b3f85a01 4fe171bb81b1 Author: Linus Torvalds Date: Sat Nov 30 10:57:22 2019 -0800 Merge tag 'afs-next-20191121' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS updates from David Howells: "Minor cleanups and fix: - Minor fix to make some debugging statements display information from the correct iov_iter. - Rename some members and variables to make things more obvious or consistent. - Provide a helper to wrap increments of the usage count on the afs_read struct. - Use scnprintf() to print into a stack buffer rather than sprintf(). - Remove some set but unused variables" * tag 'afs-next-20191121' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Remove set but not used variable 'ret' afs: Remove set but not used variables 'before', 'after' afs: xattr: use scnprintf afs: Introduce an afs_get_read() refcount helper afs: Rename desc -> req in afs_fetch_data() afs: Switch the naming of call->iter and call->_iter afs: Use call->_iter not &call->iter in debugging statements commit 50b8b3f85a01543fb82d3bb9bfe7d06659522c70 Merge: f112a2fd1f59 dfdeeb41fb08 Author: Linus Torvalds Date: Sat Nov 30 10:53:02 2019 -0800 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "This merge window saw the the following new featuers added to ext4: - Direct I/O via iomap (required the iomap-for-next branch from Darrick as a prereq). - Support for using dioread-nolock where the block size < page size. - Support for encryption for file systems where the block size < page size. - Rework of journal credits handling so a revoke-heavy workload will not cause the journal to run out of space. - Replace bit-spinlocks with spinlocks in jbd2 Also included were some bug fixes and cleanups, mostly to clean up corner cases from fuzzed file systems and error path handling" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (59 commits) ext4: work around deleting a file with i_nlink == 0 safely ext4: add more paranoia checking in ext4_expand_extra_isize handling jbd2: make jbd2_handle_buffer_credits() handle reserved handles ext4: fix a bug in ext4_wait_for_tail_page_commit ext4: bio_alloc with __GFP_DIRECT_RECLAIM never fails ext4: code cleanup for get_next_id ext4: fix leak of quota reservations ext4: remove unused variable warning in parse_options() ext4: Enable encryption for subpage-sized blocks fs/buffer.c: support fscrypt in block_read_full_page() ext4: Add error handling for io_end_vec struct allocation jbd2: Fine tune estimate of necessary descriptor blocks jbd2: Provide trace event for handle restarts ext4: Reserve revoke credits for freed blocks jbd2: Make credit checking more strict jbd2: Rename h_buffer_credits to h_total_credits jbd2: Reserve space for revoke descriptor blocks jbd2: Drop jbd2_space_needed() jbd2: Account descriptor blocks into t_outstanding_credits jbd2: Factor out common parts of stopping and restarting a handle ... commit f112a2fd1f5999c6029551f901952392d900cf99 Merge: 3b266a52d8d6 3253d9d09337 Author: Linus Torvalds Date: Sat Nov 30 10:48:24 2019 -0800 Merge tag 'vfs-5.5-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull splice fix from Darrick Wong: "Fix another place in the splice code where a pipe could ask a filesystem for a longer read than the pipe actually has free buffer space" * tag 'vfs-5.5-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: splice: only read in as much information as there is pipe buffer space commit d50264f1fef92967e2d2c9d91bdb05de214ddacf Author: Pablo Neira Ayuso Date: Fri Nov 29 10:07:01 2019 +0100 netfilter: nf_flow_table_offload: add IPv6 match description Add missing IPv6 matching description to flow_rule object. Fixes: 5c27d8d76ce8 ("netfilter: nf_flow_table_offload: add IPv6 support") Signed-off-by: Pablo Neira Ayuso commit c7c17e6a03e08860f7a40095643e72c24c3f896b Author: Florian Westphal Date: Thu Nov 28 13:25:48 2019 +0100 netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash At this time compiler inlines it, but this code will not be executed under normal conditions. Also, no inlining allows to use "nf_ct_resolve_clash%return" perf probe. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit dc4d3f2e12a6e8a22d13b0d648a6529e403b65a6 Author: Nathan Chancellor Date: Tue Nov 26 13:12:26 2019 -0700 netfilter: nf_flow_table_offload: Don't use offset uninitialized in flow_offload_port_{d,s}nat Clang warns (trimmed the second warning for brevity): ../net/netfilter/nf_flow_table_offload.c:342:2: warning: variable 'offset' is used uninitialized whenever switch default is taken [-Wsometimes-uninitialized] default: ^~~~~~~ ../net/netfilter/nf_flow_table_offload.c:346:57: note: uninitialized use occurs here flow_offload_mangle(entry, flow_offload_l4proto(flow), offset, ^~~~~~ ../net/netfilter/nf_flow_table_offload.c:331:12: note: initialize the variable 'offset' to silence this warning u32 offset; ^ = 0 Match what was done in the flow_offload_ipv{4,6}_{d,s}nat functions and just return in the default case, since port would also be uninitialized. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Link: https://github.com/ClangBuiltLinux/linux/issues/780 Signed-off-by: Nathan Chancellor Reported-by: kernelci.org bot Reviewed-by: Nick Desaulniers Signed-off-by: Pablo Neira Ayuso commit e052901991ae21e15851bfc89c682bfcb39a4dcf Author: wenxu Date: Wed Nov 20 13:12:22 2019 +0800 netfilter: nf_flow_table_offload: Fix block_cb tc_setup_type as TC_SETUP_CLSFLOWER Add/del/stats flows through block_cb call must set the tc_setup_type as TC_SETUP_CLSFLOWER. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit ee1bcfe01251e8958b53de45d2b0c85e09dd2719 Author: wenxu Date: Wed Nov 20 12:30:42 2019 +0800 netfilter: nf_flow_table_offload: Fix block setup as TC_SETUP_FT cmd Set up block through TC_SETUP_FT command. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit 3b266a52d8d6e02ea6c1bb52c96342128e624554 Merge: aa32f1169148 419e9c38aa07 Author: Linus Torvalds Date: Sat Nov 30 10:44:49 2019 -0800 Merge tag 'iomap-5.5-merge-11' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap updates from Darrick Wong: "In this release, we hoisted as much of XFS' writeback code into iomap as was practicable, refactored the unshare file data function, added the ability to perform buffered io copy on write, and tweaked various parts of the directio implementation as needed to port ext4's directio code (that will be a separate pull). Summary: - Make iomap_dio_rw callers explicitly tell us if they want us to wait - Port the xfs writeback code to iomap to complete the buffered io library functions - Refactor the unshare code to share common pieces - Add support for performing copy on write with buffered writes - Other minor fixes - Fix unchecked return in iomap_bmap - Fix a type casting bug in a ternary statement in iomap_dio_bio_actor - Improve tracepoints for easier diagnostic ability - Fix pipe page leakage in directio reads" * tag 'iomap-5.5-merge-11' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (31 commits) iomap: Fix pipe page leakage during splicing iomap: trace iomap_appply results iomap: fix return value of iomap_dio_bio_actor on 32bit systems iomap: iomap_bmap should check iomap_apply return value iomap: Fix overflow in iomap_page_mkwrite fs/iomap: remove redundant check in iomap_dio_rw() iomap: use a srcmap for a read-modify-write I/O iomap: renumber IOMAP_HOLE to 0 iomap: use write_begin to read pages to unshare iomap: move the zeroing case out of iomap_read_page_sync iomap: ignore non-shared or non-data blocks in xfs_file_dirty iomap: always use AOP_FLAG_NOFS in iomap_write_begin iomap: remove the unused iomap argument to __iomap_write_end iomap: better document the IOMAP_F_* flags iomap: enhance writeback error message iomap: pass a struct page to iomap_finish_page_writeback iomap: cleanup iomap_ioend_compare iomap: move struct iomap_page out of iomap.h iomap: warn on inline maps in iomap_writepage_map iomap: lift the xfs writeback code to iomap ... commit e3cb40d4d80516a8f4e9afaebe4d672821a2c97b Author: Bjorn Andersson Date: Sat Nov 30 10:34:36 2019 -0800 Revert "dt-bindings: remoteproc: stm32: add wakeup-source" The DeviceTree binding document was converted to YAML in a patch that is being merged through the devicetree tree, as such this patch needs to be rewritten and is currently cause for a merge conflict. This reverts commit 14ea1d04ed0f7bae60951bdb8eeaa55cdbb26c73. Signed-off-by: Bjorn Andersson commit 14e54ab9143fa60794d13ea0a66c792a2046a8f3 Author: Dust Li Date: Thu Nov 28 14:29:09 2019 +0800 net: sched: fix `tc -s class show` no bstats on class with nolock subqueues When a classful qdisc's child qdisc has set the flag TCQ_F_CPUSTATS (pfifo_fast for example), the child qdisc's cpu_bstats should be passed to gnet_stats_copy_basic(), but many classful qdisc didn't do that. As a result, `tc -s class show dev DEV` always return 0 for bytes and packets in this case. Pass the child qdisc's cpu_bstats to gnet_stats_copy_basic() to fix this issue. The qstats also has this problem, but it has been fixed in 5dd431b6b9 ("net: sched: introduce and use qstats read...") and bstats still remains buggy. Fixes: 22e0f8b9322c ("net: sched: make bstats per cpu and estimator RCU safe") Signed-off-by: Dust Li Signed-off-by: Tony Lu Acked-by: Cong Wang Signed-off-by: David S. Miller commit aa32f1169148beb90d71494e2f2a1999ba7b5366 Merge: d5bb349dbbe2 93f4e735b6d9 Author: Linus Torvalds Date: Sat Nov 30 10:33:14 2019 -0800 Merge tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull hmm updates from Jason Gunthorpe: "This is another round of bug fixing and cleanup. This time the focus is on the driver pattern to use mmu notifiers to monitor a VA range. This code is lifted out of many drivers and hmm_mirror directly into the mmu_notifier core and written using the best ideas from all the driver implementations. This removes many bugs from the drivers and has a very pleasing diffstat. More drivers can still be converted, but that is for another cycle. - A shared branch with RDMA reworking the RDMA ODP implementation - New mmu_interval_notifier API. This is focused on the use case of monitoring a VA and simplifies the process for drivers - A common seq-count locking scheme built into the mmu_interval_notifier API usable by drivers that call get_user_pages() or hmm_range_fault() with the VA range - Conversion of mlx5 ODP, hfi1, radeon, nouveau, AMD GPU, and Xen GntDev drivers to the new API. This deletes a lot of wonky driver code. - Two improvements for hmm_range_fault(), from testing done by Ralph" * tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: mm/hmm: remove hmm_range_dma_map and hmm_range_dma_unmap mm/hmm: make full use of walk_page_range() xen/gntdev: use mmu_interval_notifier_insert mm/hmm: remove hmm_mirror and related drm/amdgpu: Use mmu_interval_notifier instead of hmm_mirror drm/amdgpu: Use mmu_interval_insert instead of hmm_mirror drm/amdgpu: Call find_vma under mmap_sem nouveau: use mmu_interval_notifier instead of hmm_mirror nouveau: use mmu_notifier directly for invalidate_range_start drm/radeon: use mmu_interval_notifier_insert RDMA/hfi1: Use mmu_interval_notifier_insert for user_exp_rcv RDMA/odp: Use mmu_interval_notifier_insert() mm/hmm: define the pre-processor related parts of hmm.h even if disabled mm/hmm: allow hmm_range to be used with a mmu_interval_notifier or hmm_mirror mm/mmu_notifier: add an interval tree notifier mm/mmu_notifier: define the header pre-processor parts even if disabled mm/hmm: allow snapshot of the special zero page commit 395eba7d0c122c650fb8b6ae8c6815cbfdc39ca9 Author: Grygorii Strashko Date: Fri Nov 29 19:58:09 2019 +0200 net: ethernet: ti: ale: ensure vlan/mdb deleted when no members The recently updated ALE APIs cpsw_ale_del_mcast() and cpsw_ale_del_vlan_modify() have an issue and will not delete ALE entry even if VLAN/mcast group has no more members. Hence fix it here and delete ALE entry if !port_mask. The issue affected only new cpsw switchdev driver. Fixes: e85c14370783 ("net: ethernet: ti: ale: modify vlan/mdb api for switchdev") Signed-off-by: Grygorii Strashko Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 5f9fc3325ef95398c363b9b7813a7e99d4d85d7d Author: YueHaibing Date: Wed Nov 27 21:27:00 2019 +0800 net/mlx5e: Fix build error without IPV6 If IPV6 is not set and CONFIG_MLX5_ESWITCH is y, building fails: drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c:322:5: error: redefinition of mlx5e_tc_tun_create_header_ipv6 int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c:7:0: drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h:67:1: note: previous definition of mlx5e_tc_tun_create_header_ipv6 was here mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Use #ifdef to guard this, also move mlx5e_route_lookup_ipv6 to cleanup unused warning. Reported-by: Hulk Robot Fixes: e689e998e102 ("net/mlx5e: TC, Stub out ipv6 tun create header function") Signed-off-by: YueHaibing Acked-by: Saeed Mahameed Signed-off-by: David S. Miller commit d5bb349dbbe27537e90a03b9597deeb07723a86d Merge: 81b6b96475ac 0a6cad5df541 Author: Linus Torvalds Date: Sat Nov 30 09:38:11 2019 -0800 Merge tag 'drm-vmwgfx-coherent-2019-11-29' of git://anongit.freedesktop.org/drm/drm Pull drm coherent memory support for vmwgfx from Dave Airlie: "This is a separate pull for the mm pagewalking + drm/vmwgfx work Thomas did and you were involved in, I've left it separate in case you don't feel as comfortable with it as the other stuff. It has mm acks/r-b in the right places from what I can see" * tag 'drm-vmwgfx-coherent-2019-11-29' of git://anongit.freedesktop.org/drm/drm: drm/vmwgfx: Add surface dirty-tracking callbacks drm/vmwgfx: Implement an infrastructure for read-coherent resources drm/vmwgfx: Use an RBtree instead of linked list for MOB resources drm/vmwgfx: Implement an infrastructure for write-coherent resources mm: Add write-protect and clean utilities for address space ranges mm: Add a walk_page_mapping() function to the pagewalk code mm: pagewalk: Take the pagetable lock in walk_pte_range() mm: Remove BUG_ON mmap_sem not held from xxx_trans_huge_lock() drm/ttm: Convert vm callbacks to helpers drm/ttm: Remove explicit typecasts of vm_private_data commit 7b0b8cfd261c569177d64d6e9b1800fbe412fd65 Author: Borislav Petkov Date: Sat Nov 30 16:00:53 2019 +0100 x86/ioperm: Save an indentation level in tss_update_io_bitmap() ... for better readability. No functional changes. [ Minor edit. ] Signed-off-by: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Ingo Molnar commit aa137a6d302b5989ed205b7dfb7fe40a8851babc Author: Miroslav Benes Date: Wed Nov 6 10:56:01 2019 +0100 s390/livepatch: Implement reliable stack tracing for the consistency model The livepatch consistency model requires reliable stack tracing architecture support in order to work properly. In order to achieve this, two main issues have to be solved. First, reliable and consistent call chain backtracing has to be ensured. Second, the unwinder needs to be able to detect stack corruptions and return errors. The "zSeries ELF Application Binary Interface Supplement" says: "The stack pointer points to the first word of the lowest allocated stack frame. If the "back chain" is implemented this word will point to the previously allocated stack frame (towards higher addresses), except for the first stack frame, which shall have a back chain of zero (NULL). The stack shall grow downwards, in other words towards lower addresses." "back chain" is optional. GCC option -mbackchain enables it. Quoting Martin Schwidefsky [1]: "The compiler is called with the -mbackchain option, all normal C function will store the backchain in the function prologue. All functions written in assembler code should do the same, if you find one that does not we should fix that. The end result is that a task that *voluntarily* called schedule() should have a proper backchain at all times. Dependent on the use case this may or may not be enough. Asynchronous interrupts may stop the CPU at the beginning of a function, if kernel preemption is enabled we can end up with a broken backchain. The production kernels for IBM Z are all compiled *without* kernel preemption. So yes, we might get away without the objtool support. On a side-note, we do have a line item to implement the ORC unwinder for the kernel, that includes the objtool support. Once we have that we can drop the -mbackchain option for the kernel build. That gives us a nice little performance benefit. I hope that the change from backchain to the ORC unwinder will not be too hard to implement in the livepatch tools." Since -mbackchain is enabled by default when the kernel is compiled, the call chain backtracing should be currently ensured and objtool should not be necessary for livepatch purposes. Regarding the second issue, stack corruptions and non-reliable states have to be recognized by the unwinder. Mainly it means to detect preemption or page faults, the end of the task stack must be reached, return addresses must be valid text addresses and hacks like function graph tracing and kretprobes must be properly detected. Unwinding a running task's stack is not a problem, because there is a livepatch requirement that every checked task is blocked, except for the current task. Due to that, the implementation can be much simpler compared to the existing non-reliable infrastructure. We can consider a task's kernel/thread stack only and skip the other stacks. [1] 20180912121106.31ffa97c@mschwideX1 [not archived on lore.kernel.org] Link: https://lkml.kernel.org/r/20191106095601.29986-5-mbenes@suse.cz Reviewed-by: Heiko Carstens Tested-by: Miroslav Benes Signed-off-by: Miroslav Benes Signed-off-by: Vasily Gorbik commit be2d11b2a1e86586ace9f6839a159b170b00f2b3 Author: Miroslav Benes Date: Wed Nov 27 19:35:19 2019 +0100 s390/unwind: add stack pointer alignment sanity checks ABI requires SP to be aligned 8 bytes, report unwinding error otherwise. Link: https://lkml.kernel.org/r/20191106095601.29986-5-mbenes@suse.cz Reviewed-by: Heiko Carstens Tested-by: Miroslav Benes Signed-off-by: Miroslav Benes Signed-off-by: Vasily Gorbik commit bf018ee644897d7982e1b8dd8b15e97db6e1a4da Author: Vasily Gorbik Date: Wed Nov 27 18:12:04 2019 +0100 s390/unwind: filter out unreliable bogus %r14 Currently unwinder unconditionally returns %r14 from the first frame pointed by %r15 from pt_regs. A task could be interrupted when a function already allocated this frame (if it needs it) for its callees or to store local variables. In that case this frame would contain random values from stack or values stored there by a callee. As we are only interested in %r14 to get potential return address, skip bogus return addresses which doesn't belong to kernel text. This helps to avoid duplicating filtering logic in unwider users, most of which use unwind_get_return_address() and would choke on bogus 0 address returned by it otherwise. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 222ee9087a730b1df08d09baed0d03626e67600f Author: Vasily Gorbik Date: Wed Nov 27 17:37:51 2019 +0100 s390/unwind: start unwinding from reliable state A comment in arch/s390/include/asm/unwind.h says: > If 'first_frame' is not zero unwind_start skips unwind frames until it > reaches the specified stack pointer. > The end of the unwinding is indicated with unwind_done, this can be true > right after unwind_start, e.g. with first_frame!=0 that can not be found. > unwind_next_frame skips to the next frame. > Once the unwind is completed unwind_error() can be used to check if there > has been a situation where the unwinder could not correctly understand > the tasks call chain. With this change backchain unwinder now comply with behaviour described. As well as matches orc unwinder implementation. Now unwinder starts from reliable state, i.e. __unwind_start own stack frame is taken or stack frame generated by __switch_to (ksp) - both known to be valid. In case of pt_regs %r15 is better match for pt_regs psw, than sometimes random "sp" caller passed. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit de6921ccbd0fb2882a1f615a6d3cdfbdcd64532c Author: Vasily Gorbik Date: Mon Nov 25 14:07:40 2019 +0100 s390/test_unwind: add program check context tests Add unwinding from program check handler tests. Unwinder should be able to unwind through pt_regs stored by program check handler on task stack. Signed-off-by: Vasily Gorbik commit e7409367abe54ad04868552b9d9fe4a56acc753d Author: Vasily Gorbik Date: Fri Nov 22 19:18:58 2019 +0100 s390/test_unwind: add irq context tests Add unwinding from irq context tests. Unwinder should be able to unwind through irq stack to task stack up to task pt_regs. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 0610154650f161d56a0bef0d9678ae1de7360019 Author: Vasily Gorbik Date: Fri Nov 22 18:52:40 2019 +0100 s390/test_unwind: print verbose unwinding results Add stack name, sp and reliable information into test unwinding results. Also consider ip outside of kernel text as failure if the state is reported reliable. Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 7868249fbbc8125b82b83d99d33b23897ae7d9ab Author: Vasily Gorbik Date: Fri Nov 22 18:22:06 2019 +0100 s390/test_unwind: add CALL_ON_STACK tests Add CALL_ON_STACK helper testing. Tests make sure that we can unwind from switched stack to original one up to task pt_regs (nodat -> task stack). UWM_SWITCH_STACK could not be used together with UWM_THREAD because get_stack_info explicitly restricts unwinding to task stack if task != current. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 4ac24c092b4eef69b2436ee4d478500dc886e8b5 Author: Vasily Gorbik Date: Mon Nov 25 13:34:59 2019 +0100 s390: fix register clobbering in CALL_ON_STACK CALL_ON_STACK defines and initializes register variables. Inline assembly which follows might trigger compiler to generate memory access for "stack" argument (e.g. in case of S390_lowcore.nodat_stack). This memory access produces a function call under kasan with outline instrumentation which clobbers registers. Switch "stack" argument in CALL_ON_STACK helper to use memory reference constraint and perform load instead. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit f44fa79b104b56d53d33ae43e69bab98b63d4783 Author: Vasily Gorbik Date: Fri Nov 22 17:37:50 2019 +0100 s390/test_unwind: require that unwinding ended successfully Currently unwinder test passes if unwinding results contain unwindme_func2 and unwindme_func1 functions. Now that unwinder reports success upon reaching task pt_regs, check that unwinding ended successfully in every test. Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit badbf39790798283f2424828e7b7bec3962f1e02 Author: Ilya Leoshkevich Date: Thu Oct 17 15:09:08 2019 +0200 s390/unwind: add a test for the internal API unwind_for_each_frame can take at least 8 different sets of parameters. Add a test to make sure they all are handled in a sane way. Reviewed-by: Heiko Carstens Signed-off-by: Ilya Leoshkevich Co-developed-by: Vasily Gorbik Signed-off-by: Vasily Gorbik commit adcfb8cdc910bdd0b5d52d2ba88103af93dc43d3 Author: Vasily Gorbik Date: Tue Nov 26 17:40:04 2019 +0100 s390/unwind: always inline get_stack_pointer Always inline get_stack_pointer() to avoid potential problems due to compiler inlining decisions, i.e. getting stack pointer of get_stack_pointer() itself which is later reused. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit d497b7ec836d2c900993f1c43b2ddff5f8a6b129 Author: Niklas Schnelle Date: Thu Nov 28 09:31:52 2019 +0100 s390/pci: add error message on device number limit The config option CONFIG_PCI_NR_FUNCTIONS sets a limit on the number of PCI functions we can support. Previously on reaching this limit there was no indication why newly attached devices are not recognized by Linux which could be quite confusing. Thus this patch adds a pr_err() for this case. Reviewed-by: Peter Oberparleiter Signed-off-by: Niklas Schnelle Signed-off-by: Vasily Gorbik commit 794b8846dcdc0c6e23bbf4e5283415cab0caa9ac Author: Niklas Schnelle Date: Thu Nov 28 09:30:00 2019 +0100 s390/pci: add error message for UID collision When UID checking was turned off during runtime in the underlying hypervisor, a PCI device may be attached with the same UID. This is already detected but happens silently. Add an error message so it can more easily be understood why a device was not added. Reviewed-by: Peter Oberparleiter Signed-off-by: Niklas Schnelle Signed-off-by: Vasily Gorbik commit 247f265fa502e7b17a0cb0cc330e055a36aafce4 Author: Thomas Richter Date: Fri Nov 22 16:43:15 2019 +0100 s390/cpum_sf: Check for SDBT and SDB consistency Each SBDT is located at a 4KB page and contains 512 entries. Each entry of a SDBT points to a SDB, a 4KB page containing sampled data. The last entry is a link to another SDBT page. When an event is created the function sequence executed is: __hw_perf_event_init() +--> allocate_buffers() +--> realloc_sampling_buffers() +---> alloc_sample_data_block() Both functions realloc_sampling_buffers() and alloc_sample_data_block() allocate pages and the allocation can fail. This is handled correctly and all allocated pages are freed and error -ENOMEM is returned to the top calling function. Finally the event is not created. Once the event has been created, the amount of initially allocated SDBT and SDB can be too low. This is detected during measurement interrupt handling, where the amount of lost samples is calculated. If the number of lost samples is too high considering sampling frequency and already allocated SBDs, the number of SDBs is enlarged during the next execution of cpumsf_pmu_enable(). If more SBDs need to be allocated, functions realloc_sampling_buffers() +---> alloc-sample_data_block() are called to allocate more pages. Page allocation may fail and the returned error is ignored. A SDBT and SDB setup already exists. However the modified SDBTs and SDBs might end up in a situation where the first entry of an SDBT does not point to an SDB, but another SDBT, basicly an SBDT without payload. This can not be handled by the interrupt handler, where an SDBT must have at least one entry pointing to an SBD. Add a check to avoid SDBTs with out payload (SDBs) when enlarging the buffer setup. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit 7dd6b199df46e871e6e0d0cd7e4f71dc07dfd53c Author: Thomas Richter Date: Fri Nov 22 15:29:54 2019 +0100 s390/cpum_sf: Use TEAR_REG macro consistantly The macro TEAR_REG() saves the last used SDBT address in the perf_hw_event structure. This is also done by function hw_reset_registers() which is a one-liner and simply uses macro TEAR_REG(). Remove function hw_reset_registers(), which is only used one time and use macro TEAR_REG() instead. This macro is used throughout the code anyway. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit c17a7c6ee8177e0da998784c06f37fc093507c5b Author: Thomas Richter Date: Fri Nov 22 13:42:55 2019 +0100 s390/cpum_sf: Remove unnecessary check for pending SDBs In interrupt handling the function extend_sampling_buffer() is called after checking for a possibly extension. This check is not necessary as the called function itself performs this check again. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit 532da3de70b207be2b98cd5fb966e3915c8872c3 Author: Thomas Richter Date: Thu Nov 21 15:46:02 2019 +0100 s390/cpum_sf: Replace function name in debug statements Replace hard coded function names in debug statements by the "%s ...", __func__ construct suggested by checkpatch.pl script. Use consistent debug print format of the form variable blank value. Also add leading 0x for all hex values. Print allocated page addresses consistantly as hex numbers with leading 0x. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit a9f2f6865d784477e1c7b59269d3a384abafd9ca Author: Gerald Schaefer Date: Tue Nov 19 12:30:53 2019 +0100 s390/kaslr: store KASLR offset for early dumps The KASLR offset is added to vmcoreinfo in arch_crash_save_vmcoreinfo(), so that it can be found by crash when processing kernel dumps. However, arch_crash_save_vmcoreinfo() is called during a subsys_initcall, so if the kernel crashes before that, we have no vmcoreinfo and no KASLR offset. Fix this by storing the KASLR offset in the lowcore, where the vmcore_info pointer will be stored, and where it can be found by crash. In order to make it distinguishable from a real vmcore_info pointer, mark it as uneven (KASLR offset itself is aligned to THREAD_SIZE). When arch_crash_save_vmcoreinfo() stores the real vmcore_info pointer in the lowcore, it overwrites the KASLR offset. At that point, the KASLR offset is not yet added to vmcoreinfo, so we also need to move the mem_assign_absolute() behind the vmcoreinfo_append_str(). Fixes: b2d24b97b2a9 ("s390/kernel: add support for kernel address space layout randomization (KASLR)") Cc: # v5.2+ Signed-off-by: Gerald Schaefer Signed-off-by: Vasily Gorbik commit e76e69611e944ecc38aaf8fe3a7bebdc3c5daf84 Author: Vasily Gorbik Date: Fri Nov 22 16:49:13 2019 +0100 s390/unwind: stop gracefully at task pt_regs Consider reaching task pt_regs graceful unwinder termination. Task pt_regs itself never contains a valid state to which a task might return within the kernel context (user task pt_regs is a special case). Since we already avoid printing user task pt_regs and in most cases we don't even bother filling task pt_regs psw and r15 with something reasonable simply skip task pt_regs altogether. With this change unwind_error() now accurately represent whether unwinder reached task pt_regs successfully or failed along the way. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit cb7948e8c3f18f7ff0ab7d0fa1e6b108d938cdd6 Author: Vasily Gorbik Date: Fri Nov 22 17:15:35 2019 +0100 s390/head64: correct init_task stack setup Add missing allocation of pt_regs at the bottom of the stack. This makes it consistent with other stack setup cases and also what stack unwinder expects. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 97806dfb6f3838ee4b7bc69e6f160d83eadbc74a Author: Vasily Gorbik Date: Fri Nov 22 15:58:42 2019 +0100 s390/unwind: make reuse_sp default when unwinding pt_regs Currently unwinder yields 2 entries when pt_regs are met: sp="address of pt_regs itself" ip=pt_regs->psw sp=pt_regs->gprs[15] ip="r14 from stack frame pointed by pt_regs->gprs[15]" And neither of those 2 states (combination of sp and ip) ever happened. reuse_sp has been introduced by commit a1d863ac3e10 ("s390/unwind: fix mixing regs and sp"). reuse_sp=true makes unwinder keen to produce the following result, when pt_regs are given (as an arg to unwind_start): sp=pt_regs->gprs[15] ip=pt_regs->psw sp=pt_regs->gprs[15] ip="r14 from stack frame pointed by pt_regs->gprs[15]" The first state is an actual state in which a task was when pt_regs were collected. The second state is marked unreliable and is for debugging purposes to cover the case when a task has been interrupted in between stack frame allocation and writing back_chain - in this case r14 might show an actual caller. Make unwinder behaviour enabled via reuse_sp=true default and drop the special case handling. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 67f5593419878798bb306632cdca0698a2dd3cbd Author: Vasily Gorbik Date: Fri Nov 22 15:53:30 2019 +0100 s390/unwind: report an error if pt_regs are not on stack If unwinder is looking at pt_regs which is not on stack then something went wrong and an error has to be reported rather than successful unwinding termination. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 7bcaad1f9fac889f5fcd1a383acf7e00d006da41 Author: Vasily Gorbik Date: Fri Nov 22 13:12:57 2019 +0100 s390: avoid misusing CALL_ON_STACK for task stack setup CALL_ON_STACK is intended to be used for temporary stack switching with potential return to the caller. When CALL_ON_STACK is misused to switch from nodat stack to task stack back_chain information would later lead stack unwinder from task stack into (per cpu) nodat stack which is reused for other purposes. This would yield confusing unwinding result or errors. To avoid that introduce CALL_ON_STACK_NORETURN to be used instead. It makes sure that back_chain is zeroed and unwinder finishes gracefully ending up at task pt_regs. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 7579425777c0d802237e0d59ae395e8cf60723e1 Author: Vasily Gorbik Date: Fri Nov 22 12:47:52 2019 +0100 s390: correct CALL_ON_STACK back_chain saving Currently CALL_ON_STACK saves r15 as back_chain in the first stack frame of the stack we about to switch to. But if a function which uses CALL_ON_STACK calls other function it allocates a stack frame for a callee. In this case r15 is pointing to a callee stack frame and not a stack frame of function itself. This results in dummy unwinding entry with random sp and ip values. Introduce and utilize current_frame_address macro to get an address of actual function stack frame. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 103b4cca60d2c8c51f1290cc984b7046ccb8b46d Author: Vasily Gorbik Date: Fri Nov 22 12:35:34 2019 +0100 s390/unwind: unify task is current checks Avoid mixture of task == NULL and task == current meaning the same thing and simply always initialize task with current in unwind_start. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 7f28dad395243c5026d649136823bbc40029a828 Author: Vasily Gorbik Date: Fri Nov 22 12:19:16 2019 +0100 s390: disable preemption when switching to nodat stack with CALL_ON_STACK Make sure preemption is disabled when temporary switching to nodat stack with CALL_ON_STACK helper, because nodat stack is per cpu. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit c2e06e15ad92bad94b54df257c683f7e715238a1 Author: Vasily Gorbik Date: Fri Nov 22 12:08:44 2019 +0100 s390: always inline disabled_wait disabled_wait uses _THIS_IP_ and assumes that compiler would inline it. Make sure this assumption is always correct by utilizing __always_inline. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 5a5525b0488ce31e19065f8527dbf50266b5b712 Author: Heiko Carstens Date: Mon Nov 18 09:38:37 2019 +0100 s390/vdso: fix getcpu getcpu reads the required values for cpu and node with two instructions. This might lead to an inconsistent result if user space gets preempted and migrated to a different CPU between the two instructions. Fix this by using just a single instruction to read both values at once. This is currently rather a theoretical bug, since there is no real NUMA support available (except for NUMA emulation). Reviewed-by: Christian Borntraeger Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit a2308c11ecbc3471ebb7435ee8075815b1502ef0 Author: Heiko Carstens Date: Mon Nov 18 13:09:52 2019 +0100 s390/smp,vdso: fix ASCE handling When a secondary CPU is brought up it must initialize its control registers. CPU A which triggers that a secondary CPU B is brought up stores its control register contents into the lowcore of new CPU B, which then loads these values on startup. This is problematic in various ways: the control register which contains the home space ASCE will correctly contain the kernel ASCE; however control registers for primary and secondary ASCEs are initialized with whatever values were present in CPU A. Typically: - the primary ASCE will contain the user process ASCE of the process that triggered onlining of CPU B. - the secondary ASCE will contain the percpu VDSO ASCE of CPU A. Due to lazy ASCE handling we may also end up with other combinations. When then CPU B switches to a different process (!= idle) it will fixup the primary ASCE. However the problem is that the (wrong) ASCE from CPU A was loaded into control register 1: as soon as an ASCE is attached (aka loaded) a CPU is free to generate TLB entries using that address space. Even though it is very unlikey that CPU B will actually generate such entries, this could result in TLB entries of the address space of the process that ran on CPU A. These entries shouldn't exist at all and could cause problems later on. Furthermore the secondary ASCE of CPU B will not be updated correctly. This means that processes may see wrong results or even crash if they access VDSO data on CPU B. The correct VDSO ASCE will eventually be loaded on return to user space as soon as the kernel executed a call to strnlen_user or an atomic futex operation on CPU B. Fix both issues by intializing the to be loaded control register contents with the correct ASCEs and also enforce (re-)loading of the ASCEs upon first context switch and return to user space. Fixes: 0aaba41b58bc ("s390: remove all code using the access register mode") Cc: stable@vger.kernel.org # v4.15+ Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 6733775a92eacd612ac88afa0fd922e4ffeb2bc7 Author: Harald Freudenberger Date: Wed Nov 20 11:44:31 2019 +0100 s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR This patch introduces support for a new architectured reply code 0x8B indicating that a hypervisor layer (if any) has rejected an ap message. Linux may run as a guest on top of a hypervisor like zVM or KVM. So the crypto hardware seen by the ap bus may be restricted by the hypervisor for example only a subset like only clear key crypto requests may be supported. Other requests will be filtered out - rejected by the hypervisor. The new reply code 0x8B will appear in such cases and needs to get recognized by the ap bus and zcrypt device driver zoo. Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 914d52e46490b6599b7f03fad233f4f19bf23cf7 Author: Ilya Leoshkevich Date: Thu Jul 4 16:18:15 2019 +0200 s390: implement perf_arch_fetch_caller_regs On s390 bpf_get_stack_raw_tp() returns 0 entries for both kernel and user stacks. While there is no practical unwinding solution for userspace on s390 at this moment, there certainly is a kernel unwinder. However, it is not properly integrated with BPF. In order to start unwinding, bpf_get_stack_raw_tp() obtains the current kernel register values using perf_fetch_caller_regs(), which is not implemented for s390. The actual unwinding then happens by passing those registers to perf_callchain_kernel(). Implement perf_arch_fetch_caller_regs() for s390, where __builtin_frame_address(0) points to back_chain. Signed-off-by: Ilya Leoshkevich Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 9d9043f6a81713248d82d88983c06b1eaedda287 Author: Max Filippov Date: Fri Nov 29 01:25:20 2019 -0800 xtensa: clean up system_call/xtensa_rt_sigreturn interaction system_call assembly code always pushes pointer to struct pt_regs as the last additional parameter for all system calls. The only user of this feature is xtensa_rt_sigreturn. Avoid this special case. Define xtensa_rt_sigreturn as accepting no argiments. Use current_pt_regs to get pointer to struct pt_regs in xtensa_rt_sigreturn. Don't pass additional parameter from system_call code. Signed-off-by: Max Filippov commit 02ce94c229251555ac726ecfebe3458ef5905fa9 Author: Max Filippov Date: Fri Nov 29 14:54:06 2019 -0800 xtensa: fix system_call interaction with ptrace Don't overwrite return value if system call was cancelled at entry by ptrace. Return status code from do_syscall_trace_enter so that pt_regs::syscall doesn't need to be changed to skip syscall. Signed-off-by: Max Filippov commit ba9c1d65991a8be2e160447dd06eb803cbb9ba61 Author: Max Filippov Date: Mon Nov 25 11:51:45 2019 -0800 xtensa: rearrange syscall tracing system_call saves and restores syscall number across system call to make clone and execv entry and exit tracing match. This complicates things when syscall code may be changed by ptrace. Preserve syscall code in copy_thread and start_thread directly instead of doing tricks in system_call. Signed-off-by: Max Filippov commit 2745aea6750ff0d2c48285d25bdb00e5b636ec8b Author: Thadeu Lima de Souza Cascardo Date: Thu Nov 28 15:58:06 2019 -0300 selftests: pmtu: use -oneline for ip route list cache Some versions of iproute2 will output more than one line per entry, which will cause the test to fail, like: TEST: ipv6: list and flush cached exceptions [FAIL] can't list cached exceptions That happens, for example, with iproute2 4.15.0. When using the -oneline option, this will work just fine: TEST: ipv6: list and flush cached exceptions [ OK ] This also works just fine with a more recent version of iproute2, like 5.4.0. For some reason, two lines are printed for the IPv4 test no matter what version of iproute2 is used. Use the same -oneline parameter there instead of counting the lines twice. Fixes: b964641e9925 ("selftests: pmtu: Make list_flush_ipv6_exception test more demanding") Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Stefano Brivio Signed-off-by: David S. Miller commit d8d0470875aad437053b6743ef24eb9bd72d9789 Merge: a820e450390a 20c55f250618 Author: Jiri Kosina Date: Fri Nov 29 20:39:21 2019 +0100 Merge branch 'for-5.5/whiskers' into for-linus - robustification of tablet mode support in google-whiskers driver (Dmitry Torokhov) commit a820e450390a5a0a9a2174e79326318f4703668b Merge: 2fa55328f18f 61005d65b6c7 Author: Jiri Kosina Date: Fri Nov 29 20:37:55 2019 +0100 Merge branch 'for-5.5/logitech' into for-linus - Support for Logitech G15 (Hans de Goede) - silencing of non-informative error flow in dmesg from logitechi-hiddpp (Hans de Goede) commit 2fa55328f18f38bb85dc57da8c34616430c7bffb Merge: b49b511f417a 76f8cf6e0cfd Author: Jiri Kosina Date: Fri Nov 29 20:37:10 2019 +0100 Merge branch 'for-5.5/ish' into for-linus - typo fix (Geert Uytterhoeven) commit b49b511f417ada27e5e4a8448bac5337e24f3c39 Merge: 09f5429ddf78 4f6585815084 Author: Jiri Kosina Date: Fri Nov 29 20:36:45 2019 +0100 Merge branch 'for-5.5/i2c' into for-linus - removal of superfluous delay (You-Sheng Yang) commit 09f5429ddf78477b94f1f3c23063b53f127fbbe6 Merge: b746a1a2860f b05cec61c703 Author: Jiri Kosina Date: Fri Nov 29 20:36:00 2019 +0100 Merge branch 'for-5.5/hidraw' into for-linus - printk() -> pr_*() cleanup (Rishi Gupta) commit b746a1a2860f4a918f32d10dc569115d282aaf2f Merge: 8725aa4fa7de b03e5774d51f Author: Jiri Kosina Date: Fri Nov 29 20:34:28 2019 +0100 Merge branch 'for-5.5/core' into for-linus - hid_have_special_driver[] cleanup for LED devices (Heiner Kallweit) - HID parser improvements (Blaž Hrastnik, Candle Sun) commit 77b91c1a525d84cb560a4baef6f5f548b5c23f80 Author: Arnaldo Carvalho de Melo Date: Fri Nov 29 15:47:51 2019 -0300 perf machine: Fill map_symbol->maps in append_inlines() to fix segfault I forgot to fill in the map_symbol->maps field in append_inlines() which then makes code down the line segfault when trying to deref it. It doesn't make any sense to have an addr_location with its 'map' member not NULL while its 'maps' is NULL, after all al->maps is where al->map is in. It is done that way so that we don't have to have in each 'struct map' a pointer to the 'struct maps' it is in, as we had in the past when we would have 'map->mg', before 'struct maps' was combined with 'struct map_groups', because there was always a one-to-one relationship for these structs. This fixes a segfault when processing DWARF callgraphs in 'perf report'. Reported-by: Jiri Olsa Cc: Adrian Hunter Cc: Namhyung Kim Fixes: 08f6680e627e ("perf tools: Add a 'struct map_groups' pointer to 'struct map_symbol'") Link: http://lore.kernel.org/lkml/20191129160631.GD26963@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 3525d0ccd92c760d22b8ee26f484fb7e9941c99c Merge: 80b10aa92448 013a53f2d25a Author: Paolo Bonzini Date: Fri Nov 29 19:20:08 2019 +0100 Merge tag 'kvm-ppc-uvmem-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD KVM: Add support for secure guests under the Protected Execution Framework (PEF) Ultravisor on POWER. This enables secure memory to be represented as device memory, which provides a way for the host to keep track of which pages of a secure guest have been moved into secure memory managed by the ultravisor and are no longer accessible by the host, and manage movement of pages between secure and normal memory. commit 80b10aa92448915d35e9f65591e9325397dc40fe Author: Wainer dos Santos Moschetta Date: Fri Nov 29 13:17:30 2019 -0500 Documentation: kvm: Fix mention to number of ioctls classes In api.txt it is said that KVM ioctls belong to three classes but in reality it is four. Fixed this, but do not count categories anymore to avoid such as outdated information in the future. Signed-off-by: Wainer dos Santos Moschetta Signed-off-by: Paolo Bonzini commit aa4c3967756c6c576a38a23ac511be211462a6b7 Author: Jens Axboe Date: Fri Nov 29 10:14:00 2019 -0700 io_uring: fix missing kmap() declaration on powerpc Christophe reports that current master fails building on powerpc with this error: CC fs/io_uring.o fs/io_uring.c: In function ‘loop_rw_iter’: fs/io_uring.c:1628:21: error: implicit declaration of function ‘kmap’ [-Werror=implicit-function-declaration] iovec.iov_base = kmap(iter->bvec->bv_page) ^ fs/io_uring.c:1628:19: warning: assignment makes pointer from integer without a cast [-Wint-conversion] iovec.iov_base = kmap(iter->bvec->bv_page) ^ fs/io_uring.c:1643:4: error: implicit declaration of function ‘kunmap’ [-Werror=implicit-function-declaration] kunmap(iter->bvec->bv_page); ^ which is caused by a missing highmem.h include. Fix it by including it. Fixes: 311ae9e159d8 ("io_uring: fix dead-hung for non-iter fixed rw") Reported-by: Christophe Leroy Tested-by: Christophe Leroy Signed-off-by: Jens Axboe commit fa7f7e7354957422b43ea950b672d3e731f27e68 Author: Ian Rogers Date: Tue Nov 26 15:59:13 2019 -0800 perf jit: Move test functionality in to a test Adds a test for minimal jit_write_elf functionality. Committer testing: # perf test jit 61: Test jit_write_elf : Ok # # perf test -v jit 61: Test jit_write_elf : --- start --- test child forked, pid 10460 Writing jit code to: /tmp/perf-test-KqxURR test child finished with 0 ---- end ---- Test jit_write_elf: Ok # Committer notes: Fix up the case where HAVE_JITDUMP is no defined. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexios Zavras Cc: Allison Randal Cc: Florian Fainelli Cc: Greg Kroah-Hartman Cc: Jiri Olsa Cc: Kate Stewart Cc: Leo Yan Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Stephane Eranian Cc: Thomas Gleixner Link: http://lore.kernel.org/lkml/20191126235913.41855-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 704e2f5b700da4c912635cf161c3e982737eb89e Author: Andi Kleen Date: Wed Nov 20 16:15:22 2019 -0800 perf stat: Use affinity for enabling/disabling events Restructure event enabling/disabling to use affinity, which minimizes the number of IPIs needed. Before on a large test case with 94 CPUs: % time seconds usecs/call calls errors syscall ------ ----------- ----------- --------- --------- ---------------- 54.65 1.899986 22 84812 660 ioctl after: 39.21 0.930451 10 84796 644 ioctl Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-13-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 363fb12189d58ebc60456561b8540d68013782a6 Author: Andi Kleen Date: Wed Nov 20 16:15:21 2019 -0800 perf evsel: Add functions to enable/disable for a specific CPU Refactor the existing functions to use these functions internally. Used in the next patch. Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-12-andi@firstfloor.org Link: http://lore.kernel.org/lkml/20191127232657.GL84886@tassilo.jf.intel.com # Fix Signed-off-by: Arnaldo Carvalho de Melo commit 4b49ab708d1804bc8b2fcdde79844b8bc98f7ef6 Author: Andi Kleen Date: Wed Nov 20 16:15:20 2019 -0800 perf stat: Use affinity for reading Restructure event reading to use affinity to minimize the number of IPIs needed. Before on a large test case with 94 CPUs: % time seconds usecs/call calls errors syscall ------ ----------- ----------- --------- --------- ---------------- 3.16 0.106079 4 22082 read After: 3.43 0.081295 3 22082 read Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-11-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 4804e0111662d7d89edf4e767a64c6f7e4778bb1 Author: Andi Kleen Date: Wed Nov 20 16:15:19 2019 -0800 perf stat: Use affinity for opening events Restructure the event opening in perf stat to cycle through the events by CPU after setting affinity to that CPU. This eliminates IPI overhead in the perf API. We have to loop through the CPU in the outter builtin-stat code instead of leaving that to low level functions. It has to change the weak group fallback strategy slightly. Since we cannot easily undo the opens for other CPUs move the weak group retry to a separate loop. Before with a large test case with 94 CPUs: % time seconds usecs/call calls errors syscall ------ ----------- ----------- --------- --------- ---------------- 42.75 4.050910 67 60046 110 perf_event_open After: 26.86 0.944396 16 58069 110 perf_event_open (the number changes slightly because the weak group retries work differently and the test case relies on weak groups) Committer notes: Added one of the hunks in a patch provided by Andi after I noticed that the "event times" 'perf test' entry was segfaulting. Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-10-andi@firstfloor.org Link: http://lore.kernel.org/lkml/20191127232657.GL84886@tassilo.jf.intel.com # Fix Signed-off-by: Arnaldo Carvalho de Melo commit e0e6a6ca3ac211cc07486330a2b89f41ea31b4dd Author: Andi Kleen Date: Wed Nov 20 16:15:18 2019 -0800 perf stat: Factor out open error handling Factor out the open error handling into a separate function. This is useful for followon patches who need to duplicate this. No behavior change intended. Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-9-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 7736627b865defff2430e95df235b4aa2450bc37 Author: Andi Kleen Date: Wed Nov 20 16:15:17 2019 -0800 perf stat: Use affinity for closing file descriptors Closing a perf fd can also trigger an IPI to the target CPU. Use the same affinity technique as we use for reading/enabling events to closing to optimize the CPU transitions. Before on a large test case with 94 CPUs: % time seconds usecs/call calls errors syscall ------ ----------- ----------- --------- --------- ---------------- 32.56 3.085463 50 61483 close After: 10.54 0.735704 11 61485 close Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-8-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 99d6141d677a8cd0b35390a29527c8def42538b1 Author: Andi Kleen Date: Wed Nov 20 16:15:16 2019 -0800 perf evsel: Add functions to close evsel on a CPU Refactor the existing all CPU function to use the per CPU close internally. Export APIs to close per CPU. Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-7-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit a8cbe40fe9f4ba499cc60b8b6a6851c2c1963797 Author: Andi Kleen Date: Wed Nov 20 16:15:15 2019 -0800 perf evsel: Add iterator to iterate over events ordered by CPU Add some common code that is needed to iterate over all events in CPU order. Used in followon patches Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-6-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit a2408a70368ade9c99de27da78d49416313b8833 Author: Andi Kleen Date: Wed Nov 20 16:15:14 2019 -0800 perf evlist: Maintain evlist->all_cpus Maintain a cpumap in the evlist that is the union of all the cpus of the events. This needs a cpumap merge operation, which is added together with tests. v2: Add tests for cpu map merge Fix handling of duplicates Rename _update to _merge Factor out sorting. Fix handling of NULL maps in merge v3: Add comments and empty lines to _merge Committer testing: # perf test "Merge cpu map" 52: Merge cpu map : Ok # Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Link: http://lore.kernel.org/lkml/20191121001522.180827-5-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 7074674e7338863e6404909c9761d4d3a610a379 Author: Andi Kleen Date: Wed Nov 20 16:15:13 2019 -0800 perf cpumap: Maintain cpumaps ordered and without dups Enforce this in _trim() Needed for followon change. Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-4-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit d2cd795c4ece1a24fda170c35eeb4f17d9826cbb Author: Jaroslav Kysela Date: Fri Nov 29 15:40:27 2019 +0100 ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen The auto-parser assigns the bass speaker to DAC3 (NID 0x06) which is without the volume control. I do not see a reason to use DAC2, because the shared output to all speakers produces the sufficient and well balanced sound. The stereo support is enough for this purpose (laptop). Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20191129144027.14765-1-perex@perex.cz Signed-off-by: Takashi Iwai commit 609f5485344b05a7eaffe9fdd09d42ad1c501cdf Author: Kai Vehmanen Date: Fri Nov 29 16:37:56 2019 +0200 ALSA: hda: hdmi - preserve non-MST PCM routing for Intel platforms Commit 5398e94fb753 ("ALSA: hda - Add DP-MST support for NVIDIA codecs") introduced a slight change of behaviour how non-MST monitors are assigned to PCMs on Intel platforms. In the drm_audio_component.h interface, the third parameter to pin_eld_notify() is pipe number. On Intel platforms, this value is -1 for MST. On other platforms, a non-zero pipe id is used to signal MST use. This difference leads to some subtle differences in hdmi_find_pcm_slot() with regards to how non-MST monitors are assigned to PCMs. This patch restores the original behaviour on Intel platforms while keeping the new allocation policy on other platforms. Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20191129143756.23941-2-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit 0c0fe9e6b95ce2e9e2c83bef5563cf223e849eda Author: Kai Vehmanen Date: Fri Nov 29 16:37:55 2019 +0200 ALSA: hda: hdmi - fix kernel oops caused by invalid PCM idx Add additional check in hdmi_find_pcm_slot() to not return a pcm index that points to unallocated pcm. This could happen if codec driver is set up in codec->mst_no_extra_pcms mode. On some platforms, this leads to a kernel oops in snd_ctl_notify(), called via update_eld(). BugLink: https://github.com/thesofproject/linux/issues/1536 Fixes: 5398e94fb753 ALSA: hda - Add DP-MST support for NVIDIA codecs Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20191129143756.23941-1-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit e1e047ace8cef6d143f38c7d769753f133becbe6 Author: Marek Szyprowski Date: Tue Nov 12 11:47:34 2019 +0100 PM / devfreq: Add missing locking while setting suspend_freq Commit 2abb0d5268ae ("PM / devfreq: Lock devfreq in trans_stat_show") revealed a missing locking while calling devfreq_update_status() function during suspend/resume cycle. Code analysis revealed that devfreq_set_target() function was called without needed locks held for setting device specific suspend_freq if such has been defined. This patch fixes that by adding the needed locking, what fixes following kernel warning on Exynos4412-based OdroidU3 board during system suspend: PM: suspend entry (deep) Filesystems sync: 0.002 seconds Freezing user space processes ... (elapsed 0.001 seconds) done. OOM killer disabled. Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1385 at drivers/devfreq/devfreq.c:204 devfreq_update_status+0xc0/0x188 Modules linked in: CPU: 2 PID: 1385 Comm: rtcwake Not tainted 5.4.0-rc6-next-20191111 #6848 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xb4/0xe0) [] (dump_stack) from [] (__warn+0xf4/0x10c) [] (__warn) from [] (warn_slowpath_fmt+0xb0/0xb8) [] (warn_slowpath_fmt) from [] (devfreq_update_status+0xc0/0x188) [] (devfreq_update_status) from [] (devfreq_set_target+0xb0/0x15c) [] (devfreq_set_target) from [] (devfreq_suspend+0x2c/0x64) [] (devfreq_suspend) from [] (dpm_suspend+0xa4/0x57c) [] (dpm_suspend) from [] (dpm_suspend_start+0x98/0xa0) [] (dpm_suspend_start) from [] (suspend_devices_and_enter+0xec/0xc74) [] (suspend_devices_and_enter) from [] (pm_suspend+0x340/0x410) [] (pm_suspend) from [] (state_store+0x6c/0xc8) [] (state_store) from [] (kernfs_fop_write+0x10c/0x228) [] (kernfs_fop_write) from [] (__vfs_write+0x30/0x1d0) [] (__vfs_write) from [] (vfs_write+0xa4/0x180) [] (vfs_write) from [] (ksys_write+0x60/0xd8) [] (ksys_write) from [] (ret_fast_syscall+0x0/0x28) Exception stack(0xed3d7fa8 to 0xed3d7ff0) ... irq event stamp: 9667 hardirqs last enabled at (9679): [] _raw_spin_unlock_irq+0x20/0x58 hardirqs last disabled at (9698): [] __schedule+0xd8/0x818 softirqs last enabled at (9694): [] __do_softirq+0x4fc/0x5fc softirqs last disabled at (9719): [] irq_exit+0x16c/0x170 ---[ end trace 41ac5b57d046bdbc ]--- ------------[ cut here ]------------ Signed-off-by: Marek Szyprowski Acked-by: Chanwoo Choi Signed-off-by: Rafael J. Wysocki commit 2807273f5e88ed086d7d5d838fdee71e11e5085f Author: Christophe Leroy Date: Thu Nov 28 07:59:22 2019 +0000 powerpc/fixmap: fix crash with HIGHMEM Commit f2bb86937d86 ("powerpc/fixmap: don't clear fixmap area in paging_init()") removed the clearing of fixmap area in order to avoid clearing fixmapped areas set earlier. However unlike all other users of fixmap which use __set_fixmap(), HIGHMEM functions directly use __set_pte_at(). This means the page table must pre-exist, otherwise the following crash can be encoutered due to the lack of entry in the PGD. Oops: Kernel access of bad area, sig: 11 [#1] BE PAGE_SIZE=4K MMU=Hash PowerMac Modules linked in: CPU: 0 PID: 1 Comm: swapper Not tainted 5.4.0+ #2528 NIP: c0144ce8 LR: c0144ccc CTR: 00000080 REGS: ef0b5aa0 TRAP: 0300 Not tainted (5.4.0+) MSR: 00009032 CR: 44282842 XER: 00000000 DAR: fffdf000 DSISR: 42000000 GPR00: c0144ccc ef0b5b58 ef0b0000 fffdf000 fffdf000 00000000 c0000f7c 00000000 GPR08: c0833000 fffdf000 00000000 ef1c53c9 24042842 00000000 00000000 00000000 GPR16: 00000000 00000000 ef7e7358 effe8160 00000000 c08a9660 c0851644 00000004 GPR24: c08c70a8 00002dc2 00000000 00000001 00000201 effe8160 effe8160 00000000 NIP [c0144ce8] prep_new_page+0x138/0x178 LR [c0144ccc] prep_new_page+0x11c/0x178 Call Trace: [ef0b5b58] [c0144ccc] prep_new_page+0x11c/0x178 (unreliable) [ef0b5b88] [c0147218] get_page_from_freelist+0x1fc/0xd88 [ef0b5c38] [c0148328] __alloc_pages_nodemask+0xd4/0xbb4 [ef0b5cf8] [c0142ba8] __vmalloc_node_range+0x1b4/0x2e0 [ef0b5d38] [c0142dd0] vzalloc+0x48/0x58 [ef0b5d58] [c0301c8c] check_partition+0x58/0x244 [ef0b5d78] [c02ffe80] blk_add_partitions+0x44/0x2cc [ef0b5db8] [c01a32d8] bdev_disk_changed+0x68/0xfc [ef0b5de8] [c01a4494] __blkdev_get+0x290/0x460 [ef0b5e28] [c02fdd40] __device_add_disk+0x480/0x4d8 [ef0b5e68] [c0810688] brd_init+0xc0/0x188 [ef0b5e88] [c0005194] do_one_initcall+0x40/0x19c [ef0b5ee8] [c07dd4dc] kernel_init_freeable+0x164/0x230 [ef0b5f28] [c0005408] kernel_init+0x18/0x10c [ef0b5f38] [c0014274] ret_from_kernel_thread+0x14/0x1c Partially revert that commit to still clear the fixmap area dedicated to HIGHMEM. Fixes: f2bb86937d86 ("powerpc/fixmap: don't clear fixmap area in paging_init()") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/d42fa9747df5afa41e67b08e374c98d3b40529c9.1574927918.git.christophe.leroy@c-s.fr commit 6f090192f8225f52ba95d08785989688cb768cca Author: YueHaibing Date: Fri Nov 15 21:08:30 2019 +0800 x86/efi: remove unused variables commit ad723674d675 ("x86/efi: move common keyring handler functions to new file") leave this unused. Fixes: ad723674d675 ("x86/efi: move common keyring handler functions to new file") Reported-by: Hulk Robot Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20191115130830.13320-1-yuehaibing@huawei.com commit e0748539e3d594dd26f0d27a270f14720b22a406 Author: Kai-Heng Feng Date: Fri Nov 29 14:23:03 2019 +0800 x86/intel: Disable HPET on Intel Ice Lake platforms Like CFL and CFL-H, ICL SoC has skewed HPET timer once it hits PC10. So let's disable HPET on ICL. Signed-off-by: Kai-Heng Feng Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: bp@alien8.de Cc: feng.tang@intel.com Cc: harry.pan@intel.com Cc: hpa@zytor.com Link: https://lkml.kernel.org/r/20191129062303.18982-2-kai.heng.feng@canonical.com Signed-off-by: Ingo Molnar commit f8edbde885bbcab6a2b4a1b5ca614e6ccb807577 Author: Kai-Heng Feng Date: Fri Nov 29 14:23:02 2019 +0800 x86/intel: Disable HPET on Intel Coffee Lake H platforms Coffee Lake H SoC has similar behavior as Coffee Lake, skewed HPET timer once the SoCs entered PC10. So let's disable HPET on CFL-H platforms. Signed-off-by: Kai-Heng Feng Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: bp@alien8.de Cc: feng.tang@intel.com Cc: harry.pan@intel.com Cc: hpa@zytor.com Link: https://lkml.kernel.org/r/20191129062303.18982-1-kai.heng.feng@canonical.com Signed-off-by: Ingo Molnar commit 36a8015f89e40f7c9c91cc7e6d028fa288dad27b Author: Leonard Crestez Date: Tue Nov 26 17:17:13 2019 +0200 PM / QoS: Restore DEV_PM_QOS_MIN/MAX_FREQUENCY Support for adding per-device frequency limits was removed in commit 2aac8bdf7a0f ("PM: QoS: Drop frequency QoS types from device PM QoS") after cpufreq switched to use a new "freq_constraints" construct. Restore support for per-device freq limits but base this upon freq_constraints. This is primarily meant to be used by the devfreq subsystem. This removes the "static" marking on freq_qos_apply but does not export it for modules. Signed-off-by: Leonard Crestez Reviewed-by: Matthias Kaehlcke Tested-by: Matthias Kaehlcke Signed-off-by: Rafael J. Wysocki commit 342035f66c866f4ad750477b21b210e98d1f6818 Author: Leonard Crestez Date: Tue Nov 26 17:17:12 2019 +0200 PM / QoS: Reorder pm_qos/freq_qos/dev_pm_qos structs This allows dev_pm_qos to embed freq_qos structs, which is done in the next patch. Separate commit to make it easier to review. Signed-off-by: Leonard Crestez Reviewed-by: Matthias Kaehlcke Signed-off-by: Rafael J. Wysocki commit 14e087576081f4f3a6fc6a229166b05b65cf98e5 Author: Leonard Crestez Date: Tue Nov 26 17:17:10 2019 +0200 PM / QoS: Initial kunit test The pm_qos family of APIs are used in relatively difficult to reproduce scenarios such as thermal throttling so they benefit from unit testing. Start by adding basic tests from the the freq_qos APIs. It includes tests for issues that were brought up on mailing lists: https://patchwork.kernel.org/patch/11252425/#23017005 https://patchwork.kernel.org/patch/11253421/ Signed-off-by: Leonard Crestez Reviewed-by: Matthias Kaehlcke Signed-off-by: Rafael J. Wysocki commit c6a3aea93571a5393602256d8f74772bd64c8225 Author: Leonard Crestez Date: Tue Nov 26 17:17:11 2019 +0200 PM / QoS: Redefine FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX QOS requests for DEFAULT_VALUE are supposed to be ignored but this is not the case for FREQ_QOS_MAX. Adding one request for MAX_DEFAULT_VALUE and one for a real value will cause freq_qos_read_value to unexpectedly return MAX_DEFAULT_VALUE (-1). This happens because freq_qos max value is aggregated with PM_QOS_MIN but FREQ_QOS_MAX_DEFAULT_VALUE is (-1) so it's smaller than other values. Fix this by redefining FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX. Looking at current users for freq_qos it seems that none of them create requests for FREQ_QOS_MAX_DEFAULT_VALUE. Fixes: 77751a466ebd ("PM: QoS: Introduce frequency QoS") Signed-off-by: Leonard Crestez Reported-by: Matthias Kaehlcke Reviewed-by: Matthias Kaehlcke Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki commit 2a0efc77735b48c42aedbe99df1f8f91aa402f57 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:40:04 2019 +0800 power: avs: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Acked-by: Kevin Hilman Signed-off-by: Rafael J. Wysocki commit cde10f856a7de191a773d880bb524ea15084e1cc Author: Krzysztof Kozlowski Date: Thu Nov 21 04:19:15 2019 +0100 cpufreq: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 4d30d4a0441dac4452fcc188cd21536bedaec5df Author: Randy Dunlap Date: Thu Nov 28 14:38:03 2019 -0800 cpuidle: minor Kconfig help text fixes End sentences in help text with a period (aka full stop). Signed-off-by: Randy Dunlap Signed-off-by: Rafael J. Wysocki commit ba1e78a1dc0ca3e92f0be82279e6ba24177af7d6 Author: Rafael J. Wysocki Date: Thu Nov 21 19:41:51 2019 +0100 cpuidle: Drop disabled field from struct cpuidle_state After recent cpuidle updates the "disabled" field in struct cpuidle_state is only used by two drivers (intel_idle and shmobile cpuidle) for marking unusable idle states, but that may as well be achieved with the help of a state flag, so define an "unusable" idle state flag, CPUIDLE_FLAG_UNUSABLE, make the drivers in question use it instead of the "disabled" field and make the core set CPUIDLE_STATE_DISABLED_BY_DRIVER for the idle states with that flag set. After the above changes, the "disabled" field in struct cpuidle_state is not used any more, so drop it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki commit 656b4e639831a6110dab8cd7e557c41f87514869 Author: Krzysztof Kozlowski Date: Thu Nov 21 04:19:12 2019 +0100 cpuidle: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rafael J. Wysocki commit 627ead724eff33673597216f5020b72118827de4 Author: Vamshi K Sthambamkadi Date: Thu Nov 28 15:58:29 2019 +0530 ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() kmemleak reported backtrace: [] kmem_cache_alloc_trace+0x128/0x260 [<6677f215>] i2c_acpi_install_space_handler+0x4b/0xe0 [<1180f4fc>] i2c_register_adapter+0x186/0x400 [<6083baf7>] i2c_add_adapter+0x4e/0x70 [] intel_gmbus_setup+0x1a2/0x2c0 [i915] [<84cb69ae>] i915_driver_probe+0x8d8/0x13a0 [i915] [<81911d4b>] i915_pci_probe+0x48/0x160 [i915] [<4b159af1>] pci_device_probe+0xdc/0x160 [] really_probe+0x1ee/0x450 [] driver_probe_device+0x142/0x1b0 [] device_driver_attach+0x49/0x50 [] __driver_attach+0xc9/0x150 [] bus_for_each_dev+0x56/0xa0 [<80089bba>] driver_attach+0x19/0x20 [] bus_add_driver+0x177/0x220 [<7b29d8c7>] driver_register+0x56/0xf0 In i2c_acpi_remove_space_handler(), a leak occurs whenever the "data" parameter is initialized to 0 before being passed to acpi_bus_get_private_data(). This is because the NULL pointer check in acpi_bus_get_private_data() (condition->if(!*data)) returns EINVAL and, in consequence, memory is never freed in i2c_acpi_remove_space_handler(). Fix the NULL pointer check in acpi_bus_get_private_data() to follow the analogous check in acpi_get_data_full(). Signed-off-by: Vamshi K Sthambamkadi [ rjw: Subject & changelog ] Cc: All applicable Signed-off-by: Rafael J. Wysocki commit 6e78c01fde9023e0701f3af880c1fd9de6e4e8e3 Author: Joel Stanley Date: Fri Nov 29 10:49:30 2019 +1030 Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()" This reverts commit f2538f999345405f7d2e1194c0c8efa4e11f7b3a. The patch stopped JFFS2 from being able to mount an existing filesystem with the following errors: jffs2: error: (77) jffs2_build_inode_fragtree: Add node to tree failed -22 jffs2: error: (77) jffs2_do_read_inode_internal: Failed to build final fragtree for inode #5377: error -22 Fixes: f2538f999345 ("jffs2: Fix possible null-pointer dereferences...") Cc: stable@vger.kernel.org Suggested-by: Hou Tao Signed-off-by: Joel Stanley Signed-off-by: Richard Weinberger commit feb174069fd72ca92feca7fb3a57752f86986a4c Author: Krzysztof Kozlowski Date: Wed Nov 20 21:43:10 2019 +0800 ACPI: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rafael J. Wysocki commit 833a426cc471b6088011b3d67f1dc4e147614647 Author: Francesco Ruggeri Date: Tue Nov 19 21:47:27 2019 -0800 ACPI: OSL: only free map once in osl.c acpi_os_map_cleanup checks map->refcount outside of acpi_ioremap_lock before freeing the map. This creates a race condition the can result in the map being freed more than once. A panic can be caused by running for ((i=0; i<10; i++)) do for ((j=0; j<100000; j++)) do cat /sys/firmware/acpi/tables/data/BERT >/dev/null done & done This patch makes sure that only the process that drops the reference to 0 does the freeing. Fixes: b7c1fadd6c2e ("ACPI: Do not use krefs under a mutex in osl.c") Signed-off-by: Francesco Ruggeri Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> Cc: All applicable Signed-off-by: Rafael J. Wysocki commit 90ed9c639c1b53556f87b1c5031c7e4c57285a92 Author: Hans de Goede Date: Mon Nov 18 16:35:56 2019 +0100 ACPI: button: Add DMI quirk for Acer Switch 10 SW5-032 lid-switch The Acer Switch 10 SW5-032 _LID method is quite broken, it looks like this: Method (_LID, 0, NotSerialized) // _LID: Lid Status { If ((STAS & One)) { Local0 = One PBCG |= 0x05000000 HMCG |= 0x05000000 } Else { Local0 = Zero PBCG &= 0xF0FFFFFF HMCG &= 0xF0FFFFFF } ^^PCI0.GFX0.CLID = Local0 Return (Local0) } The problem here is the accesses to the PBCG and HMCG, these are the pinconf0 registers for the power, resp. the home button GPIO, e.g. PBCG is declared as: OperationRegion (PWBT, SystemMemory, 0xFED0E080, 0x10) Field (PWBT, DWordAcc, NoLock, Preserve) { PBCG, 32, PBV1, 32, PBSA, 32, PBV2, 32 } Where 0xFED0E000 is the base address of the GPO2 device and 0x80 is the offset for the pin used for the powerbutton. The problem here is this line in _LID: PBCG |= 0x05000000 This changes the trigger flags of the GPIO, changing when it generates interrupts. Note it does not clear the original flags. Linux uses an edge triggered interrupt on both positive and negative edges. This |= adds the BYT_TRIG_LVL flag to this, so now it is turned into a level interrupt which fires both when low and high, iow it simply always fires leading to an interrupt storm, the tablet immediately waking up from suspend again, etc. There is nothing we can do to fix this, except for a DSDT override, which the user needs to do manually. The only thing we can do is never call _LID, which requires disabling the lid-switch functionality altogether. This commit adds a quirk for this, as no lid-switch function is better then the interrupt storm. A user manually applying a DSDT override can also override the quirk on the kernel cmdline. Signed-off-by: Hans de Goede Reviewed-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit df786c9b947639aedbc7bb44b5dae2a7824af360 Author: Stanislav Fomichev Date: Wed Nov 27 14:57:59 2019 -0800 bpf: Force .BTF section start to zero when dumping from vmlinux While trying to figure out why fentry_fexit selftest doesn't pass for me (old pahole, broken BTF), I found out that my latest patch can break vmlinux .BTF generation. objcopy preserves section start when doing --only-section, so there is a chance (depending on where pahole inserts .BTF section) to have leading empty zeroes. Let's explicitly force section offset to zero. Before: $ objcopy --set-section-flags .BTF=alloc -O binary \ --only-section=.BTF vmlinux .btf.vmlinux.bin $ xxd .btf.vmlinux.bin | head -n1 00000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................ After: $ objcopy --change-section-address .BTF=0 \ --set-section-flags .BTF=alloc -O binary \ --only-section=.BTF vmlinux .btf.vmlinux.bin $ xxd .btf.vmlinux.bin | head -n1 00000000: 9feb 0100 1800 0000 0000 0000 80e1 1c00 ................ ^BTF magic As part of this change, I'm also dropping '2>/dev/null' from objcopy invocation to be able to catch possible other issues (objcopy doesn't produce any warnings for me anymore, it did before with --dump-section). Fixes: da5fb18225b4 ("bpf: Support pre-2.25-binutils objcopy for vmlinux BTF") Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Cc: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191127225759.39923-1-sdf@google.com commit 5a43b87b3c62ad149ba6e9d0d3e5c0e5da02a5ca Author: Srinivas Pandruvada Date: Thu Nov 28 07:08:24 2019 -0800 x86/mce/therm_throt: Mask out read-only and reserved MSR bits While writing to MSR IA32_THERM_STATUS/IA32_PKG_THERM_STATUS, avoid writing 1 to read only and reserved fields because updating some fields generates exception. [ bp: Vertically align for better readability. ] Fixes: f6656208f04e ("x86/mce/therm_throt: Optimize notifications of thermal throttle") Reported-by: Dominik Brodowski Tested-by: Dominik Brodowski Signed-off-by: Srinivas Pandruvada Signed-off-by: Borislav Petkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: linux-edac Cc: Thomas Gleixner Cc: Tony Luck Cc: x86-ml Link: https://lkml.kernel.org/r/20191128150824.22413-1-srinivas.pandruvada@linux.intel.com commit 18a110b022a5c02e7dc9f6109d0bd93e58ac6ebb Author: Florian Westphal Date: Fri Nov 15 12:39:23 2019 +0100 netfilter: ctnetlink: netns exit must wait for callbacks Curtis Taylor and Jon Maxwell reported and debugged a crash on 3.10 based kernel. Crash occurs in ctnetlink_conntrack_events because net->nfnl socket is NULL. The nfnl socket was set to NULL by netns destruction running on another cpu. The exiting network namespace calls the relevant destructors in the following order: 1. ctnetlink_net_exit_batch This nulls out the event callback pointer in struct netns. 2. nfnetlink_net_exit_batch This nulls net->nfnl socket and frees it. 3. nf_conntrack_cleanup_net_list This removes all remaining conntrack entries. This is order is correct. The only explanation for the crash so ar is: cpu1: conntrack is dying, eviction occurs: -> nf_ct_delete() -> nf_conntrack_event_report \ -> nf_conntrack_eventmask_report -> notify->fcn() (== ctnetlink_conntrack_events). cpu1: a. fetches rcu protected pointer to obtain ctnetlink event callback. b. gets interrupted. cpu2: runs netns exit handlers: a runs ctnetlink destructor, event cb pointer set to NULL. b runs nfnetlink destructor, nfnl socket is closed and set to NULL. cpu1: c. resumes and trips over NULL net->nfnl. Problem appears to be that ctnetlink_net_exit_batch only prevents future callers of nf_conntrack_eventmask_report() from obtaining the callback. It doesn't wait of other cpus that might have already obtained the callbacks address. I don't see anything in upstream kernels that would prevent similar crash: We need to wait for all cpus to have exited the event callback. Fixes: 9592a5c01e79dbc59eb56fa ("netfilter: ctnetlink: netns support") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit aaa34256284c8fffddfda88078d5dda2a380cd94 Merge: 61183b056b49 d34910e1751b Author: David S. Miller Date: Thu Nov 28 23:09:15 2019 -0800 Merge branch 'tipc-Fix-some-bugs-at-socket-layer' Tung Nguyen says: ==================== tipc: Fix some bugs at socket layer This series fixes some bugs at socket layer. ==================== Signed-off-by: David S. Miller commit d34910e1751be79672db9cc61ca8892fbb4763f2 Author: Tung Nguyen Date: Thu Nov 28 10:10:08 2019 +0700 tipc: fix duplicate SYN messages under link congestion Scenario: 1. A client socket initiates a SYN message to a listening socket. 2. The send link is congested, the SYN message is put in the send link and a wakeup message is put in wakeup queue. 3. The congestion situation is abated, the wakeup message is pulled out of the wakeup queue. Function tipc_sk_push_backlog() is called to send out delayed messages by Nagle. However, the client socket is still in CONNECTING state. So, it sends the SYN message in the socket write queue to the listening socket again. 4. The listening socket receives the first SYN message and creates first server socket. The client socket receives ACK- and establishes a connection to the first server socket. The client socket closes its connection with the first server socket. 5. The listening socket receives the second SYN message and creates second server socket. The second server socket sends ACK- to the client socket, but it has been closed. It results in connection reset error when reading from the server socket in user space. Solution: return from function tipc_sk_push_backlog() immediately if there is pending SYN message in the socket write queue. Fixes: c0bceb97db9e ("tipc: add smart nagle feature") Signed-off-by: Tung Nguyen Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 12db3c8083fcab4270866a88191933f2d9f24f89 Author: Tung Nguyen Date: Thu Nov 28 10:10:07 2019 +0700 tipc: fix wrong timeout input for tipc_wait_for_cond() In function __tipc_shutdown(), the timeout value passed to tipc_wait_for_cond() is not jiffies. This commit fixes it by converting that value from milliseconds to jiffies. Fixes: 365ad353c256 ("tipc: reduce risk of user starvation during link congestion") Signed-off-by: Tung Nguyen Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 91a4a3eb433e4d786420c41f3c08d1d16c605962 Author: Tung Nguyen Date: Thu Nov 28 10:10:06 2019 +0700 tipc: fix wrong socket reference counter after tipc_sk_timeout() returns When tipc_sk_timeout() is executed but user space is grabbing ownership, this function rearms itself and returns. However, the socket reference counter is not reduced. This causes potential unexpected behavior. This commit fixes it by calling sock_put() before tipc_sk_timeout() returns in the above-mentioned case. Fixes: afe8792fec69 ("tipc: refactor function tipc_sk_timeout()") Signed-off-by: Tung Nguyen Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 2fe97a578d7bad3116a89dc8a6692a51e6fc1d9c Author: Tung Nguyen Date: Thu Nov 28 10:10:05 2019 +0700 tipc: fix potential memory leak in __tipc_sendmsg() When initiating a connection message to a server side, the connection message is cloned and added to the socket write queue. However, if the cloning is failed, only the socket write queue is purged. It causes memory leak because the original connection message is not freed. This commit fixes it by purging the list of connection message when it cannot be cloned. Fixes: 6787927475e5 ("tipc: buffer overflow handling in listener socket") Reported-by: Hoang Le Signed-off-by: Tung Nguyen Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 61183b056b49e2937ff92a1424291ba36a6f6d05 Author: Chuhong Yuan Date: Thu Nov 28 10:00:21 2019 +0800 net: macb: add missed tasklet_kill This driver forgets to kill tasklet in remove. Add the call to fix it. Fixes: 032dc41ba6e2 ("net: macb: Handle HRESP error") Signed-off-by: Chuhong Yuan Signed-off-by: David S. Miller commit 1a365e822372ba24c9da0822bc583894f6f3d821 Author: Marco Elver Date: Wed Nov 20 16:57:15 2019 +0100 locking/spinlock/debug: Fix various data races This fixes various data races in spinlock_debug. By testing with KCSAN, it is observable that the console gets spammed with data races reports, suggesting these are extremely frequent. Example data race report: read to 0xffff8ab24f403c48 of 4 bytes by task 221 on cpu 2: debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline] do_raw_spin_lock+0x9b/0x210 kernel/locking/spinlock_debug.c:112 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_lock+0x39/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] get_partial_node.isra.0.part.0+0x32/0x2f0 mm/slub.c:1873 get_partial_node mm/slub.c:1870 [inline] write to 0xffff8ab24f403c48 of 4 bytes by task 167 on cpu 3: debug_spin_unlock kernel/locking/spinlock_debug.c:103 [inline] do_raw_spin_unlock+0xc9/0x1a0 kernel/locking/spinlock_debug.c:138 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:159 [inline] _raw_spin_unlock_irqrestore+0x2d/0x50 kernel/locking/spinlock.c:191 spin_unlock_irqrestore include/linux/spinlock.h:393 [inline] free_debug_processing+0x1b3/0x210 mm/slub.c:1214 __slab_free+0x292/0x400 mm/slub.c:2864 As a side-effect, with KCSAN, this eventually locks up the console, most likely due to deadlock, e.g. .. -> printk lock -> spinlock_debug -> KCSAN detects data race -> kcsan_print_report() -> printk lock -> deadlock. This fix will 1) avoid the data races, and 2) allow using lock debugging together with KCSAN. Reported-by: Qian Cai Signed-off-by: Marco Elver Cc: Andrew Morton Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Link: https://lkml.kernel.org/r/20191120155715.28089-1-elver@google.com Signed-off-by: Ingo Molnar commit 2eaa857534b4860dc337496e35f72f50614383b3 Merge: 81b6b96475ac e5dc9dd32580 Author: David S. Miller Date: Thu Nov 28 22:40:30 2019 -0800 Merge branch 'net-tls-fix-scatter-gather-list-issues' Jakub Kicinski says: ==================== net: tls: fix scatter-gather list issues This series kicked of by a syzbot report fixes three issues around scatter gather handling in the TLS code. First patch fixes a use- -after-free situation which may occur if record was freed on error. This could have already happened in BPF paths, and patch 2 now makes the same condition occur in non-BPF code. Patch 2 fixes the problem spotted by syzbot. If encryption failed we have to clean the end markings from scatter gather list. As suggested by John the patch frees the record entirely and caller may retry copying data from user space buffer again. Third patch fixes a bug in the TLS 1.3 code spotted while working on patch 2. TLS 1.3 may effectively overflow the SG list which leads to the BUG() in sg_page() being triggered. Patch 4 adds a test case which triggers this bug reliably. Next two patches are small cleanups of dead code and code which makes dangerous assumptions. Last but not least two minor improvements to the sockmap tests. Tested: - bpf/test_sockmap - net/tls - syzbot repro (which used error injection, hence no direct selftest is added to preserve it). ==================== Signed-off-by: David S. Miller commit e5dc9dd3258098bf8b5ceb75fc3433b41eff618a Author: Jakub Kicinski Date: Wed Nov 27 12:16:46 2019 -0800 selftests: bpf: correct perror strings perror(str) is basically equivalent to print("%s: %s\n", str, strerror(errno)). New line or colon at the end of str is a mistake/breaks formatting. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 4b67c515036313f3c3ecba3cb2babb9cbddb3f85 Author: Jakub Kicinski Date: Wed Nov 27 12:16:45 2019 -0800 selftests: bpf: test_sockmap: handle file creation failures gracefully test_sockmap creates a temporary file to use for sendpage. this may fail for various reasons. Handle the error rather than segfault. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit c5daa6cccdc2f94aca2c9b3fa5f94e4469997293 Author: Jakub Kicinski Date: Wed Nov 27 12:16:44 2019 -0800 net/tls: use sg_next() to walk sg entries Partially sent record cleanup path increments an SG entry directly instead of using sg_next(). This should not be a problem today, as encrypted messages should be always allocated as arrays. But given this is a cleanup path it's easy to miss was this ever to change. Use sg_next(), and simplify the code. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 9e5ffed37df68d0ccfb2fdc528609e23a1e70ebe Author: Jakub Kicinski Date: Wed Nov 27 12:16:43 2019 -0800 net/tls: remove the dead inplace_crypto code Looks like when BPF support was added by commit d3b18ad31f93 ("tls: add bpf support to sk_msg handling") and commit d829e9c4112b ("tls: convert to generic sk_msg interface") it broke/removed the support for in-place crypto as added by commit 4e6d47206c32 ("tls: Add support for inplace records encryption"). The inplace_crypto member of struct tls_rec is dead, inited to zero, and sometimes set to zero again. It used to be set to 1 when record was allocated, but the skmsg code doesn't seem to have been written with the idea of in-place crypto in mind. Since non trivial effort is required to bring the feature back and we don't really have the HW to measure the benefit just remove the left over support for now to avoid confusing readers. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 65190f77424d7b82c4aad7326c9cce6bd91a2fcc Author: Jakub Kicinski Date: Wed Nov 27 12:16:42 2019 -0800 selftests/tls: add a test for fragmented messages Add a sendmsg test with very fragmented messages. This should fill up sk_msg and test the boundary conditions. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 031097d9e079e40dce401031d1012e83d80eaf01 Author: Jakub Kicinski Date: Wed Nov 27 12:16:41 2019 -0800 net: skmsg: fix TLS 1.3 crash with full sk_msg TLS 1.3 started using the entry at the end of the SG array for chaining-in the single byte content type entry. This mostly works: [ E E E E E E . . ] ^ ^ start end E < content type / [ E E E E E E C . ] ^ ^ start end (Where E denotes a populated SG entry; C denotes a chaining entry.) If the array is full, however, the end will point to the start: [ E E E E E E E E ] ^ start end And we end up overwriting the start: E < content type / [ C E E E E E E E ] ^ start end The sg array is supposed to be a circular buffer with start and end markers pointing anywhere. In case where start > end (i.e. the circular buffer has "wrapped") there is an extra entry reserved at the end to chain the two halves together. [ E E E E E E . . l ] (Where l is the reserved entry for "looping" back to front. As suggested by John, let's reserve another entry for chaining SG entries after the main circular buffer. Note that this entry has to be pointed to by the end entry so its position is not fixed. Examples of full messages: [ E E E E E E E E . l ] ^ ^ start end <---------------. [ E E . E E E E E E l ] ^ ^ end start Now the end will always point to an unused entry, so TLS 1.3 can always use it. Fixes: 130b392c6cd6 ("net: tls: Add tls 1.3 support") Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit d10523d0b3d78153ee58d19853ced26c9004c8c4 Author: Jakub Kicinski Date: Wed Nov 27 12:16:40 2019 -0800 net/tls: free the record on encryption error When tls_do_encryption() fails the SG lists are left with the SG_END and SG_CHAIN marks in place. One could hope that once encryption fails we will never see the record again, but that is in fact not true. Commit d3b18ad31f93 ("tls: add bpf support to sk_msg handling") added special handling to ENOMEM and ENOSPC errors which mean we may see the same record re-submitted. As suggested by John free the record, the BPF code is already doing just that. Reported-by: syzbot+df0d4ec12332661dd1f9@syzkaller.appspotmail.com Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling") Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Acked-by: John Fastabend Signed-off-by: David S. Miller commit c329ef9684de9517d82af5b4758c9e1b64a8a11a Author: Jakub Kicinski Date: Wed Nov 27 12:16:39 2019 -0800 net/tls: take into account that bpf_exec_tx_verdict() may free the record bpf_exec_tx_verdict() may free the record if tls_push_record() fails, or if the entire record got consumed by BPF. Re-check ctx->open_rec before touching the data. Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling") Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Acked-by: John Fastabend Signed-off-by: David S. Miller commit e680a41fcaf07ccac8817c589fc4824988b48eac Merge: 405b45376de9 5172672da02e Author: Ingo Molnar Date: Fri Nov 29 06:56:05 2019 +0100 Merge tag 'perf-core-for-mingo-5.5-20191128' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: perf script: Adrian Hunter: - Fix brstackinsn for AUXTRACE. - Fix invalid LBR/binary mismatch error. perf diff: Arnaldo Carvalho de Melo: - Use llabs() with 64-bit values, fixing the build in some 32-bit architectures. perf pmu: Andi Kleen: - Use file system cache to optimize sysfs access. x86: Adrian Hunter: - Add some more Intel instructions to the opcode map and to the perf test entry: gf2p8affineinvqb, gf2p8affineqb, gf2p8mulb, v4fmaddps, v4fmaddss, v4fnmaddps, v4fnmaddss, vaesdec, vaesdeclast, vaesenc, vaesenclast, vcvtne2ps2bf16, vcvtneps2bf16, vdpbf16ps, vgf2p8affineinvqb, vgf2p8affineqb, vgf2p8mulb, vp2intersectd, vp2intersectq, vp4dpwssd, vp4dpwssds, vpclmulqdq, vpcompressb, vpcompressw, vpdpbusd, vpdpbusds, vpdpwssd, vpdpwssds, vpexpandb, vpexpandw, vpopcntb, vpopcntd, vpopcntq, vpopcntw, vpshldd, vpshldq, vpshldvd, vpshldvq, vpshldvw, vpshldw, vpshrdd, vpshrdq, vpshrdvd, vpshrdvq, vpshrdvw, vpshrdw, vpshufbitqmb. perf affinity: Andi Kleen: - Add infrastructure to save/restore affinity perf maps: Arnaldo Carvalho de Melo: - Merge 'struct maps' with 'struct map_groups', as there is a 1x1 relationship, simplifying code overal. perf build: Jiri Olsa: - Allow to link with libbpf dynamicaly. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit ce27709b8162e5c501bc54292b8bf6bdecc4bbd4 Author: Alexei Starovoitov Date: Wed Nov 27 20:35:08 2019 -0800 bpf: Fix build in minimal configurations Some kconfigs can have BPF enabled without a single valid program type. In such configurations the build will fail with: ./kernel/bpf/btf.c:3466:1: error: empty enum is invalid Fix it by adding unused value to the enum. Reported-by: Randy Dunlap Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/bpf/20191128043508.2346723-1-ast@kernel.org commit f60b85e83659b5fbd3eb2c8f68d33ef4e35ebb2c Author: Shuah Khan Date: Thu Nov 28 16:03:21 2019 -0700 Revert "selftests: Fix O= and KBUILD_OUTPUT handling for relative paths" This reverts commit 303e6218ecec475d5bc3e5922dec770ee5baf107. This patch breaks several CI use-cases that run kselftest builds without using main Makefile. This fix depends on abs_objtree which is undefined when kselftest build is invoked on selftests Makefile without going through the main Makefile. Revert this for now as this patch impacts selftest runs. Fixes: 303e6218ecec ("selftests: Fix O= and KBUILD_OUTPUT handling for relative paths") Reported-by: Cristian Marussi Reported-by: Michael Ellerman Signed-off-by: Shuah Khan commit 336820c4374bc065317f247dc2bb37c0e41b64a6 Author: Takashi Iwai Date: Thu Nov 28 21:26:30 2019 +0100 ALSA: hda/realtek - Fix inverted bass GPIO pin on Acer 8951G We've added the bass speaker support on Acer 8951G by the commit 00066e9733f6 ("Add Acer Aspire Ethos 8951G model quirk"), but it seems that the GPIO pin was wrongly set: while the commit turns off the bit to power up the amp, the actual hardware reacts other way round, i.e. GPIO bit on = amp on. So this patch fixes the bug, turning on the GPIO bit 0x02 as default. Since turning on the GPIO bit can be more easily managed with alc_setup_gpio() call, we simplify the quirk code by integrating the GPIO setup into the existing alc662_fixup_aspire_ethos_hp() and dropping the whole ALC669_FIXUP_ACER_ASPIRE_ETHOS_SUBWOOFER quirk. Fixes: 00066e9733f6 ("Add Acer Aspire Ethos 8951G model quirk") Reported-and-tested-by: Sergey 'Jin' Bostandzhyan Cc: Link: https://lore.kernel.org/r/20191128202630.6626-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 81b6b96475ac7a4ebfceae9f16fb3758327adbfe Merge: a308a7102215 a7ba70f1787f Author: Linus Torvalds Date: Thu Nov 28 11:16:43 2019 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux; tag 'dma-mapping-5.5' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - improve dma-debug scalability (Eric Dumazet) - tiny dma-debug cleanup (Dan Carpenter) - check for vmap memory in dma_map_single (Kees Cook) - check for dma_addr_t overflows in dma-direct when using DMA offsets (Nicolas Saenz Julienne) - switch the x86 sta2x11 SOC to use more generic DMA code (Nicolas Saenz Julienne) - fix arm-nommu dma-ranges handling (Vladimir Murzin) - use __initdata in CMA (Shyam Saini) - replace the bus dma mask with a limit (Nicolas Saenz Julienne) - merge the remapping helpers into the main dma-direct flow (me) - switch xtensa to the generic dma remap handling (me) - various cleanups around dma_capable (me) - remove unused dev arguments to various dma-noncoherent helpers (me) * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux: * tag 'dma-mapping-5.5' of git://git.infradead.org/users/hch/dma-mapping: (22 commits) dma-mapping: treat dev->bus_dma_mask as a DMA limit dma-direct: exclude dma_direct_map_resource from the min_low_pfn check dma-direct: don't check swiotlb=force in dma_direct_map_resource dma-debug: clean up put_hash_bucket() powerpc: remove support for NULL dev in __phys_to_dma / __dma_to_phys dma-direct: avoid a forward declaration for phys_to_dma dma-direct: unify the dma_capable definitions dma-mapping: drop the dev argument to arch_sync_dma_for_* x86/PCI: sta2x11: use default DMA address translation dma-direct: check for overflows on 32 bit DMA addresses dma-debug: increase HASH_SIZE dma-debug: reorder struct dma_debug_entry fields xtensa: use the generic uncached segment support dma-mapping: merge the generic remapping helpers into dma-direct dma-direct: provide mmap and get_sgtable method overrides dma-direct: remove the dma_handle argument to __dma_direct_alloc_pages dma-direct: remove __dma_direct_free_pages usb: core: Remove redundant vmap checks kernel: dma-contiguous: mark CMA parameters __initdata/__initconst dma-debug: add a schedule point in debug_dma_dump_mappings() ... commit a308a7102215a582fc474375648965bc5692894b Merge: 05bd375b6bde eafee5944062 Author: Linus Torvalds Date: Thu Nov 28 10:57:12 2019 -0800 Merge tag 'ioremap-5.5' of git://git.infradead.org/users/hch/ioremap Pull generic ioremap support from Christoph Hellwig: "This adds the remaining bits for an entirely generic ioremap and iounmap to lib/ioremap.c. To facilitate that, it cleans up the giant mess of weird ioremap variants we had with no users outside the arch code. For now just the three newest ports use the code, but there is more than a handful others that can be converted without too much work. Summary: - clean up various obsolete ioremap and iounmap variants - add a new generic ioremap implementation and switch csky, nds32 and riscv over to it" * tag 'ioremap-5.5' of git://git.infradead.org/users/hch/ioremap: (21 commits) nds32: use generic ioremap csky: use generic ioremap csky: remove ioremap_cache riscv: use the generic ioremap code lib: provide a simple generic ioremap implementation sh: remove __iounmap nios2: remove __iounmap hexagon: remove __iounmap m68k: rename __iounmap and mark it static arch: rely on asm-generic/io.h for default ioremap_* definitions asm-generic: don't provide ioremap for CONFIG_MMU asm-generic: ioremap_uc should behave the same with and without MMU xtensa: clean up ioremap x86: Clean up ioremap() parisc: remove __ioremap nios2: remove __ioremap alpha: remove the unused __ioremap wrapper hexagon: clean up ioremap ia64: rename ioremap_nocache to ioremap_uc unicore32: remove ioremap_cached ... commit 05bd375b6bdede3748023e130990c9b6214fd46a Merge: a6ed68d6468b e944475e6984 Author: Linus Torvalds Date: Thu Nov 28 10:43:39 2019 -0800 Merge tag 'for-5.5/io_uring-post-20191128' of git://git.kernel.dk/linux-block Pull more io_uring updates from Jens Axboe: "As mentioned in the first pull request, there was a later batch as well. This contains fixes to the stuff that already went in, cleanups, and a few later additions. In particular, this contains: - Cleanups/fixes/unification of the submission and completion path (Pavel,me) - Linked timeouts improvements (Pavel,me) - Error path fixes (me) - Fix lookup window where cancellations wouldn't work (me) - Improve DRAIN support (Pavel) - Fix backlog flushing -EBUSY on submit (me) - Add support for connect(2) (me) - Fix for non-iter based fixed IO (Pavel) - creds inheritance for async workers (me) - Disable cmsg/ancillary data for sendmsg/recvmsg (me) - Shrink io_kiocb to 3 cachelines (me) - NUMA fix for io-wq (Jann)" * tag 'for-5.5/io_uring-post-20191128' of git://git.kernel.dk/linux-block: (42 commits) io_uring: make poll->wait dynamically allocated io-wq: shrink io_wq_work a bit io-wq: fix handling of NUMA node IDs io_uring: use kzalloc instead of kcalloc for single-element allocations io_uring: cleanup io_import_fixed() io_uring: inline struct sqe_submit io_uring: store timeout's sqe->off in proper place net: disallow ancillary data for __sys_{send,recv}msg_file() net: separate out the msghdr copy from ___sys_{send,recv}msg() io_uring: remove superfluous check for sqe->off in io_accept() io_uring: async workers should inherit the user creds io-wq: have io_wq_create() take a 'data' argument io_uring: fix dead-hung for non-iter fixed rw io_uring: add support for IORING_OP_CONNECT net: add __sys_connect_file() helper io_uring: only return -EBUSY for submit on non-flushed backlog io_uring: only !null ptr to io_issue_sqe() io_uring: simplify io_req_link_next() io_uring: pass only !null to io_req_find_next() io_uring: remove io_free_req_find_next() ... commit 9677d64e5695b751cec15e25f82da408dad2f005 Author: zhengbin Date: Thu Nov 28 11:09:32 2019 +0800 ataflop: Remove unneeded semicolon Fixes coccicheck warning: drivers/block/ataflop.c:860:53-54: Unneeded semicolon Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Jens Axboe commit c15cc235b744f556b1a37c23c81a09c86cebdb4f Author: zhengbin Date: Thu Nov 28 11:09:31 2019 +0800 block: sunvdc: Remove unneeded semicolon Fixes coccicheck warning: drivers/block/sunvdc.c:637:2-3: Unneeded semicolon Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Jens Axboe commit ec45a26377900df4f8a2c3cda07989908cc2b1f6 Author: zhengbin Date: Thu Nov 28 11:09:30 2019 +0800 drbd: Remove unneeded semicolon Fixes coccicheck warning: drivers/block/drbd/drbd_req.c:887:2-3: Unneeded semicolon Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Jens Axboe commit 6c5c240e412682f97aecd233c1e706822704aa28 Author: Roman Penyaev Date: Thu Nov 28 12:53:22 2019 +0100 io_uring: add mapping support for NOMMU archs That is a bit weird scenario but I find it interesting to run fio loads using LKL linux, where MMU is disabled. Probably other real archs which run uClinux can also benefit from this patch. Signed-off-by: Roman Penyaev Signed-off-by: Jens Axboe commit 54fb3fe0f211d4729a2551cf9497bd612189af9d Author: Sudeep Holla Date: Thu Nov 28 15:33:57 2019 +0000 Revert "arm64: dts: juno: add dma-ranges property" This reverts commit 193d00a2b35ee3353813b4006a18131122087205. Commit 951d48855d86 ("of: Make of_dma_get_range() work on bus nodes") reworked the logic such that of_dma_get_range() works correctly starting from a bus node containing "dma-ranges". Since on Juno we don't have a SoC level bus node and "dma-ranges" is present only in the root node, we get the following error: OF: translation of DMA address(0) to CPU address failed node(/sram@2e000000) OF: translation of DMA address(0) to CPU address failed node(/uart@7ff80000) ... OF: translation of DMA address(0) to CPU address failed node(/mhu@2b1f0000) OF: translation of DMA address(0) to CPU address failed node(/iommu@2b600000) OF: translation of DMA address(0) to CPU address failed node(/iommu@2b600000) OF: translation of DMA address(0) to CPU address failed node(/iommu@2b600000) So let's fix it by dropping the "dma-ranges" property for now. This should be fine since it doesn't represent any kind of device-visible restriction; it was only there for completeness, and we've since given in to the assumption that missing "dma-ranges" implies a 1:1 mapping anyway. We can add it later with a proper SoC bus node and moving all the devices that belong there along with the "dma-ranges" if required. Fixes: 193d00a2b35e ("arm64: dts: juno: add dma-ranges property") Cc: Rob Herring Cc: Liviu Dudau Cc: Lorenzo Pieralisi Acked-by: Robin Murphy Signed-off-by: Sudeep Holla commit a72e27f7a47069b1b4942051bffa7dc77b4aee0c Author: Wolfram Sang Date: Wed Nov 6 10:50:23 2019 +0100 video: fbdev: matrox: convert to i2c_new_scanned_device Move from the deprecated i2c_new_probed_device() to the new i2c_new_scanned_device(). Make use of the new ERRPTR if suitable. Signed-off-by: Wolfram Sang Acked-by: Daniel Vetter Signed-off-by: Wolfram Sang commit ce668524bf79e7739fdceb406b4f9d6cd6ba6cc0 Author: Wolfram Sang Date: Wed Nov 6 10:50:20 2019 +0100 i2c: icy: convert to i2c_new_scanned_device Move from the deprecated i2c_new_probed_device() to the new i2c_new_scanned_device(). Make use of the new ERRPTR if suitable. Signed-off-by: Wolfram Sang Reviewed-by: Max Staudt Signed-off-by: Wolfram Sang commit c1d084759c95ecd0ef08274654a1f6c4f343cdcd Author: Wolfram Sang Date: Wed Nov 6 10:50:19 2019 +0100 i2c: replace i2c_new_probed_device with an ERR_PTR variant In the general move to have i2c_new_*_device functions which return ERR_PTR instead of NULL, this patch converts i2c_new_probed_device(). There are only few users, so this patch converts the I2C core and all users in one go. The function gets renamed to i2c_new_scanned_device() so out-of-tree users will get a build failure to understand they need to adapt their error checking code. Signed-off-by: Wolfram Sang Reviewed-by: Luca Ceresoli Reviewed-by: Max Staudt Signed-off-by: Wolfram Sang commit 7e124c40517218e079e580909de2652bddb60ff5 Merge: 48617f03c940 36533f355b1a Author: Bjorn Helgaas Date: Thu Nov 28 08:54:55 2019 -0600 Merge branch 'pci/trivial' - Fix typos and comments (Bjorn Helgaas) - Fix Kconfig whitespace errors (Krzysztof Kozlowski) * pci/trivial: PCI: Fix indentation PCI: Fix typos PCI: Remove useless comments and tidy others PCI: Remove unnecessary includes # Conflicts: # drivers/pci/probe.c commit 48617f03c94088780c86692593b0a9b10f74530f Merge: 7bd4c4a7b0ff 3c379a59b479 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:54 2019 -0600 Merge branch 'remotes/lorenzo/pci/misc' - Fix iproc-msi and mvebu __iomem annotations (Ben Dooks) - Make mvebu_pci_bridge_emul_ops static (Ben Dooks) - Add Marek Vasut and Yoshihiro Shimoda as R-Car maintainers (Simon Horman) - Fix pcitest.c fd leak (Hewenliang) * remotes/lorenzo/pci/misc: tools: PCI: Fix fd leakage MAINTAINERS: Add Marek and Shimoda-san as R-Car PCIE co-maintainers PCI: mvebu: mvebu_pcie_map_registers __iomem fix PCI: mvebu: Make mvebu_pci_bridge_emul_ops static PCI: iproc-msi: Fix __iomem annotation in decode_msi_hwirq() commit 7bd4c4a7b0ff94ef01247f905cd568fb67c747e0 Merge: d8ddab63635d 3b55809cf91f Author: Bjorn Helgaas Date: Thu Nov 28 08:54:53 2019 -0600 Merge branch 'remotes/lorenzo/pci/mmio-dma-ranges' - Consolidate DT "dma-ranges" parsing and convert all host drivers to use shared parsing (Rob Herring) * remotes/lorenzo/pci/mmio-dma-ranges: PCI: Make devm_of_pci_get_host_bridge_resources() static PCI: rcar: Use inbound resources for setup PCI: iproc: Use inbound resources for setup PCI: xgene: Use inbound resources for setup PCI: v3-semi: Use inbound resources for setup PCI: ftpci100: Use inbound resources for setup PCI: of: Add inbound resource parsing to helpers PCI: versatile: Enable COMPILE_TEST PCI: versatile: Remove usage of PHYS_OFFSET PCI: versatile: Use pci_parse_request_of_pci_ranges() PCI: xilinx-nwl: Use pci_parse_request_of_pci_ranges() PCI: xilinx: Use pci_parse_request_of_pci_ranges() PCI: xgene: Use pci_parse_request_of_pci_ranges() PCI: v3-semi: Use pci_parse_request_of_pci_ranges() PCI: rockchip: Drop storing driver private outbound resource data PCI: rockchip: Use pci_parse_request_of_pci_ranges() PCI: mobiveil: Use pci_parse_request_of_pci_ranges() PCI: mediatek: Use pci_parse_request_of_pci_ranges() PCI: iproc: Use pci_parse_request_of_pci_ranges() PCI: faraday: Use pci_parse_request_of_pci_ranges() PCI: dwc: Use pci_parse_request_of_pci_ranges() PCI: altera: Use pci_parse_request_of_pci_ranges() PCI: aardvark: Use pci_parse_request_of_pci_ranges() PCI: Export pci_parse_request_of_pci_ranges() resource: Add a resource_list_first_type helper # Conflicts: # drivers/pci/controller/pcie-rcar.c commit d8ddab63635d4b474a99424538001932884b55ae Merge: 77471510559c e3d023b8952b Author: Bjorn Helgaas Date: Thu Nov 28 08:54:52 2019 -0600 Merge branch 'remotes/lorenzo/pci/vmd' - Add VMD bus 224-255 restriction decode (Jon Derrick) - Add VMD 8086:9A0B device ID (Jon Derrick) - Remove Keith from VMD maintainer list (Keith Busch) * remotes/lorenzo/pci/vmd: MAINTAINERS: Remove Keith from VMD maintainer PCI: vmd: Add device id for VMD device 8086:9A0B PCI: vmd: Add bus 224-255 restriction decode commit 77471510559cdb60cd3dd4e93dca5bfe71b0f5c6 Merge: b19c3f46caf8 4b1140ade8f5 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:51 2019 -0600 Merge branch 'remotes/lorenzo/pci/uniphier' - Set uniphier to host (RC) mode always (Kunihiko Hayashi) * remotes/lorenzo/pci/uniphier: PCI: uniphier: Set mode register to host mode commit b19c3f46caf8c0833792b84bf1602d99bf89e757 Merge: 069ade5dfec9 ff5c2bb9c6f5 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:50 2019 -0600 Merge branch 'remotes/lorenzo/pci/tegra' - Fix Tegra CLKREQ dependency programming (Vidya Sagar) * remotes/lorenzo/pci/tegra: PCI: tegra: Fix CLKREQ dependency programming commit 069ade5dfec93dd2916a85df8b1bab2d578857bd Merge: 21cea0c0eaba 1e4d40186026 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:49 2019 -0600 Merge branch 'remotes/lorenzo/pci/rockchip' - Make rockchip 0V9 and 1V8 power regulators non-optional (Robin Murphy) * remotes/lorenzo/pci/rockchip: PCI: rockchip: Make some regulators non-optional commit 21cea0c0eabae5d8b498b661885396d7186f6b61 Merge: 4940330a3696 7c7e53e1c93d Author: Bjorn Helgaas Date: Thu Nov 28 08:54:48 2019 -0600 Merge branch 'remotes/lorenzo/pci/rcar' - Clear bit 0 of MACCTLR before PCIETCTLR.CFINIT per manual (Yoshihiro Shimoda) - Remove unnecessary header include from rcar (Andrew Murray) - Tighten register index checking for rcar inbound range programming (Marek Vasut) - Fix rcar inbound range alignment calculation to improve packing of multiple entries (Marek Vasut) - Update rcar MACCTLR setting to match documentation (Yoshihiro Shimoda) * remotes/lorenzo/pci/rcar: PCI: rcar: Fix missing MACCTLR register setting in initialization sequence PCI: rcar: Recalculate inbound range alignment for each controller entry PCI: rcar: Move the inbound index check PCI: rcar: Remove unnecessary header include (../pci.h) commit 4940330a3696c37d95cb8e16880c412c28748e2d Merge: 30c50d3a26a5 4906c05b87d4 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:47 2019 -0600 Merge branch 'remotes/lorenzo/pci/mobiveil' - Change mobiveil csr_read()/write() function names that conflict with riscv arch functions (Kefeng Wang) * remotes/lorenzo/pci/mobiveil: PCI: mobiveil: Fix csr_read()/write() build issue commit 30c50d3a26a512890f30e2a9c4899fa9f4ce48d7 Merge: e63758e2790f ba1f8af7f772 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:46 2019 -0600 Merge branch 'remotes/lorenzo/pci/meson' - Fix meson PERST# GPIO polarity problem (Remi Pommarel) - Add DT bindings for Amlogic Meson G12A (Neil Armstrong) - Fix meson clock names to match DT bindings (Neil Armstrong) - Add meson support for Amlogic G12A SoC with separate shared PHY (Neil Armstrong) - Add meson extended PCIe PHY functions for Amlogic G12A USB3+PCIe combo PHY (Neil Armstrong) - Add arm64 DT for Amlogic G12A PCIe controller node (Neil Armstrong) - Add commented-out description of VIM3 USB3/PCIe mux in arm64 DT (Neil Armstrong) * remotes/lorenzo/pci/meson: arm64: dts: khadas-vim3: add commented support for PCIe arm64: dts: meson-g12a: Add PCIe node phy: meson-g12a-usb3-pcie: Add support for PCIe mode PCI: amlogic: meson: Add support for G12A PCI: amlogic: Fix probed clock names dt-bindings: pci: amlogic, meson-pcie: Add G12A bindings PCI: amlogic: Fix reset assertion via gpio descriptor commit e63758e2790fe8b37a6092dba21d370a5ae25430 Merge: 132c4a6b544a 7973eb13aecf Author: Bjorn Helgaas Date: Thu Nov 28 08:54:45 2019 -0600 Merge branch 'remotes/lorenzo/pci/layerscape' - Add layerscape LS1028a support (Xiaowei Bao) * remotes/lorenzo/pci/layerscape: PCI: layerscape: Add LS1028a support dt-bindings: pci: layerscape-pci: add compatible strings "fsl, ls1028a-pcie" commit 132c4a6b544a37cc8cd91f166c9bebe80c4abcee Merge: 4eb87ddf390e 9415743e4c8a Author: Bjorn Helgaas Date: Thu Nov 28 08:54:44 2019 -0600 Merge branch 'remotes/lorenzo/pci/iproc' - Invalidate iProc PAXB address mapping before programming it (Abhishek Shah) * remotes/lorenzo/pci/iproc: PCI: iproc: Invalidate PAXB address mapping before programming it commit 4eb87ddf390e5fdbaa973a981d0f1f7887b7f65a Merge: 454f4de2d931 877b911a5ba0 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:43 2019 -0600 Merge branch 'remotes/lorenzo/pci/hv' - Add hibernation support for Hyper-V virtual PCI devices (Dexuan Cui) - Track Hyper-V pci_protocol_version per-hbus, not globally (Dexuan Cui) - Avoid kmemleak false positive on hv hbus buffer (Dexuan Cui) * remotes/lorenzo/pci/hv: PCI: hv: Avoid a kmemleak false positive caused by the hbus buffer PCI: hv: Change pci_protocol_version to per-hbus PCI: hv: Add hibernation support PCI: hv: Reorganize the code in preparation of hibernation commit 454f4de2d93153ec795565b2525768374ac3f644 Merge: d76d273dc861 daee4f4e42c7 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:42 2019 -0600 Merge branch 'remotes/lorenzo/pci/endpoint' - Fix endpoint driver sign extension problem when shifting page number to phys_addr_t (Alan Mikhak) * remotes/lorenzo/pci/endpoint: PCI: endpoint: Cast the page number to phys_addr_t commit d76d273dc861416ac435781818b3a7468bd47d9d Merge: ba7e87c5dd63 1137e61dcb99 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:41 2019 -0600 Merge branch 'remotes/lorenzo/pci/dwc' - Fix dwc find_next_bit() usage (Niklas Cassel) * remotes/lorenzo/pci/dwc: PCI: dwc: Fix find_next_bit() usage commit ba7e87c5dd631773fe9c814f45a412451a48e1c4 Merge: 318ed91f36f9 de80f95ccb9c Author: Bjorn Helgaas Date: Thu Nov 28 08:54:40 2019 -0600 Merge branch 'remotes/lorenzo/pci/cadence' - Refactor Cadence PCIe host controller to use as a library for both host and endpoint (Tom Joseph) * remotes/lorenzo/pci/cadence: PCI: cadence: Move all files to per-device cadence directory PCI: cadence: Refactor driver to use as a core library commit 318ed91f36f98615147bac840294c315b9b6c444 Merge: f52412b151a4 e0d9d30b7354 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:39 2019 -0600 Merge branch 'remotes/lorenzo/pci/aardvark' - Use LTSSM state to build link training flag since Aardvark doesn't implement the Link Training bit (Remi Pommarel) - Delay before training Aardvark link in case PERST# was asserted before the driver probe (Remi Pommarel) - Fix Aardvark issues with Root Control reads and writes (Remi Pommarel) - Don't rely on jiffies in Aardvark config access path since interrupts may be disabled (Remi Pommarel) - Fix Aardvark big-endian support (Grzegorz Jaszczyk) - Fix bridge emulation big-endian support (Grzegorz Jaszczyk) * remotes/lorenzo/pci/aardvark: PCI: pci-bridge-emul: Fix big-endian support PCI: aardvark: Fix big endian support PCI: aardvark: Don't rely on jiffies while holding spinlock PCI: aardvark: Fix PCI_EXP_RTCTL register configuration PCI: aardvark: Wait for endpoint to be ready before training link PCI: aardvark: Use LTSSM state to build link training flag commit f52412b151a45d3864833202a4a19729322b4de6 Merge: e771e0bf823f 7cf2cba43f15 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:38 2019 -0600 Merge branch 'pci/virtualization' - Fix erroneous intel-iommu dependency on CONFIG_AMD_IOMMU (Bjorn Helgaas) - Move pci_prg_resp_pasid_required() to CONFIG_PCI_PRI (Bjorn Helgaas) - Allow VFs to use PRI (the PF PRI is shared by the VFs, but the code previously didn't recognize that) (Kuppuswamy Sathyanarayanan) - Allow VFs to use PASID (the PF PASID capability is shared by the VFs, but the code previously didn't recognize that) (Kuppuswamy Sathyanarayanan) - Disconnect PF and VF ATS enablement, since ATS in PFs and associated VFs can be enabled independently (Kuppuswamy Sathyanarayanan) - Cache PRI and PASID capability offsets (Kuppuswamy Sathyanarayanan) - Cache the PRI PRG Response PASID Required bit (Bjorn Helgaas) - Consolidate ATS declarations in linux/pci-ats.h (Krzysztof Wilczynski) - Remove unused PRI and PASID stubs (Bjorn Helgaas) - Removed unnecessary EXPORT_SYMBOL_GPL() from ATS, PRI, and PASID interfaces that are only used by built-in IOMMU drivers (Bjorn Helgaas) - Hide PRI and PASID state restoration functions used only inside the PCI core (Bjorn Helgaas) - Fix the UPDCR register address in the Intel ACS quirk (Steffen Liebergeld) - Add a DMA alias quirk for the Intel VCA NTB (Slawomir Pawlowski) - Serialize sysfs sriov_numvfs reads vs writes (Pierre Crégut) - Update Cavium ACS quirk for ThunderX2 and ThunderX3 (George Cherian) - Unify ACS quirk implementations (Bjorn Helgaas) * pci/virtualization: PCI: Unify ACS quirk desired vs provided checking PCI: Make ACS quirk implementations more uniform PCI: Apply Cavium ACS quirk to ThunderX2 and ThunderX3 PCI/IOV: Serialize sysfs sriov_numvfs reads vs writes PCI: Add DMA alias quirk for Intel VCA NTB PCI: Fix Intel ACS quirk UPDCR register address PCI/ATS: Make pci_restore_pri_state(), pci_restore_pasid_state() private PCI/ATS: Remove unnecessary EXPORT_SYMBOL_GPL() PCI/ATS: Remove unused PRI and PASID stubs PCI/ATS: Consolidate ATS declarations in linux/pci-ats.h PCI/ATS: Cache PRI PRG Response PASID Required bit PCI/ATS: Cache PASID Capability offset PCI/ATS: Cache PRI Capability offset PCI/ATS: Disable PF/VF ATS service independently PCI/ATS: Handle sharing of PF PASID Capability with all VFs PCI/ATS: Handle sharing of PF PRI Capability with all VFs PCI/ATS: Move pci_prg_resp_pasid_required() to CONFIG_PCI_PRI iommu/vt-d: Select PCI_PRI for INTEL_IOMMU_SVM commit e771e0bf823ffe4e58095bd837ba397edf48448d Merge: 774800cb099f 6acdf7e19b37 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:37 2019 -0600 Merge branch 'pci/switchtec' - Read all 64 bits of Switchtec part_event_bitmap (Logan Gunthorpe) * pci/switchtec: PCI/switchtec: Read all 64 bits of part_event_bitmap commit 774800cb099f8ee2f0f5c55ddb1809802d7c7cf8 Merge: 7cfe16393c3c 73884a7082f4 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:36 2019 -0600 Merge branch 'pci/resource' - Protect pci_reassign_bridge_resources() against concurrent addition/removal (Benjamin Herrenschmidt) - Fix bridge dma_ranges resource list cleanup (Rob Herring) - Add PCI_STD_NUM_BARS for the number of standard BARs (Denis Efremov) - Add "pci=hpmmiosize" and "pci=hpmmioprefsize" parameters to control the MMIO and prefetchable MMIO window sizes of hotplug bridges independently (Nicholas Johnson) - Fix MMIO/MMIO_PREF window assignment that assigned more space than desired (Nicholas Johnson) - Only enforce bus numbers from bridge EA if the bridge has EA devices downstream (Subbaraya Sundeep) * pci/resource: PCI: Do not use bus number zero from EA capability PCI: Avoid double hpmemsize MMIO window assignment PCI: Add "pci=hpmmiosize" and "pci=hpmmioprefsize" parameters PCI: Add PCI_STD_NUM_BARS for the number of standard BARs PCI: Fix missing bridge dma_ranges resource list cleanup PCI: Protect pci_reassign_bridge_resources() against concurrent addition/removal commit 7cfe16393c3c9fed45545b234b852e1154c7cc5b Merge: c59f0da5780f bae26849372b Author: Bjorn Helgaas Date: Thu Nov 28 08:54:35 2019 -0600 Merge branch 'pci/pm' - Always return devices to D0 when thawing to fix hibernation with drivers like mlx4 that used legacy power management (previously we only did it for drivers with new power management ops) (Dexuan Cui) - Clear PCIe PME Status even for legacy power management (Bjorn Helgaas) - Fix PCI PM documentation errors (Bjorn Helgaas) - Use dev_printk() for more power management messages (Bjorn Helgaas) - Apply D2 delay as milliseconds, not microseconds (Bjorn Helgaas) - Convert xen-platform from legacy to generic power management (Bjorn Helgaas) - Removed unused .resume_early() and .suspend_late() legacy power management hooks (Bjorn Helgaas) - Rearrange power management code for clarity (Rafael J. Wysocki) - Decode power states more clearly ("4" or "D4" really refers to "D3cold") (Bjorn Helgaas) - Notice when reading PM Control register returns an error (~0) instead of interpreting it as being in D3hot (Bjorn Helgaas) - Add missing link delays required by the PCIe spec (Mika Westerberg) * pci/pm: PCI/PM: Move pci_dev_wait() definition earlier PCI/PM: Add missing link delays required by the PCIe spec PCI/PM: Add pcie_wait_for_link_delay() PCI/PM: Return error when changing power state from D3cold PCI/PM: Decode D3cold power state correctly PCI/PM: Fold __pci_complete_power_transition() into its caller PCI/PM: Avoid exporting __pci_complete_power_transition() PCI/PM: Fold __pci_start_power_transition() into its caller PCI/PM: Use pci_power_up() in pci_set_power_state() PCI/PM: Move power state update away from pci_power_up() PCI/PM: Remove unused pci_driver.suspend_late() hook PCI/PM: Remove unused pci_driver.resume_early() hook xen-platform: Convert to generic power management PCI/PM: Simplify pci_set_power_state() PCI/PM: Expand PM reset messages to mention D3hot (not just D3) PCI/PM: Apply D2 delay as milliseconds, not microseconds PCI/PM: Use pci_WARN() to include device information PCI/PM: Use PCI dev_printk() wrappers for consistency PCI/PM: Wrap long lines in documentation PCI/PM: Note that PME can be generated from D0 PCI/PM: Make power management op coding style consistent PCI/PM: Run resume fixups before disabling wakeup events PCI/PM: Clear PCIe PME Status even for legacy power management PCI/PM: Correct pci_pm_thaw_noirq() documentation PCI/PM: Always return devices to D0 when thawing commit c59f0da5780f4ea3645020bffc1e261c87aece32 Merge: e87eb585d31f 191d6f91f283 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:34 2019 -0600 Merge branch 'pci/msi' - Remove unused pci_irq_get_node() Greg Kroah-Hartman) - Move power state check out of pci_msi_supported() (Bjorn Helgaas) - Fix incorrect MSI-X masking on resume and revert related nvme quirk for Kingston NVME SSD running FW E8FK11.T (Jian-Hong Pan) - Make asm/msi.h mandatory and simplify PCI_MSI_IRQ_DOMAIN Kconfig (Palmer Dabbelt, Michal Simek) * pci/msi: PCI: Remove PCI_MSI_IRQ_DOMAIN architecture whitelist asm-generic: Make msi.h a mandatory include/asm header Revert "nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T" PCI/MSI: Fix incorrect MSI-X masking on resume PCI/MSI: Move power state check out of pci_msi_supported() PCI/MSI: Remove unused pci_irq_get_node() commit e87eb585d31fadb5e9e549a1de4b2da60a79bfc9 Merge: 2df08822a643 3d581b11e34a Author: Bjorn Helgaas Date: Thu Nov 28 08:54:32 2019 -0600 Merge branch 'pci/misc' - Add NumaChip SPDX header (Krzysztof Wilczynski) - Replace EXTRA_CFLAGS with ccflags-y (Krzysztof Wilczynski) - Remove unused includes (Krzysztof Wilczynski) - Avoid AMD FCH XHCI USB PME# from D0 defect that prevents wakeup on USB 2.0 or 1.1 connect events (Kai-Heng Feng) - Removed unused sysfs attribute groups (Ben Dooks) - Remove PTM and ASPM dependencies on PCIEPORTBUS (Bjorn Helgaas) - Add PCIe Link Control 2 register field definitions to replace magic numbers in AMDGPU and Radeon CIK/SI (Bjorn Helgaas) - Fix incorrect Link Control 2 Transmit Margin usage in AMDGPU and Radeon CIK/SI PCIe Gen3 link training (Bjorn Helgaas) - Use pcie_capability_read_word() instead of pci_read_config_word() in AMDGPU and Radeon CIK/SI (Frederick Lawler) * pci/misc: drm/radeon: Prefer pcie_capability_read_word() drm/radeon: Replace numbers with PCI_EXP_LNKCTL2 definitions drm/radeon: Correct Transmit Margin masks drm/amdgpu: Prefer pcie_capability_read_word() drm/amdgpu: Replace numbers with PCI_EXP_LNKCTL2 definitions drm/amdgpu: Correct Transmit Margin masks PCI: Add #defines for Enter Compliance, Transmit Margin PCI: Allow building PCIe things without PCIEPORTBUS PCI: Remove PCIe Kconfig dependencies on PCI PCI/ASPM: Remove dependency on PCIEPORTBUS PCI/PTM: Remove dependency on PCIEPORTBUS PCI/PTM: Remove spurious "d" from granularity message PCI: sysfs: Remove unused attribute groups x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect PCI: Remove unused includes and superfluous struct declaration x86/PCI: Replace deprecated EXTRA_CFLAGS with ccflags-y x86/PCI: Correct SPDX comment style x86/PCI: Add NumaChip SPDX GPL-2.0 to replace COPYING boilerplate commit 2df08822a643558402b7c58528b8478e31e40ad7 Merge: 093b9062adc1 77adf9355304 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:31 2019 -0600 Merge branch 'pci/hotplug' - Avoid returning prematurely from sysfs requests to enable or disable a PCIe hotplug slot (Lukas Wunner) - Don't disable interrupts twice when suspending hotplug ports (Mika Westerberg) - Fix deadlocks when PCIe ports are hot-removed while suspended (Mika Westerberg) - Fix boot-time Embedded Controller GPE storm caused by incorrect resource assignment after ACPI Bus Check Notification (Mika Westerberg) * pci/hotplug: ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug bridge PCI: pciehp: Prevent deadlock on disconnect PCI: pciehp: Do not disable interrupt twice on suspend PCI: pciehp: Refactor infinite loop in pcie_poll_cmd() PCI: pciehp: Avoid returning prematurely from sysfs requests commit 093b9062adc14f1a0ad53629a53c9d06eed3c65e Merge: abd05c97f971 ad5086108b9f Author: Bjorn Helgaas Date: Thu Nov 28 08:54:30 2019 -0600 Merge branch 'pci/enumeration' - Warn if a host bridge has no NUMA info (Yunsheng Lin) * pci/enumeration: PCI: Warn if no host bridge NUMA node info commit abd05c97f9711a4baa8cd43832893b8df45d459e Merge: c2a3d213d1bc 87e90283c94c Author: Bjorn Helgaas Date: Thu Nov 28 08:54:29 2019 -0600 Merge branch 'pci/aspm' - Remove unnecessary ASPM locking (Bjorn Helgaas) - Add support for disabling L1 PM Substates (Heiner Kallweit) - Allow re-enabling Clock PM after it has been disabled (Heiner Kallweit) - Add sysfs attributes for controlling ASPM link states (Heiner Kallweit) - Remove CONFIG_PCIEASPM_DEBUG, including "link_state" and "clk_ctl" sysfs files (Heiner Kallweit) * pci/aspm: PCI/ASPM: Remove PCIEASPM_DEBUG Kconfig option and related code PCI/ASPM: Add sysfs attributes for controlling ASPM link states PCI/ASPM: Add pcie_aspm_get_link() PCI/ASPM: Allow re-enabling Clock PM PCI/ASPM: Add L1 PM substate support to pci_disable_link_state() PCI/ASPM: Remove pcie_aspm_enabled() unnecessary locking commit c2a3d213d1bc007683f63790b1cf522d5586d1a8 Merge: 7d194c2100ad 35a0b2378c19 Author: Bjorn Helgaas Date: Thu Nov 28 08:54:28 2019 -0600 Merge branch 'pci/aer' - Restore AER capability after resume (Mayurkumar Patel) - Add PoisonTLPBlocked AER counter (Rajat Jain) - Use for_each_set_bit() to simplify AER code (Andy Shevchenko) - Fix AER kernel-doc (Andy Shevchenko) - Add "pcie_ports=dpc-native" parameter to allow native use of DPC even if platform didn't grant control over AER (Olof Johansson) * pci/aer: PCI/DPC: Add "pcie_ports=dpc-native" to allow DPC without AER control PCI/AER: Fix kernel-doc warnings PCI/AER: Use for_each_set_bit() to simplify code PCI/AER: Add PoisonTLPBlocked to Uncorrectable error counters PCI/AER: Save AER Capability for suspend/resume commit 7251953d784baf7e5416afabe030a0e81de1a938 Author: Linus Walleij Date: Thu Nov 28 09:37:18 2019 +0100 spi: fsl: Handle the single hardwired chipselect case The Freescale MPC8xxx had a special quirk for handling a single hardwired chipselect, the case when we're using neither GPIO nor native chip select: when inspecting the device tree and finding zero "cs-gpios" on the device node the code would assume we have a single hardwired chipselect that leaves the device always selected. This quirk is not handled by the new core code, so we need to check the "cs-gpios" explicitly in the driver and set pdata->max_chipselect = 1 which will later fall through to the SPI master ->num_chipselect. Make sure not to assign the chip select handler in this case: there is no handling needed since the chip is always selected, and this is what the old code did as well. Cc: Christophe Leroy Reported-by: Christophe Leroy Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors") Signed-off-by: Linus Walleij Tested-by: Christophe Leroy (No tested the Link: https://lore.kernel.org/r/20191128083718.39177-3-linus.walleij@linaro.org Signed-off-by: Mark Brown commit 71b8f600b034c7f5780f6fb311dabfe331c64feb Author: Linus Walleij Date: Thu Nov 28 09:37:17 2019 +0100 gpio: Handle counting of Freescale chipselects We have a special quirk to handle the Freescale nonstandard SPI chipselect GPIOs in the gpiolib-of.c file, but it currently only handles the case where the GPIOs are actually requested (gpiod_*get()). We also need to handle that the SPI core attempts to count the GPIOs before use, and that needs a similar quirk in the OF part of the library. Cc: Christophe Leroy Reported-by: Christophe Leroy Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors") Signed-off-by: Linus Walleij Tested-by: Christophe Leroy Link: https://lore.kernel.org/r/20191128083718.39177-2-linus.walleij@linaro.org Signed-off-by: Mark Brown commit f106904968e2a075e64653b9b79dda9f0f070ab5 Author: Linus Walleij Date: Thu Nov 28 09:37:16 2019 +0100 spi: fsl: Fix GPIO descriptor support This makes the driver actually support looking up GPIO descriptor. A coding mistake in the initial descriptor support patch was that it was failing to turn on the very feature it was implementing. Mea culpa. Cc: Christophe Leroy Reported-by: Christophe Leroy Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors") Signed-off-by: Linus Walleij Tested-by: Christophe Leroy Link: https://lore.kernel.org/r/20191128083718.39177-1-linus.walleij@linaro.org Signed-off-by: Mark Brown commit ada9e3fcc175db4538f5b5e05abf5dedf626e550 Author: Charles Keepax Date: Wed Nov 27 15:39:36 2019 +0000 spi: dw: Correct handling of native chipselect This patch reverts commit 6e0a32d6f376 ("spi: dw: Fix default polarity of native chipselect"). The SPI framework always called the set_cs callback with the logic level it desired on the chip select line, which is what the drivers original handling supported. commit f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs") changed these symantics, but only in the case of drivers that also support GPIO chip selects, to true meaning apply slave select rather than logic high. This left things in an odd state where a driver that only supports hardware chip selects, the core would handle polarity but if the driver supported GPIOs as well the driver should handle polarity. At this point the reverted change was applied to change the logic in the driver to match new system. This was then broken by commit 3e5ec1db8bfe ("spi: Fix SPI_CS_HIGH setting when using native and GPIO CS") which reverted the core back to consistently calling set_cs with a logic level. This fix reverts the driver code back to its original state to match the current core code. This is probably a better fix as a) the set_cs callback is always called with consistent symantics and b) the inversion for SPI_CS_HIGH can be handled in the core and doesn't need to be coded in each driver supporting it. Fixes: 3e5ec1db8bfe ("spi: Fix SPI_CS_HIGH setting when using native and GPIO CS") Signed-off-by: Charles Keepax Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20191127153936.29719-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 4cc4a1708903f404d2ca0dfde30e71e052c6cbc9 Author: Sven Eckelmann Date: Thu Nov 28 12:25:45 2019 +0100 batman-adv: Fix DAT candidate selection on little endian systems The distributed arp table is using a DHT to store and retrieve MAC address information for an IP address. This is done using unicast messages to selected peers. The potential peers are looked up using the IP address and the VID. While the IP address is always stored in big endian byte order, this is not the case of the VID. It can (depending on the host system) either be big endian or little endian. The host must therefore always convert it to big endian to ensure that all devices calculate the same peers for the same lookup data. Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware") Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 5172672da02e483d9b3c4d814c3482d0c8ffb1a6 Author: Adrian Hunter Date: Wed Nov 27 11:56:31 2019 +0200 perf script: Fix invalid LBR/binary mismatch error The 'len' returned by grab_bb() includes an extra MAXINSN bytes to allow for the last instruction, so the the final 'offs' will not be 'len'. Fix the error condition logic accordingly. Before: $ perf record -e '{intel_pt//,cpu/mem_inst_retired.all_loads,aux-sample-size=8192/pp}:u' grep -rqs jhgjhg /boot [ perf record: Woken up 19 times to write data ] [ perf record: Captured and wrote 2.274 MB perf.data ] $ perf script -F +brstackinsn --xed --itrace=i1usl100 | head grep 13759 [002] 8091.310257: 1862 instructions:uH: 5641d58069eb bmexec+0x86b (/bin/grep) bmexec+2485: 00005641d5806b35 jnz 0x5641d5806bd0 # MISPRED 00005641d5806bd0 movzxb (%r13,%rdx,1), %eax 00005641d5806bd6 add %rdi, %rax 00005641d5806bd9 movzxb -0x1(%rax), %edx 00005641d5806bdd cmp %rax, %r14 00005641d5806be0 jnb 0x5641d58069c0 # MISPRED mismatch of LBR data and executable 00005641d58069c0 movzxb (%r13,%rdx,1), %edi After: $ perf script -F +brstackinsn --xed --itrace=i1usl100 | head grep 13759 [002] 8091.310257: 1862 instructions:uH: 5641d58069eb bmexec+0x86b (/bin/grep) bmexec+2485: 00005641d5806b35 jnz 0x5641d5806bd0 # MISPRED 00005641d5806bd0 movzxb (%r13,%rdx,1), %eax 00005641d5806bd6 add %rdi, %rax 00005641d5806bd9 movzxb -0x1(%rax), %edx 00005641d5806bdd cmp %rax, %r14 00005641d5806be0 jnb 0x5641d58069c0 # MISPRED 00005641d58069c0 movzxb (%r13,%rdx,1), %edi 00005641d58069c6 add %rax, %rdi Fixes: e98df280bc2a ("perf script brstackinsn: Fix recovery from LBR/binary mismatch") Reported-by: Andi Kleen Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191127095631.15663-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 0cd032d3b5fcebf5454315400ab310746a81ca53 Author: Adrian Hunter Date: Wed Nov 27 11:53:21 2019 +0200 perf script: Fix brstackinsn for AUXTRACE brstackinsn must be allowed to be set by the user when AUX area data has been captured because, in that case, the branch stack might be synthesized on the fly. This fixes the following error: Before: $ perf record -e '{intel_pt//,cpu/mem_inst_retired.all_loads,aux-sample-size=8192/pp}:u' grep -rqs jhgjhg /boot [ perf record: Woken up 19 times to write data ] [ perf record: Captured and wrote 2.274 MB perf.data ] $ perf script -F +brstackinsn --xed --itrace=i1usl100 | head Display of branch stack assembler requested, but non all-branch filter set Hint: run 'perf record -b ...' After: $ perf record -e '{intel_pt//,cpu/mem_inst_retired.all_loads,aux-sample-size=8192/pp}:u' grep -rqs jhgjhg /boot [ perf record: Woken up 19 times to write data ] [ perf record: Captured and wrote 2.274 MB perf.data ] $ perf script -F +brstackinsn --xed --itrace=i1usl100 | head grep 13759 [002] 8091.310257: 1862 instructions:uH: 5641d58069eb bmexec+0x86b (/bin/grep) bmexec+2485: 00005641d5806b35 jnz 0x5641d5806bd0 # MISPRED 00005641d5806bd0 movzxb (%r13,%rdx,1), %eax 00005641d5806bd6 add %rdi, %rax 00005641d5806bd9 movzxb -0x1(%rax), %edx 00005641d5806bdd cmp %rax, %r14 00005641d5806be0 jnb 0x5641d58069c0 # MISPRED mismatch of LBR data and executable 00005641d58069c0 movzxb (%r13,%rdx,1), %edi Fixes: 48d02a1d5c13 ("perf script: Add 'brstackinsn' for branch stacks") Reported-by: Andi Kleen Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191127095322.15417-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 267ed5d8593cedd6146eabe00d270629c9cff771 Author: Andi Kleen Date: Wed Nov 20 16:15:12 2019 -0800 perf affinity: Add infrastructure to save/restore affinity The kernel perf subsystem has to IPI to the target CPU for many operations. On systems with many CPUs and when managing many events the overhead can be dominated by lots of IPIs. An alternative is to set up CPU affinity in the perf tool, then set up all the events for that CPU, and then move on to the next CPU. Add some affinity management infrastructure to enable such a model. Used in followon patches. Committer notes: Use zfree() in some places, add missing stdbool.h header, some minor coding style changes. Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-3-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit d96645821e940bddff3fc5290656f83bf70d4c92 Author: Andi Kleen Date: Wed Nov 20 16:15:11 2019 -0800 perf pmu: Use file system cache to optimize sysfs access pmu.c does a lot of redundant /sys accesses while parsing aliases and probing for PMUs. On large systems with a lot of PMUs this can get expensive (>2s): % time seconds usecs/call calls errors syscall ------ ----------- ----------- --------- --------- ---------------- 27.25 1.227847 8 160888 16976 openat 26.42 1.190481 7 164224 164077 stat Add a cache to remember if specific file names exist or don't exist, which eliminates most of this overhead. Also optimize some stat() calls to be slightly cheaper access() Resulting in: 0.18 0.004166 2 1851 305 open 0.08 0.001970 2 829 622 access Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20191121001522.180827-2-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 5b596e0ff0e1852197d4c82d3314db5e43126bf7 Author: Arnaldo Carvalho de Melo Date: Wed Nov 27 10:13:34 2019 -0300 perf regs: Make perf_reg_name() return "unknown" instead of NULL To avoid breaking the build on arches where this is not wired up, at least all the other features should be made available and when using this specific routine, the "unknown" should point the user/developer to the need to wire this up on this particular hardware architecture. Detected in a container mipsel debian cross build environment, where it shows up as: In file included from /usr/mipsel-linux-gnu/include/stdio.h:867, from /git/linux/tools/perf/lib/include/perf/cpumap.h:6, from util/session.c:13: In function 'printf', inlined from 'regs_dump__printf' at util/session.c:1103:3, inlined from 'regs__printf' at util/session.c:1131:2: /usr/mipsel-linux-gnu/include/bits/stdio2.h:107:10: error: '%-5s' directive argument is null [-Werror=format-overflow=] 107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ()); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cross compiler details: mipsel-linux-gnu-gcc (Debian 9.2.1-8) 9.2.1 20190909 Also on mips64: In file included from /usr/mips64-linux-gnuabi64/include/stdio.h:867, from /git/linux/tools/perf/lib/include/perf/cpumap.h:6, from util/session.c:13: In function 'printf', inlined from 'regs_dump__printf' at util/session.c:1103:3, inlined from 'regs__printf' at util/session.c:1131:2, inlined from 'regs_user__printf' at util/session.c:1139:3, inlined from 'dump_sample' at util/session.c:1246:3, inlined from 'machines__deliver_event' at util/session.c:1421:3: /usr/mips64-linux-gnuabi64/include/bits/stdio2.h:107:10: error: '%-5s' directive argument is null [-Werror=format-overflow=] 107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ()); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In function 'printf', inlined from 'regs_dump__printf' at util/session.c:1103:3, inlined from 'regs__printf' at util/session.c:1131:2, inlined from 'regs_intr__printf' at util/session.c:1147:3, inlined from 'dump_sample' at util/session.c:1249:3, inlined from 'machines__deliver_event' at util/session.c:1421:3: /usr/mips64-linux-gnuabi64/include/bits/stdio2.h:107:10: error: '%-5s' directive argument is null [-Werror=format-overflow=] 107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ()); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cross compiler details: mips64-linux-gnuabi64-gcc (Debian 9.2.1-8) 9.2.1 20190909 Fixes: 2bcd355b71da ("perf tools: Add interface to arch registers sets") Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-95wjyv4o65nuaeweq31t7l1s@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 2b1ac6403f8800babed0f16ab1d29ee3300be122 Author: Arnaldo Carvalho de Melo Date: Wed Nov 27 09:58:22 2019 -0300 perf diff: Use llabs() with 64-bit values To fix this build error on a debian mipsel cross build environment: builtin-diff.c: In function 'compute_cycles_diff': builtin-diff.c:649:10: error: absolute value function 'labs' given an argument of type 's64' {aka 'long long int'} but has parameter of type 'long int' which may cause truncation of value [-Werror=absolute-value] 649 | val = labs(pair->block_info->cycles_spark[i] - | ^~~~ Fixes: cebf7d51a6c3 ("perf diff: Report noisy for cycles diff") Cc: Jin Yao Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-pn7szy5uw384ntjgk6zckh6a@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 98e93245113d0f5c279ef77f4a9e7d097323ad71 Author: Arnaldo Carvalho de Melo Date: Wed Nov 27 09:58:22 2019 -0300 perf diff: Use llabs() with 64-bit values To fix these build errors on a debian mipsel cross build environment: builtin-diff.c: In function 'block_cycles_diff_cmp': builtin-diff.c:550:6: error: absolute value function 'labs' given an argument of type 's64' {aka 'long long int'} but has parameter of type 'long int' which may cause truncation of value [-Werror=absolute-value] 550 | l = labs(left->diff.cycles); | ^~~~ builtin-diff.c:551:6: error: absolute value function 'labs' given an argument of type 's64' {aka 'long long int'} but has parameter of type 'long int' which may cause truncation of value [-Werror=absolute-value] 551 | r = labs(right->diff.cycles); | ^~~~ Fixes: 99150a1faab2 ("perf diff: Use hists to manage basic blocks per symbol") Cc: Jin Yao Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-pn7szy5uw384ntjgk6zckh6a@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 59c4bd853abcea95eccc167a7d7fd5f1a5f47b98 Author: Sebastian Andrzej Siewior Date: Thu Nov 28 09:53:06 2019 +0100 x86/fpu: Don't cache access to fpu_fpregs_owner_ctx The state/owner of the FPU is saved to fpu_fpregs_owner_ctx by pointing to the context that is currently loaded. It never changed during the lifetime of a task - it remained stable/constant. After deferred FPU registers loading until return to userland was implemented, the content of fpu_fpregs_owner_ctx may change during preemption and must not be cached. This went unnoticed for some time and was now noticed, in particular since gcc 9 is caching that load in copy_fpstate_to_sigframe() and reusing it in the retry loop: copy_fpstate_to_sigframe() load fpu_fpregs_owner_ctx and save on stack fpregs_lock() copy_fpregs_to_sigframe() /* failed */ fpregs_unlock() *** PREEMPTION, another uses FPU, changes fpu_fpregs_owner_ctx *** fault_in_pages_writeable() /* succeed, retry */ fpregs_lock() __fpregs_load_activate() fpregs_state_valid() /* uses fpu_fpregs_owner_ctx from stack */ copy_fpregs_to_sigframe() /* succeeds, random FPU content */ This is a comparison of the assembly produced by gcc 9, without vs with this patch: | # arch/x86/kernel/fpu/signal.c:173: if (!access_ok(buf, size)) | cmpq %rdx, %rax # tmp183, _4 | jb .L190 #, |-# arch/x86/include/asm/fpu/internal.h:512: return fpu == this_cpu_read_stable(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu; |-#APP |-# 512 "arch/x86/include/asm/fpu/internal.h" 1 |- movq %gs:fpu_fpregs_owner_ctx,%rax #, pfo_ret__ |-# 0 "" 2 |-#NO_APP |- movq %rax, -88(%rbp) # pfo_ret__, %sfp … |-# arch/x86/include/asm/fpu/internal.h:512: return fpu == this_cpu_read_stable(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu; |- movq -88(%rbp), %rcx # %sfp, pfo_ret__ |- cmpq %rcx, -64(%rbp) # pfo_ret__, %sfp |+# arch/x86/include/asm/fpu/internal.h:512: return fpu == this_cpu_read(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu; |+#APP |+# 512 "arch/x86/include/asm/fpu/internal.h" 1 |+ movq %gs:fpu_fpregs_owner_ctx(%rip),%rax # fpu_fpregs_owner_ctx, pfo_ret__ |+# 0 "" 2 |+# arch/x86/include/asm/fpu/internal.h:512: return fpu == this_cpu_read(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu; |+#NO_APP |+ cmpq %rax, -64(%rbp) # pfo_ret__, %sfp Use this_cpu_read() instead this_cpu_read_stable() to avoid caching of fpu_fpregs_owner_ctx during preemption points. The Fixes: tag points to the commit where deferred FPU loading was added. Since this commit, the compiler is no longer allowed to move the load of fpu_fpregs_owner_ctx somewhere else / outside of the locked section. A task preemption will change its value and stale content will be observed. [ bp: Massage. ] Debugged-by: Austin Clements Debugged-by: David Chase Debugged-by: Ian Lance Taylor Fixes: 5f409e20b7945 ("x86/fpu: Defer FPU state load until return to userspace") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Borislav Petkov Reviewed-by: Rik van Riel Tested-by: Borislav Petkov Cc: Aubrey Li Cc: Austin Clements Cc: Barret Rhoden Cc: Dave Hansen Cc: David Chase Cc: "H. Peter Anvin" Cc: ian@airs.com Cc: Ingo Molnar Cc: Josh Bleecher Snyder Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/20191128085306.hxfa2o3knqtu4wfn@linutronix.de Link: https://bugzilla.kernel.org/show_bug.cgi?id=205663 commit 22d0d5ae7a089967e9295a06694aa3e8a812b15e Author: Christian Lamparter Date: Sun Nov 24 15:40:59 2019 +0100 ath9k: use iowrite32 over __raw_writel This patch changes the ath9k_pci_owl_loader to use the same iowrite32 memory accessor that ath9k_pci is using to communicate with the PCI(e) chip. This will fix endian issues that came up during testing with loaned AVM Fritz!Box 7360 (Lantiq MIPS SoCs + AR9287). Fixes: 5a4f2040fd07 ("ath9k: add loader for AR92XX (and older) pci(e)") Signed-off-by: Christian Lamparter Signed-off-by: Kalle Valo commit 3d94a4a8373bf5f45cf5f939e88b8354dbf2311b Author: Ganapathi Bhat Date: Thu Nov 21 21:34:38 2019 +0530 mwifiex: fix possible heap overflow in mwifiex_process_country_ie() mwifiex_process_country_ie() function parse elements of bss descriptor in beacon packet. When processing WLAN_EID_COUNTRY element, there is no upper limit check for country_ie_len before calling memcpy. The destination buffer domain_info->triplet is an array of length MWIFIEX_MAX_TRIPLET_802_11D(83). The remote attacker can build a fake AP with the same ssid as real AP, and send malicous beacon packet with long WLAN_EID_COUNTRY elemen (country_ie_len > 83). Attacker can force STA connect to fake AP on a different channel. When the victim STA connects to fake AP, will trigger the heap buffer overflow. Fix this by checking for length and if found invalid, don not connect to the AP. This fix addresses CVE-2019-14895. Reported-by: huangwen Signed-off-by: Ganapathi Bhat Signed-off-by: Kalle Valo commit 6d29032c2cef31633db5dfd946fbcf9190dddef0 Author: Rahul Tanwar Date: Thu Nov 28 16:08:32 2019 +0800 pinctrl: Fix warning by adding missing MODULE_LICENSE Fix below build warning WARNING: modpost: missing MODULE_LICENSE() in drivers/pinctrl/pinctrl-equilibrium.o Introduced by commit 1948d5c51dba ("pinctrl: Add pinmux & GPIO controller driver for a new SoC") by adding missing MODULE_LICENSE. Signed-off-by: Rahul Tanwar Link: https://lore.kernel.org/r/20191128080832.13529-2-rahul.tanwar@linux.intel.com Signed-off-by: Linus Walleij commit e1e8c1fdce8b00fce08784d9d738c60ebf598ebc Author: Kailang Yang Date: Tue Nov 26 17:04:23 2019 +0800 ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 headphone have noise even the volume is very small. Let it fill up pcbeep hidden register to default value. The issue was gone. Fixes: 4344aec84bd8 ("ALSA: hda/realtek - New codec support for ALC256") Fixes: 736f20a70608 ("ALSA: hda/realtek - Add support for ALC236/ALC3204") Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/9ae47f23a64d4e41a9c81e263cd8a250@realtek.com Signed-off-by: Takashi Iwai commit 013a53f2d25a9fa9b9e1f70f5baa3f56e3454052 Author: Anshuman Khandual Date: Mon Nov 25 08:36:31 2019 +0530 powerpc: Ultravisor: Add PPC_UV config option CONFIG_PPC_UV adds support for ultravisor. Signed-off-by: Anshuman Khandual Signed-off-by: Bharata B Rao Signed-off-by: Ram Pai [ Update config help and commit message ] Signed-off-by: Claudio Carvalho Reviewed-by: Sukadev Bhattiprolu Signed-off-by: Paul Mackerras commit 22945688acd4d0ec2620b0670a53110401ed9c59 Author: Bharata B Rao Date: Mon Nov 25 08:36:30 2019 +0530 KVM: PPC: Book3S HV: Support reset of secure guest Add support for reset of secure guest via a new ioctl KVM_PPC_SVM_OFF. This ioctl will be issued by QEMU during reset and includes the the following steps: - Release all device pages of the secure guest. - Ask UV to terminate the guest via UV_SVM_TERMINATE ucall - Unpin the VPA pages so that they can be migrated back to secure side when guest becomes secure again. This is required because pinned pages can't be migrated. - Reinit the partition scoped page tables After these steps, guest is ready to issue UV_ESM call once again to switch to secure mode. Signed-off-by: Bharata B Rao Signed-off-by: Sukadev Bhattiprolu [Implementation of uv_svm_terminate() and its call from guest shutdown path] Signed-off-by: Ram Pai [Unpinning of VPA pages] Signed-off-by: Paul Mackerras commit c32622575dd0ecb6fd0b41e3a451bd58152971ba Author: Bharata B Rao Date: Mon Nov 25 08:36:29 2019 +0530 KVM: PPC: Book3S HV: Handle memory plug/unplug to secure VM Register the new memslot with UV during plug and unregister the memslot during unplug. In addition, release all the device pages during unplug. Signed-off-by: Bharata B Rao Signed-off-by: Paul Mackerras commit 008e359c76d85facb10d10fa21fd5bc8c3a4e5d6 Author: Bharata B Rao Date: Mon Nov 25 08:36:28 2019 +0530 KVM: PPC: Book3S HV: Radix changes for secure guest - After the guest becomes secure, when we handle a page fault of a page belonging to SVM in HV, send that page to UV via UV_PAGE_IN. - Whenever a page is unmapped on the HV side, inform UV via UV_PAGE_INVAL. - Ensure all those routines that walk the secondary page tables of the guest don't do so in case of secure VM. For secure guest, the active secondary page tables are in secure memory and the secondary page tables in HV are freed when guest becomes secure. Signed-off-by: Bharata B Rao Signed-off-by: Paul Mackerras commit 60f0a643aa44e4bed3a74ea671110707dd64d892 Author: Bharata B Rao Date: Mon Nov 25 08:36:27 2019 +0530 KVM: PPC: Book3S HV: Shared pages support for secure guests A secure guest will share some of its pages with hypervisor (Eg. virtio bounce buffers etc). Support sharing of pages between hypervisor and ultravisor. Shared page is reachable via both HV and UV side page tables. Once a secure page is converted to shared page, the device page that represents the secure page is unmapped from the HV side page tables. Signed-off-by: Bharata B Rao Signed-off-by: Paul Mackerras commit ca9f4942670c37407bb109090eaf776ce2ccc54c Author: Bharata B Rao Date: Mon Nov 25 08:36:26 2019 +0530 KVM: PPC: Book3S HV: Support for running secure guests A pseries guest can be run as secure guest on Ultravisor-enabled POWER platforms. On such platforms, this driver will be used to manage the movement of guest pages between the normal memory managed by hypervisor (HV) and secure memory managed by Ultravisor (UV). HV is informed about the guest's transition to secure mode via hcalls: H_SVM_INIT_START: Initiate securing a VM H_SVM_INIT_DONE: Conclude securing a VM As part of H_SVM_INIT_START, register all existing memslots with the UV. H_SVM_INIT_DONE call by UV informs HV that transition of the guest to secure mode is complete. These two states (transition to secure mode STARTED and transition to secure mode COMPLETED) are recorded in kvm->arch.secure_guest. Setting these states will cause the assembly code that enters the guest to call the UV_RETURN ucall instead of trying to enter the guest directly. Migration of pages betwen normal and secure memory of secure guest is implemented in H_SVM_PAGE_IN and H_SVM_PAGE_OUT hcalls. H_SVM_PAGE_IN: Move the content of a normal page to secure page H_SVM_PAGE_OUT: Move the content of a secure page to normal page Private ZONE_DEVICE memory equal to the amount of secure memory available in the platform for running secure guests is created. Whenever a page belonging to the guest becomes secure, a page from this private device memory is used to represent and track that secure page on the HV side. The movement of pages between normal and secure memory is done via migrate_vma_pages() using UV_PAGE_IN and UV_PAGE_OUT ucalls. In order to prevent the device private pages (that correspond to pages of secure guest) from participating in KSM merging, H_SVM_PAGE_IN calls ksm_madvise() under read version of mmap_sem. However ksm_madvise() needs to be under write lock. Hence we call kvmppc_svm_page_in with mmap_sem held for writing, and it then downgrades to a read lock after calling ksm_madvise. [paulus@ozlabs.org - roll in patch "KVM: PPC: Book3S HV: Take write mmap_sem when calling ksm_madvise"] Signed-off-by: Bharata B Rao Signed-off-by: Paul Mackerras commit 33cf170715e87efd0608af6f2c056cafe0e7fc47 Author: Bharata B Rao Date: Mon Nov 25 08:36:25 2019 +0530 mm: ksm: Export ksm_madvise() On PEF-enabled POWER platforms that support running of secure guests, secure pages of the guest are represented by device private pages in the host. Such pages needn't participate in KSM merging. This is achieved by using ksm_madvise() call which need to be exported since KVM PPC can be a kernel module. Signed-off-by: Bharata B Rao Acked-by: Hugh Dickins Cc: Andrea Arcangeli Signed-off-by: Paul Mackerras commit 0a6cad5df541108cfd3fbd79eef48eb824c89bdc Merge: acc61b892936 9ca7d19ff8ba Author: Dave Airlie Date: Thu Nov 28 12:39:50 2019 +1000 Merge branch 'vmwgfx-coherent' of git://people.freedesktop.org/~thomash/linux into drm-next Graphics APIs like OpenGL 4.4 and Vulkan require the graphics driver to provide coherent graphics memory, meaning that the GPU sees any content written to the coherent memory on the next GPU operation that touches that memory, and the CPU sees any content written by the GPU to that memory immediately after any fence object trailing the GPU operation is signaled. Paravirtual drivers that otherwise require explicit synchronization needs to do this by hooking up dirty tracking to pagefault handlers and buffer object validation. Provide mm helpers needed for this and that also allow for huge pmd- and pud entries (patch 1-3), and the associated vmwgfx code (patch 4-7). The code has been tested and exercised by a tailored version of mesa where we disable all explicit synchronization and assume graphics memory is coherent. The performance loss varies of course; a typical number is around 5%. Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patchwork.freedesktop.org/patch/msgid/20191113131639.4653-1-thomas_os@shipmail.org commit 7c3977d1e80401b1a25efded698b05d60ee26e31 Author: Alexei Starovoitov Date: Wed Nov 27 17:46:56 2019 -0800 libbpf: Fix sym->st_value print on 32-bit arches The st_value field is a 64-bit value and causing this error on 32-bit arches: In file included from libbpf.c:52: libbpf.c: In function 'bpf_program__record_reloc': libbpf_internal.h:59:22: error: format '%lu' expects argument of type 'long unsigned int', but argument 3 has type 'Elf64_Addr' {aka 'const long long unsigned int'} [-Werror=format=] Fix it with (__u64) cast. Fixes: 1f8e2bcb2cd5 ("libbpf: Refactor relocation handling") Reported-by: Arnaldo Carvalho de Melo Signed-off-by: Alexei Starovoitov commit a6ed68d6468bd5a3da78a103344ded1435fed57a Merge: 8c39f71ee201 acc61b892936 Author: Linus Torvalds Date: Wed Nov 27 17:45:48 2019 -0800 Merge tag 'drm-next-2019-11-27' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "Lots of stuff in here, though it hasn't been too insane this merge apart from dealing with the security fun. uapi: - export different colorspace properties on DP vs HDMI - new fourcc for ARM 16x16 block format - syncobj: allow querying last submitted timeline value - DRM_FORMAT_BIG_ENDIAN defined as unsigned core: - allow using gem vma manager in ttm - connector/encoder/bridge doc fixes - allow more than 3 encoders for a connector - displayport mst suspend/resume reprobing support - vram lazy unmapping, uniform vram mm and gem vram - edid cleanups + AVI informframe bar info - displayport helpers - dpcd parser added dp_cec: - Allow a connector to be associated with a cec device ttm: - pipelining with no_gpu_wait fix - always keep BOs on the LRU sched: - allow free_job routine to sleep i915: - Block userptr from mappable GTT - i915 perf uapi versioning - OA stream dynamic reconfiguration - make context persistence optional - introduce DRM_I915_UNSTABLE Kconfig - add fake lmem testing under unstable - BT.2020 support for DP MSA - struct mutex elimination - Tigerlake display/PLL/power management improvements - Jasper Lake PCH support - refactor PMU for multiple GPUs - Icelake firmware update - Split out vga + switcheroo code amdgpu: - implement dma-buf import/export without helpers - vega20 RAS enablement - DC i2c over aux fixes - renoir GPU reset - DC HDCP support - BACO support for CI/VI asics - MSI-X support - Arcturus EEPROM support - Arcturus VCN encode support - VCN dynamic powergating on RV/RV2 amdkfd: - add navi12/14/renoir support to kfd radeon: - SI dpm fix ported from amdgpu - fix bad DMA on ppc platforms gma500: - memory leak fixes qxl: - convert to new gem mmap exynos: - build warning fix komeda: - add aclk sysfs attribute v3d: - userspace cleanup uapi change i810: - fix for underflow in dispatch ioctls ast: - refactor show_cursor mgag200: - refactor show_cursor arcgpu: - encoder finding improvements mediatek: - mipi_tx, dsi and partial crtc support for MT8183 SoC - rotation support meson: - add suspend/resume support omap: - misc refactors tegra: - DisplayPort support for Tegra 210, 186 and 194. - IOMMU-backed DMA API fixes panfrost: - fix lockdep issue - simplify devfreq integration rcar-du: - R8A774B1 SoC support - fixes for H2 ES2.0 sun4i: - vcc-dsi regulator support virtio-gpu: - vmexit vs spinlock fix - move to gem shmem helpers - handle large command buffers with cma" * tag 'drm-next-2019-11-27' of git://anongit.freedesktop.org/drm/drm: (1855 commits) drm/amdgpu: invalidate mmhub semaphore workaround in gmc9/gmc10 drm/amdgpu: initialize vm_inv_eng0_sem for gfxhub and mmhub drm/amd/amdgpu/sriov skip RLCG s/r list for arcturus VF. drm/amd/amdgpu/sriov temporarily skip ras,dtm,hdcp for arcturus VF drm/amdgpu/gfx10: re-init clear state buffer after gpu reset merge fix for "ftrace: Rework event_create_dir()" drm/amdgpu: Update Arcturus golden registers drm/amdgpu/gfx10: fix out-of-bound mqd_backup array access drm/amdgpu/gfx10: explicitly wait for cp idle after halt/unhalt Revert "drm/amd/display: enable S/G for RAVEN chip" drm/amdgpu: disable gfxoff on original raven drm/amdgpu: remove experimental flag for Navi14 drm/amdgpu: disable gfxoff when using register read interface drm/amdgpu/powerplay: properly set PP_GFXOFF_MASK (v2) drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2 drm/radeon: fix bad DMA from INTERRUPT_CNTL2 drm/amd/display: Fix debugfs on MST connectors drm/amdgpu/nv: add asic func for fetching vbios from rom directly drm/amdgpu: put flush_delayed_work at first drm/amdgpu/vcn2.5: fix the enc loop with hw fini ... commit 8c39f71ee2019e77ee14f88b1321b2348db51820 Merge: 95f1fa9e3418 bac139a84669 Author: Linus Torvalds Date: Wed Nov 27 17:17:40 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: "This is mostly to fix the iwlwifi regression: 1) Flush GRO state properly in iwlwifi driver, from Alexander Lobakin. 2) Validate TIPC link name with properly length macro, from John Rutherford. 3) Fix completion init and device query timeouts in ibmvnic, from Thomas Falcon. 4) Fix SKB size calculation for netlink messages in psample, from Nikolay Aleksandrov. 5) Similar kind of fix for OVS flow dumps, from Paolo Abeni. 6) Handle queue allocation failure unwind properly in gve driver, we could try to release pages we didn't allocate. From Jeroen de Borst. 7) Serialize TX queue SKB list accesses properly in mscc ocelot driver. From Yangbo Lu" * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: net: usb: aqc111: Use the correct style for SPDX License Identifier net: phy: Use the correct style for SPDX License Identifier net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling net: mscc: ocelot: use skb queue instead of skbs list net: mscc: ocelot: avoid incorrect consuming in skbs list gve: Fix the queue page list allocated pages count net: inet_is_local_reserved_port() port arg should be unsigned short openvswitch: fix flow command message size net: phy: dp83869: Fix return paths to return proper values net: psample: fix skb_over_panic net: usbnet: Fix -Wcast-function-type net: hso: Fix -Wcast-function-type net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port) ibmvnic: Serialize device queries ibmvnic: Bound waits for device queries ibmvnic: Terminate waiting device threads after loss of service ibmvnic: Fix completion structure initialization net-sctp: replace some sock_net(sk) with just 'net' net: Fix a documentation bug wrt. ip_unprivileged_port_start tipc: fix link name length check commit 1fd450f99272791df8ea8e1b0f5657678e118e90 Author: Arnaldo Carvalho de Melo Date: Tue Nov 26 12:10:45 2019 -0300 libbpf: Fix up generation of bpf_helper_defs.h $ make -C tools/perf build-test does, ends up with these two problems: make[3]: *** No rule to make target '/tmp/tmp.zq13cHILGB/perf-5.3.0/include/uapi/linux/bpf.h', needed by 'bpf_helper_defs.h'. Stop. make[3]: *** Waiting for unfinished jobs.... make[2]: *** [Makefile.perf:757: /tmp/tmp.zq13cHILGB/perf-5.3.0/tools/lib/bpf/libbpf.a] Error 2 make[2]: *** Waiting for unfinished jobs.... Because $(srcdir) points to the /tmp/tmp.zq13cHILGB/perf-5.3.0 directory and we need '/tools/ after that variable, and after fixing this then we get to another problem: /bin/sh: /home/acme/git/perf/tools/scripts/bpf_helpers_doc.py: No such file or directory make[3]: *** [Makefile:184: bpf_helper_defs.h] Error 127 make[3]: *** Deleting file 'bpf_helper_defs.h' LD /tmp/build/perf/libapi-in.o make[2]: *** [Makefile.perf:778: /tmp/build/perf/libbpf.a] Error 2 make[2]: *** Waiting for unfinished jobs.... Because this requires something outside the tools/ directories that gets collected into perf's detached tarballs, to fix it just add it to tools/perf/MANIFEST, which this patch does, now it works for that case and also for all these other cases. Fixes: e01a75c15969 ("libbpf: Move bpf_{helpers, helper_defs, endian, tracing}.h into libbpf") Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Alexei Starovoitov Cc: Adrian Hunter Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Jiri Olsa Cc: Martin KaFai Lau Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-4pnkg2vmdvq5u6eivc887wen@git.kernel.org Link: https://lore.kernel.org/bpf/20191126151045.GB19483@kernel.org commit 53f8dd434b6fe666b1c4e0be80a8727e8fa9839f Author: Andrii Nakryiko Date: Wed Nov 27 12:06:50 2019 -0800 libbpf: Fix global variable relocation Similarly to a0d7da26ce86 ("libbpf: Fix call relocation offset calculation bug"), relocations against global variables need to take into account referenced symbol's st_value, which holds offset into a corresponding data section (and, subsequently, offset into internal backing map). For static variables this offset is always zero and data offset is completely described by respective instruction's imm field. Convert a bunch of selftests to global variables. Previously they were relying on `static volatile` trick to ensure Clang doesn't inline static variables, which with global variables is not necessary anymore. Fixes: 393cdfbee809 ("libbpf: Support initialized global variables") Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20191127200651.1381348-1-andriin@fb.com commit b568405856906ee4d9ba6284fd36f2928653a623 Author: Andrii Nakryiko Date: Wed Nov 27 12:01:34 2019 -0800 libbpf: Fix Makefile' libbpf symbol mismatch diagnostic Fix Makefile's diagnostic diff output when there is LIBBPF_API-versioned symbols mismatch. Fixes: 1bd63524593b ("libbpf: handle symbol versioning properly for libbpf.a") Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20191127200134.1360660-1-andriin@fb.com commit 82995cc6c5ae4bf4d72edef381a085e52d5b5905 Author: David Howells Date: Mon Mar 25 16:38:32 2019 +0000 libceph, rbd, ceph: convert to use the new mount API Convert the ceph filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. [ Numerous string handling, leak and regression fixes; rbd conversion was particularly broken and had to be redone almost from scratch. ] Signed-off-by: David Howells Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 95f1fa9e3418d50ce099e67280b5497b9c93843b Merge: 477093b3e144 16c0f03f629a Author: Linus Torvalds Date: Wed Nov 27 11:42:01 2019 -0800 Merge tag 'trace-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing updates from Steven Rostedt: "New tracing features: - New PERMANENT flag to ftrace_ops when attaching a callback to a function. As /proc/sys/kernel/ftrace_enabled when set to zero will disable all attached callbacks in ftrace, this has a detrimental impact on live kernel tracing, as it disables all that it patched. If a ftrace_ops is registered to ftrace with the PERMANENT flag set, it will prevent ftrace_enabled from being disabled, and if ftrace_enabled is already disabled, it will prevent a ftrace_ops with PREMANENT flag set from being registered. - New register_ftrace_direct(). As eBPF would like to register its own trampolines to be called by the ftrace nop locations directly, without going through the ftrace trampoline, this function has been added. This allows for eBPF trampolines to live along side of ftrace, perf, kprobe and live patching. It also utilizes the ftrace enabled_functions file that keeps track of functions that have been modified in the kernel, to allow for security auditing. - Allow for kernel internal use of ftrace instances. Subsystems in the kernel can now create and destroy their own tracing instances which allows them to have their own tracing buffer, and be able to record events without worrying about other users from writing over their data. - New seq_buf_hex_dump() that lets users use the hex_dump() in their seq_buf usage. - Notifications now added to tracing_max_latency to allow user space to know when a new max latency is hit by one of the latency tracers. - Wider spread use of generic compare operations for use of bsearch and friends. - More synthetic event fields may be defined (32 up from 16) - Use of xarray for architectures with sparse system calls, for the system call trace events. This along with small clean ups and fixes" * tag 'trace-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (51 commits) tracing: Enable syscall optimization for MIPS tracing: Use xarray for syscall trace events tracing: Sample module to demonstrate kernel access to Ftrace instances. tracing: Adding new functions for kernel access to Ftrace instances tracing: Fix Kconfig indentation ring-buffer: Fix typos in function ring_buffer_producer ftrace: Use BIT() macro ftrace: Return ENOTSUPP when DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not configured ftrace: Rename ftrace_graph_stub to ftrace_stub_graph ftrace: Add a helper function to modify_ftrace_direct() to allow arch optimization ftrace: Add helper find_direct_entry() to consolidate code ftrace: Add another check for match in register_ftrace_direct() ftrace: Fix accounting bug with direct->count in register_ftrace_direct() ftrace/selftests: Fix spelling mistake "wakeing" -> "waking" tracing: Increase SYNTH_FIELDS_MAX for synthetic_events ftrace/samples: Add a sample module that implements modify_ftrace_direct() ftrace: Add modify_ftrace_direct() tracing: Add missing "inline" in stub function of latency_fsnotify() tracing: Remove stray tab in TRACE_EVAL_MAP_FILE's help text tracing: Use seq_buf_hex_dump() to dump buffers ... commit 477093b3e144aa0ece07a5fd2a84013d037e2776 Merge: 6a0e20cd8cdd 22648c989cb8 Author: Linus Torvalds Date: Wed Nov 27 11:30:55 2019 -0800 Merge tag 'microblaze-v5.5-rc1' of git://git.monstr.eu/linux-2.6-microblaze Pull Microblaze updates from Michal Simek: - extend DTB space - defconfig update - clean up rescheduling logic - enable SPARSE_IRQ * tag 'microblaze-v5.5-rc1' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: Increase max dtb size to 64K from 32K microblaze: Enable SPARSE_IRQ microblaze: defconfig: Enable devtmps and tmpfs microblaze: entry: Remove unneeded need_resched() loop commit 6a0e20cd8cddd70ae5c1211ebe102d738ff2069b Merge: 80eb5fea3c14 5ba9aa56e6d3 Author: Linus Torvalds Date: Wed Nov 27 11:27:59 2019 -0800 Merge tag 'riscv/for-v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: "New features: - SECCOMP support - nommu support - SBI-less system support - M-Mode support - TLB flush optimizations Other improvements: - Pass the complete RISC-V ISA string supported by the CPU cores to userspace, rather than redacting parts of it in the kernel - Add platform DMA IP block data to the HiFive Unleashed board DT file - Add Makefile support for BZ2, LZ4, LZMA, LZO kernel image compression formats, in line with other architectures Cleanups: - Remove unnecessary PTE_PARENT_SIZE macro - Standardize include guard naming across arch/riscv" * tag 'riscv/for-v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (22 commits) riscv: provide a flat image loader riscv: add nommu support riscv: clear the instruction cache and all registers when booting riscv: read the hart ID from mhartid on boot riscv: provide native clint access for M-mode riscv: dts: add support for PDMA device of HiFive Unleashed Rev A00 riscv: add support for MMIO access to the timer registers riscv: implement remote sfence.i using IPIs riscv: cleanup the default power off implementation riscv: poison SBI calls for M-mode riscv: don't allow selecting SBI based drivers for M-mode RISC-V: Add multiple compression image format. riscv: clean up the macro format in each header file riscv: Use PMD_SIZE to replace PTE_PARENT_SIZE riscv: abstract out CSR names for supervisor vs machine mode riscv: separate MMIO functions into their own header file riscv: enter WFI in default_power_off() if SBI does not shutdown RISC-V: Issue a tlb page flush if possible RISC-V: Issue a local tlbflush if possible. RISC-V: Do not invoke SBI call if cpumask is empty ... commit bac139a846697b290c74fefd6af54a9e192de315 Author: Nishad Kamdar Date: Wed Nov 27 19:15:52 2019 +0530 net: usb: aqc111: Use the correct style for SPDX License Identifier This patch corrects the SPDX License Identifier style in header files related to drivers for USB Network devices. This patch gives an explicit block comment to the SPDX License Identifier. Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by: Joe Perches Signed-off-by: Nishad Kamdar Signed-off-by: David S. Miller commit 9aab906a9adc292f2bb7eccfd0b1c0aa862296ca Author: Nishad Kamdar Date: Wed Nov 27 18:49:08 2019 +0530 net: phy: Use the correct style for SPDX License Identifier This patch corrects the SPDX License Identifier style in header files related to PHY Layer for Ethernet drivers. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used). This patch also gives an explicit block comment to the SPDX License Identifier. Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by: Joe Perches Signed-off-by: Nishad Kamdar Signed-off-by: David S. Miller commit 80eb5fea3c14fb171facb5242a1555b3aafea4d0 Merge: 9a3d7fd275be af2e8c68b9c5 Author: Linus Torvalds Date: Wed Nov 27 11:25:04 2019 -0800 Merge tag 'powerpc-spectre-rsb' of powerpc-CVE-2019-18660.bundle Pull powerpc Spectre-RSB fixes from Michael Ellerman: "We failed to activate the mitigation for Spectre-RSB (Return Stack Buffer, aka. ret2spec) on context switch, on CPUs prior to Power9 DD2.3. That allows a process to poison the RSB (called Link Stack on Power CPUs) and possibly misdirect speculative execution of another process. If the victim process can be induced to execute a leak gadget then it may be possible to extract information from the victim via a side channel. The fix is to correctly activate the link stack flush mitigation on all CPUs that have any mitigation of Spectre v2 in userspace enabled. There's a second commit which adds a link stack flush in the KVM guest exit path. A leak via that path has not been demonstrated, but we believe it's at least theoretically possible. This is the fix for CVE-2019-18660" * tag 'powerpc-spectre-rsb' of /home/torvalds/Downloads/powerpc-CVE-2019-18660.bundle: KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel powerpc/book3s64: Fix link stack flush on context switch commit b167191e2a851cb2e4c6ef8b91c83ff73ef41872 Author: Alexander Lobakin Date: Wed Nov 27 12:41:23 2019 +0300 net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling Commit 6570bc79c0df ("net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()") has applied batched GRO_NORMAL packets processing to all napi_gro_receive() users, including mac80211-based drivers. However, this change has led to a regression in iwlwifi driver [1][2] as it is required for NAPI users to call napi_complete_done() or napi_complete() and the end of every polling iteration, whilst iwlwifi doesn't use NAPI scheduling at all and just calls napi_gro_flush(). In that particular case, packets which have not been already flushed from napi->rx_list stall in it until at least next Rx cycle. Fix this by adding a manual flushing of the list to iwlwifi driver right before napi_gro_flush() call to mimic napi_complete() logics. I prefer to open-code gro_normal_list() rather than exporting it for 2 reasons: * to prevent from using it and napi_gro_flush() in any new drivers, as it is the *really* bad way to use NAPI that should be avoided; * to keep gro_normal_list() static and don't lose any CC optimizations. I also don't add the "Fixes:" tag as the mentioned commit was only a trigger that only exposed an improper usage of NAPI in this particular driver. [1] https://lore.kernel.org/netdev/PSXP216MB04388962C411CD0B17A86F47804A0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM [2] https://bugzilla.kernel.org/show_bug.cgi?id=205647 Signed-off-by: Alexander Lobakin Acked-by: Luca Coelho Reported-by: Nicholas Johnson Tested-by: Nicholas Johnson Reviewed-by: Edward Cree Signed-off-by: David S. Miller commit da5fb18225b49b97bb37c51bcbbb2990a507c364 Author: Stanislav Fomichev Date: Wed Nov 27 08:14:10 2019 -0800 bpf: Support pre-2.25-binutils objcopy for vmlinux BTF If vmlinux BTF generation fails, but CONFIG_DEBUG_INFO_BTF is set, .BTF section of vmlinux is empty and kernel will prohibit BPF loading and return "in-kernel BTF is malformed". --dump-section argument to binutils' objcopy was added in version 2.25. When using pre-2.25 binutils, BTF generation silently fails. Convert to --only-section which is present on pre-2.25 binutils. Documentation/process/changes.rst states that binutils 2.21+ is supported, not sure those standards apply to BPF subsystem. v2: * exit and print an error if gen_btf fails (John Fastabend) v3: * resend with Andrii's Acked-by/Tested-by tags Fixes: 341dfcf8d78ea ("btf: expose BTF info through sysfs") Signed-off-by: Stanislav Fomichev Signed-off-by: Alexei Starovoitov Tested-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Cc: John Fastabend Link: https://lore.kernel.org/bpf/20191127161410.57327-1-sdf@google.com commit 9a3d7fd275be4559277667228902824165153c80 Merge: 0dd09bc02c1b 0e4a459f56c3 Author: Linus Torvalds Date: Wed Nov 27 11:06:20 2019 -0800 Merge tag 'driver-core-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the "big" set of driver core patches for 5.5-rc1 There's a few minor cleanups and fixes in here, but the majority of the patches in here fall into two buckets: - debugfs api cleanups and fixes - driver core device link support for boot dependancy issues The debugfs api cleanups are working to slowly refactor the debugfs apis so that it is even harder to use incorrectly. That work has been happening for the past few kernel releases and will continue over time, it's a long-term project/goal The driver core device link support missed 5.4 by just a bit, so it's been sitting and baking for many months now. It's from Saravana Kannan to help resolve the problems that DT-based systems have at boot time with dependancy graphs and kernel modules. Turns out that no one has actually tried to build a generic arm64 kernel with loads of modules and have it "just work" for a variety of platforms (like a distro kernel). The big problem turned out to be a lack of dependency information between different areas of DT entries, and the work here resolves that problem and now allows devices to boot properly, and quicker than a monolith kernel. All of these patches have been in linux-next for a long time with no reported issues" * tag 'driver-core-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (68 commits) tracing: Remove unnecessary DEBUG_FS dependency of: property: Add device link support for interrupt-parent, dmas and -gpio(s) debugfs: Fix !DEBUG_FS debugfs_create_automount of: property: Add device link support for "iommu-map" of: property: Fix the semantics of of_is_ancestor_of() i2c: of: Populate fwnode in of_i2c_get_board_info() drivers: base: Fix Kconfig indentation firmware_loader: Fix labels with comma for builtin firmware driver core: Allow device link operations inside sync_state() driver core: platform: Declare ret variable only once cpu-topology: declare parse_acpi_topology in crypto: hisilicon: no need to check return value of debugfs_create functions driver core: platform: use the correct callback type for bus_find_device firmware_class: make firmware caching configurable driver core: Clarify documentation for fwnode_operations.add_links() mailbox: tegra: Fix superfluous IRQ error message net: caif: Fix debugfs on 64-bit platforms mac80211: Use debugfs_create_xul() helper media: c8sectpfe: no need to check return value of debugfs_create functions of: property: Add device link support for iommus, mboxes and io-channels ... commit 0dd09bc02c1bad55e92306ca83b38b3cf48b9f40 Merge: 8f56e4ebe05c 0f6f8749872e Author: Linus Torvalds Date: Wed Nov 27 10:57:52 2019 -0800 Merge tag 'staging-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging / iio updates from Greg KH: "Here is the big staging and iio set of patches for the 5.5-rc1 release. It's the usual huge collection of cleanup patches all over the drivers/staging/ area, along with a new staging driver, and a bunch of new IIO drivers as well. Full details are in the shortlog, but all of these have been in linux-next for a long time with no reported issues" * tag 'staging-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (548 commits) staging: vchiq: Have vchiq_dump_* functions return an error code staging: vchiq: Refactor indentation in vchiq_dump_* functions staging: fwserial: Fix Kconfig indentation (seven spaces) staging: vchiq_dump: Replace min with min_t staging: vchiq: Fix block comment format in vchiq_dump() staging: octeon: indent with tabs instead of spaces staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error staging: most: core: remove sysfs attr remove_link staging: vc04: Fix Kconfig indentation staging: pi433: Fix Kconfig indentation staging: nvec: Fix Kconfig indentation staging: most: Fix Kconfig indentation staging: fwserial: Fix Kconfig indentation staging: fbtft: Fix Kconfig indentation fbtft: Drop OF dependency fbtft: Make use of device property API fbtft: Drop useless #ifdef CONFIG_OF and dead code fbtft: Describe function parameters in kernel-doc fbtft: Make sure string is NULL terminated staging: rtl8723bs: remove set but not used variable 'change', 'pos' ... commit 8f56e4ebe05c26c30e167519273843476e39e244 Merge: 59274c716480 b78cda795ac8 Author: Linus Torvalds Date: Wed Nov 27 10:53:50 2019 -0800 Merge tag 'char-misc-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver updates from Greg KH: "Here is the big set of char/misc and other driver patches for 5.5-rc1 Loads of different things in here, this feels like the catch-all of driver subsystems these days. Full details are in the shortlog, but nothing major overall, just lots of driver updates and additions. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (198 commits) char: Fix Kconfig indentation, continued habanalabs: add more protection of device during reset habanalabs: flush EQ workers in hard reset habanalabs: make the reset code more consistent habanalabs: expose reset counters via existing INFO IOCTL habanalabs: make code more concise habanalabs: use defines for F/W files habanalabs: remove prints on successful device initialization habanalabs: remove unnecessary checks habanalabs: invalidate MMU cache only once habanalabs: skip VA block list update in reset flow habanalabs: optimize MMU unmap habanalabs: prevent read/write from/to the device during hard reset habanalabs: split MMU properties to PCI/DRAM habanalabs: re-factor MMU masks and documentation habanalabs: type specific MMU cache invalidation habanalabs: re-factor memory module code habanalabs: export uapi defines to user-space habanalabs: don't print error when queues are full habanalabs: increase max jobs number to 512 ... commit a02e3991af3d8fd6c529331554d543bc329f5669 Merge: a95069ecb709 b049da133808 Author: David S. Miller Date: Wed Nov 27 10:53:37 2019 -0800 Merge branch 'mscc-skb-lists' Yangbo Lu says: ==================== net: mscc: ocelot: fix potential issues accessing skbs list Fix two prtential issues accessing skbs list. - Break the matching loop when find the matching skb to avoid consuming more skbs incorrectly. The timestamp ID is only from 0 to 3 while the FIFO supports 128 timestamps at most. - Convert to use skb queue instead of the list of skbs to provide protect with lock. Changes for v2: - Split into two patches. - Converted to use skb queue. ==================== Signed-off-by: David S. Miller commit b049da1338082714262034a8c8b87022623dc106 Author: Yangbo Lu Date: Wed Nov 27 15:27:57 2019 +0800 net: mscc: ocelot: use skb queue instead of skbs list Convert to use skb queue instead of the list of skbs. The skb queue could provide protection with lock. Signed-off-by: Yangbo Lu Signed-off-by: David S. Miller commit fc62c0948986b7aa6b2871a450a4469e35c5f9bc Author: Yangbo Lu Date: Wed Nov 27 15:27:56 2019 +0800 net: mscc: ocelot: avoid incorrect consuming in skbs list Break the matching loop when find the matching skb for TX timestamp. This is to avoid consuming more skbs incorrectly. The timestamp ID is from 0 to 3 while the FIFO could support 128 timestamps at most. Signed-off-by: Yangbo Lu Signed-off-by: David S. Miller commit 59274c7164807d27b24e6c068dfe734f7bea4623 Merge: d76886972823 91a9f2d3f976 Author: Linus Torvalds Date: Wed Nov 27 10:46:34 2019 -0800 Merge tag 'usb-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB updates from Greg KH: "Here is the big set of USB patches for 5.5-rc1 Lots of little things in here: - typec updates and additions - usb-serial drivers cleanups and fixes - misc USB drivers cleanups and fixes - gadget drivers new features and controllers added - usual xhci additions - other minor changes All of these have been in linux-next with no reported issues" * tag 'usb-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (223 commits) usb: gadget: udc: gr_udc: create debugfs directory under usb root usb: gadget: atmel: create debugfs directory under usb root usb: musb: create debugfs directory under usb root usb: serial: Fix Kconfig indentation usb: misc: Fix Kconfig indentation usb: gadget: Fix Kconfig indentation usb: host: Fix Kconfig indentation usb: dwc3: Fix Kconfig indentation usb: gadget: configfs: Fix missing spin_lock_init() usb-storage: Disable UAS on JMicron SATA enclosure USB: documentation: flags on usb-storage versus UAS USB: uas: heed CAPACITY_HEURISTICS USB: uas: honor flag to avoid CAPACITY16 usb: host: xhci-tegra: Correct phy enable sequence usb-serial: cp201x: support Mark-10 digital force gauge usb: chipidea: imx: pinctrl for HSIC is optional usb: chipidea: imx: refine the error handling for hsic usb: chipidea: imx: change hsic power regulator as optional usb: chipidea: imx: check data->usbmisc_data against NULL before access usb: chipidea: core: change vbus-regulator as optional ... commit 87f67cc4c7b81273fd1d9f775192eeb3124562f9 Author: Guenter Roeck Date: Wed Nov 27 07:26:12 2019 -0800 MIPS: Fix boot on Fuloong2 systems Commit 268a2d60013049 ("MIPS: Loongson64: Rename CPU TYPES") changed Kconfig symbols as follows: CPU_LOONGSON2 to CPU_LOONGSON2EF CPU_LOONGSON3 to CPU_LOONGSON64 SYS_HAS_CPU_LOONGSON3 to SYS_HAS_CPU_LOONGSON64 It did not touch SYS_HAS_CPU_LOONGSON2E or SYS_HAS_CPU_LOONGSON2F. However, the patch changed a conditional from #if defined(CONFIG_SYS_HAS_CPU_LOONGSON2E) || \ defined(CONFIG_SYS_HAS_CPU_LOONGSON2F) to #if defined(CONFIG_SYS_HAS_CPU_LOONGSON2EF) SYS_HAS_CPU_LOONGSON2EF does not exist, resulting in boot failures with the qemu fulong2e emulation. Revert to the original code. Fixes: 268a2d60013049 ("MIPS: Loongson64: Rename CPU TYPES") Cc: Jiaxun Yang Signed-off-by: Guenter Roeck Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit d76886972823ce456c0c61cd2284e85668e2131e Merge: 0e45384ceccc f295e4cece5c Author: Linus Torvalds Date: Wed Nov 27 10:17:28 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "Again another fairly quiet cycle with few notable core code changes and the usual variety of driver bug fixes and small improvements. - Various driver updates and bug fixes for siw, bnxt_re, hns, qedr, iw_cxgb4, vmw_pvrdma, mlx5 - Improvements in SRPT from working with iWarp - SRIOV VF support for bnxt_re - Skeleton kernel-doc files for drivers/infiniband - User visible counters for events related to ODP - Common code for tracking of mmap lifetimes so that drivers can link HW object liftime to a VMA - ODP bug fixes and rework - RDMA READ support for efa - Removal of the very old cxgb3 driver" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (168 commits) RDMA/hns: Delete unnecessary callback functions for cq RDMA/hns: Rename the functions used inside creating cq RDMA/hns: Redefine the member of hns_roce_cq struct RDMA/hns: Redefine interfaces used in creating cq RDMA/efa: Expose RDMA read related attributes RDMA/efa: Support remote read access in MR registration RDMA/efa: Store network attributes in device attributes IB/hfi1: remove redundant assignment to variable ret RDMA/bnxt_re: Fix missing le16_to_cpu RDMA/bnxt_re: Fix stat push into dma buffer on gen p5 devices RDMA/bnxt_re: Fix chip number validation Broadcom's Gen P5 series RDMA/bnxt_re: Fix Kconfig indentation IB/mlx5: Implement callbacks for getting VFs GUID attributes IB/ipoib: Add ndo operation for getting VFs GUID attributes IB/core: Add interfaces to get VF node and port GUIDs net/core: Add support for getting VF GUIDs RDMA/qedr: Fix null-pointer dereference when calling rdma_user_mmap_get_offset RDMA/cm: Use refcount_t type for refcount variable IB/mlx5: Support extended number of strides for Striding RQ IB/mlx4: Update HW GID table while adding vlan GID ... commit 0e45384cecccaa950783e67e7a29ed470133f19d Merge: dc5fa4656864 def7bd940f8c Author: Linus Torvalds Date: Wed Nov 27 10:03:52 2019 -0800 Merge tag 'mmc-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "These are the updates for MMC and MEMSTICK for v5.5. Note that this also contains quite some additional changes reaching beyond both the MMC and MEMSTICK subsystems. This is primarily because of fixing an old regression for a WiFi driver based on the SDIO interface on an OMAP openpandora board MMC core: - Add CMD13 polling for MMC IOCTLS with R1B response. - Add common DT properties for clk-phase-delays for various speed modes. - Fix size overflow for mmc gp-partitions. - Re-work HW reset for SDIO cards, which also includes a re-work for Marvell's WiFi mwifiex SDIO func driver. MMC host: - jz4740: Add support for X1000 and JZ4760. - jz4740: Add support for 8-bit bus and for low power mode. - mmci: Add support for HW busy timeout for the stm32_sdmmc variant. - owl-mmc: Add driver for Actions Semi Owl SoCs SD/MMC controller. - renesas_sdhi: Add support for r8a774b1. - sdhci_am654: Add support for Command Queuing Engine for J721E. - sdhci-milbeaut: Add driver for the Milbeaut SD controller. - sdhci-of-arasan: Add support for ZynqMP tap-delays. - sdhci-of-arasan: Add support for clk-phase-delays for SD cards. - sdhci-of-arasan: Add support for Intel LGM SDXC. - sdhci-of-aspeed: Allow inversion of the internal card detect signal. - sdhci-of-esdhc: Fixup workaround for erratum A-008171 for tunings. - sdhci-of-at91: Improve support for calibration. - sdhci-pci: Add support for Intel JSL. - sdhci-pci: Add quirk for AMD SDHC Device 0x7906. - tmio: Enable support for erase/discard/trim requests. MMC/OMAP/pandora/wl1251: The TI wl1251 WiFi driver for SDIO on the OMAP openpandora board has been broken since v4.7. To fix the problems, changes have been made cross subsystems, but also to OMAP2 machine code and to openpandora DTS files, as summarized below. Relevant changes have been tagged for stable. - mmc/wl1251: Re-introduce lost SDIO quirks and vendor-id for wl1251 - omap/omap_hsmmc: Remove redundant platform config for openpandora - omap_hsmmc: Initialize non-std SDIO card for wl1251 for pandora - omap/dts/pandora: Specify wl1251 through a child node of mmc3 - wl1251: Add devicetree support for TI wl1251 SDIO" * tag 'mmc-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (73 commits) dt-bindings: mmc: Correct the type of the clk phase properties Revert "mmc: tmio: remove workaround for NON_REMOVABLE" memstick: Fix Kconfig indentation mmc: sdhci-of-arasan: Add support for ZynqMP Platform Tap Delays Setup dt-bindings: mmc: arasan: Document 'xlnx,zynqmp-8.9a' controller firmware: xilinx: Add SDIO Tap Delay nodes mmc: sdhci-of-arasan: Add support to set clock phase delays for SD dt-bindings: mmc: Add optional generic properties for mmc mmc: sdhci-of-arasan: Add sampling clock for a phy to use dt-bindings: mmc: arasan: Update Documentation for the input clock mmc: sdhci-of-arasan: Separate out clk related data to another structure mmc: sdhci: Fix grammar in warning message mmc: sdhci-of-aspeed: add inversion signal presence mmc: sdhci-of-aspeed: enable CONFIG_MMC_SDHCI_IO_ACCESSORS mmc: sdhci_am654: Add Support for Command Queuing Engine to J721E mmc: core: Fix size overflow for mmc partitions mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests net: wireless: ti: remove local VENDOR_ID and DEVICE_ID definitions net: wireless: ti: wl1251 use new SDIO_VENDOR_ID_TI_WL1251 definition mmc: core: fix wl1251 sdio quirks ... commit dc5fa4656864d3391cdf13512ffa0733ef72fcdc Merge: 3d9e3501a064 ae75b53e08b9 Author: Linus Torvalds Date: Wed Nov 27 10:00:33 2019 -0800 Merge tag 'pinctrl-v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "This is the bulk of pin control changes for v5.5. It is pretty much business as usual, the most interesting thing I think is the pin controller for a new Intel chip called Lightning Mountain, which is according to news reports some kind of embedded network processor and what is surprising about it is that Intel have decided to use device tree to describe the system rather than ACPI that they have traditionally favored. Core changes: - Avoid taking direct references to device tree-supplied device names: these may changed at runtime under certain circumstances to kstrdup them. GPIO related: - Work is ongoing to move to passing the irqchip along as a templated struct gpio_irq_chip when adding a standard gpiolib-based irqchip to a GPIO controller, a few patches in this cycle switches a few pin control drivers over to using this method. New hardware support: - Intel Lightning Mountain SoC pin controller and GPIO support, a first Intel platform to use device tree rather than ACPI to configure the system. News reports says that this SoC is a network processor. - Qualcomm MSM8976 and MSM8956 - Qualcomm PMIC GPIO now also supports PM6150 and PM6150L - Qualcomm SPMI MPP and SPMI GPIO for PM8950 and PMI8950 - Rockchip RK3308 - Renesas R8A77961 - Allwinner Meson-A1 Driver improvements: - get_multiple and set_multiple support for the AT91-PIO4 driver. - Convert Qualcomm SSBI GPIO to use the hierarchical IRQ helpers in the GPIOlib irqchip" * tag 'pinctrl-v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (93 commits) pinctrl: ingenic: Add OTG VBUS pin for the JZ4770 pinctrl: ingenic: Handle PIN_CONFIG_OUTPUT config pinctrl: Fix Kconfig indentation pinctrl: lewisburg: Update pin list according to v1.1v6 MAINTAINERS: Replace my email by one @kernel.org pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type() dt-bindings: pinctrl: intel: Add for new SoC pinctrl: Add pinmux & GPIO controller driver for a new SoC pinctrl: rza1: remove unnecessary static inline function pinctrl: meson: add pinctrl driver support for Meson-A1 SoC pinctrl: meson: add a new callback for SoCs fixup pinctrl: nomadik: db8500: Add mc0_a_2 pin group without direction control dt-bindings: pinctrl: Convert generic pin mux and config properties to schema pinctrl: cherryview: Missed type change to unsigned int pinctrl: intel: Missed type change to unsigned int pinctrl: use devm_platform_ioremap_resource() to simplify code pinctrl: just return if no valid maps dt-bindings: pinctrl: qcom-pmic-mpp: Add support for PM/PMI8950 pinctrl: qcom: spmi-mpp: Add PM/PMI8950 compatible strings dt-bindings: pinctrl: qcom-pmic-gpio: Add support for PM/PMI8950 ... commit 3d9e3501a064eff90274f1ce927fe71ca1ff4205 Merge: 00074a7007c2 4a1288f1c1cf Author: Linus Torvalds Date: Wed Nov 27 09:58:49 2019 -0800 Merge tag 'hwmon-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: - Add support for Texas Instruments TMP512/513 - Add support for LTC2947 - Add support for BEL PFE1100 and PFE3000 - Various minor improvements and fixes * tag 'hwmon-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: dell-smm-hwmon: Add documentation hwmon: (dell-smm) Add support for disabling automatic BIOS fan control hwmon: Add driver for Texas Instruments TMP512/513 sensor chips. dt-bindings: hwmon: Add TMP512/513 docs: hwmon: Document bel-pfe pmbus driver hwmon: (pmbus) add driver for BEL PFE1100 and PFE3000 dt-bindings: hwmon: Add ltc2947 documentation hwmon: Add support for ltc2947 hwmon: (ina3221) Add summation feature support hwmon: (tmp421) Allow reading at 2Hz instead of 0.5Hz hwmon: (w83793d) remove redundant assignment to variable res hwmon: (pmbus/ibm-cffps) Add version detection capability dt-bindings: hwmon: Document ibm,cffps compatible string hwmon: abituguru: make array probe_order static, makes object smaller hwmon: (applesmc) switch to using input device polling mode hwmon: (aspeed-pwm-tacho) Use devm_platform_ioremap_resource() in aspeed_pwm_tacho_probe() hwmon: (pmbus/ibm-cffps) Fix LED blink behavior hwmon: (pmbus/ibm-cffps) Switch LEDs to blocking brightness call commit 00074a7007c24f947a9f9baf66bf5db2fe651ee9 Merge: 89d57dddd7d3 9480029fe5c2 Author: Linus Torvalds Date: Wed Nov 27 09:55:39 2019 -0800 Merge tag 'for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: - test_power: add support for current and charge_counter - cpcap-charger: improve charge calculation and limit default charge voltage - ab8500: convert to IIO - misc small fixes all over drivers * tag 'for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (29 commits) power: supply: bd70528: Add MODULE_ALIAS to allow module auto loading power: supply: ab8500_charger: Fix inconsistent IS_ERR and PTR_ERR power: supply: cpcap-charger: cpcap_charger_voltage_to_regval() can be static power: supply: cpcap-battery: Add basic coulomb counter calibrate support power: supply: cpcap-battery: Read and save integrator register CCI power: supply: cpcap-battery: Simplify short term power average calculation power: supply: cpcap-battery: Simplify coulomb counter calculation with div_s64 power: supply: cpcap-battery: Move coulomb counter units per lsb to ddata power: supply: cpcap-charger: Allow changing constant charge voltage power: supply: cpcap-battery: Fix handling of lowered charger voltage power: supply: cpcap-charger: Improve battery detection power: supply: cpcap-battery: Check voltage before orderly_poweroff power: supply: cpcap-charger: Limit voltage to 4.2V for battery power: supply: ab8500: Handle invalid IRQ from platform_get_irq_byname() power: supply: ab8500_fg: Do not free non-requested IRQs in probe's error path power: supply: ab8500: Cleanup probe in reverse order power: reset: at91: fix __le32 cast in reset code power: supply: abx500_chargalg: Fix code indentation mfd: Switch the AB8500 GPADC to IIO iio: adc: New driver for the AB8500 GPADC ... commit 68464b88cc0a735eaacd2c69beffb85d36f25292 Author: Dan Carpenter via samba-technical Date: Tue Nov 26 15:11:15 2019 +0300 CIFS: fix a white space issue in cifs_get_inode_info() We accidentally messed up the indenting on this if statement. Fixes: 16c696a6c300 ("CIFS: refactor cifs_get_inode_info()") Signed-off-by: Dan Carpenter Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 8feb4732ff9f2732354b44c4418569974e2f949c Author: Darrick J. Wong Date: Mon Nov 25 18:43:10 2019 -0800 xfs: allow parent directory scans to be interrupted with fatal signals Allow a fatal signal to interrupt us when we're scanning a directory to verify a parent pointer. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit ec16ffe36d80b18a1f98d126a865d5557ab27c30 Merge: dabedfede324 cd94eade0b2a 564f86d38475 8f39f22f73b3 1e4fb2c0cb34 Author: Stephen Boyd Date: Wed Nov 27 08:15:13 2019 -0800 Merge branches 'clk-ingenic', 'clk-init-leak', 'clk-ux500' and 'clk-bitmain' into clk-next - Support CGU in Ingenix X1000 - Support Bitmain BM1880 clks * clk-ingenic: clk: ingenic: Allow drivers to be built with COMPILE_TEST clk: Ingenic: Add CGU driver for X1000. dt-bindings: clock: Add X1000 bindings. * clk-init-leak: clk: mark clk_disable_unused() as __init clk: Fix memory leak in clk_unregister() * clk-ux500: MAINTAINERS: Update section for Ux500 clock drivers * clk-bitmain: MAINTAINERS: Add entry for BM1880 SoC clock driver clk: Add common clock driver for BM1880 SoC dt-bindings: clock: Add devicetree binding for BM1880 SoC clk: Add clk_hw_unregister_composite helper function definition clk: Zero init clk_init_data in helpers commit dabedfede32435ccb7cba4a8e527248d6aed6a39 Merge: 6df24d0c2f9d fc59462c5ce6 a31414e8c98d 9320c7ddf968 9629dbdabd19 46acbcb4849b Author: Stephen Boyd Date: Wed Nov 27 08:15:00 2019 -0800 Merge branches 'clk-gpio-flags', 'clk-tegra', 'clk-rockchip', 'clk-sprd' and 'clk-pxa' into clk-next - Make gpio gate clks propagate rate setting up to parent * clk-gpio-flags: clk: clk-gpio: propagate rate change to parent * clk-tegra: (23 commits) clk: tegra: Use match_string() helper to simplify the code clk: tegra: Fix build error without CONFIG_PM_SLEEP clk: tegra: Add missing stubs for the case of !CONFIG_PM_SLEEP clk: tegra: Optimize PLLX restore on Tegra20/30 clk: tegra: Add suspend and resume support on Tegra210 clk: tegra: Share clk and rst register defines with Tegra clock driver clk: tegra: Use fence_udelay() during PLLU init clk: tegra: clk-dfll: Add suspend and resume support clk: tegra: clk-super: Add restore-context support clk: tegra: clk-super: Fix to enable PLLP branches to CPU clk: tegra: periph: Add restore_context support clk: tegra: Support for OSC context save and restore clk: tegra: pll: Save and restore pll context clk: tegra: pllout: Save and restore pllout context clk: tegra: divider: Save and restore divider rate clk: tegra: Reimplement SOR clocks on Tegra210 clk: tegra: Reimplement SOR clock on Tegra124 clk: tegra: Rename sor0_lvds to sor0_out clk: tegra: Move SOR0 implementation to Tegra124 clk: tegra: Remove last remains of TEGRA210_CLK_SOR1_SRC ... * clk-rockchip: clk: rockchip: protect the pclk_usb_grf as critical on px30 clk: rockchip: add video-related niu clocks as critical on px30 clk: rockchip: move px30 critical clocks to correct clock controller clk: rockchip: Add div50 clocks for px30 sdmmc, emmc, sdio and nandc clk: rockchip: Add div50 clock-ids for sdmmc on px30 and nandc clk: rockchip: make clk_half_divider_ops static * clk-sprd: clk: sprd: Use IS_ERR() to validate the return value of syscon_regmap_lookup_by_phandle() * clk-pxa: clk: pxa: fix one of the pxa RTC clocks commit 6df24d0c2f9d7991a0e50ac96512de59f420c9fa Merge: 74ca928886cc 7f6ac72946b8 bb302711d141 f5790382edef e620a1e061c4 801b787a693b Author: Stephen Boyd Date: Wed Nov 27 08:14:38 2019 -0800 Merge branches 'clk-ti', 'clk-allwinner', 'clk-qcom', 'clk-sa' and 'clk-aspeed' into clk-next - Qualcomm MSM8998 GPU clk controllers - Qualcomm SC7180 GCC and RPMH clk controllers - Qualcomm QCS404 Q6SSTOP clk controllers - Use struct_size() some more in various clk drivers * clk-ti: clk/ti/adpll: allocate room for terminating null ARM: dts: omap3: fix DPLL4 M4 divider max value clk: ti: divider: convert to use min,max,mask instead of width clk: ti: divider: cleanup ti_clk_parse_divider_data API clk: ti: divider: cleanup _register_divider and ti_clk_get_div_table clk: ti: am43xx: drop idlest polling from gfx clock clk: ti: am33xx: drop idlest polling from gfx clock clk: ti: am33xx: drop idlest polling from pruss clkctrl clock clk: ti: am43xx: drop idlest polling from pruss clkctrl clock clk: ti: omap5: Drop idlest polling from IPU & DSP clkctrl clocks clk: ti: omap4: Drop idlest polling from IPU & DSP clkctrl clocks clk: ti: dra7xx: Drop idlest polling from IPU & DSP clkctrl clocks clk: ti: omap5: add IVA subsystem clkctrl data dt-bindings: clk: add omap5 iva clkctrl definitions clk: ti: clkctrl: add new exported API for checking standby info clk: ti: clkctrl: convert to use bit helper macros instead of bitops clk: ti: clkctrl: fix setting up clkctrl clocks * clk-allwinner: clk: sunxi-ng: h3: Export MBUS clock clk: sunxi-ng: h6: Allow GPU to change parent rate clk: sunxi-ng: h6: Use sigma-delta modulation for audio PLL * clk-qcom: clk: qcom: rpmh: Reuse sdm845 clks for sm8150 clk: qcom: Add MSM8998 GPU Clock Controller (GPUCC) driver clk: qcom: Allow constant ratio freq tables for rcg clk: qcom: smd: Add missing pnoc clock clk: qcom: Enumerate clocks and reset needed to boot the 8998 modem clk: qcom: clk-rpmh: Add support for RPMHCC for SC7180 dt-bindings: clock: Introduce RPMHCC bindings for SC7180 dt-bindings: clock: Add YAML schemas for the QCOM RPMHCC clock bindings clk: qcom: Add Global Clock controller (GCC) driver for SC7180 dt-bindings: clock: Add sc7180 GCC clock binding dt-bindings: clock: Add YAML schemas for the QCOM GCC clock bindings clk: qcom: common: Return NULL from clk_hw OF provider clk: qcom: rcg: update the DFS macro for RCG clk: qcom: remove unneeded semicolon clk: qcom: Add Q6SSTOP clock controller for QCS404 dt-bindings: clock: qcom: Add QCOM Q6SSTOP clock controller bindings * clk-sa: drivers/clk: convert VL struct to struct_size * clk-aspeed: clk: aspeed: Add RMII RCLK gates for both AST2500 MACs clk: ast2600: Add RMII RCLK gates for all four MACs dt-bindings: clock: Add AST2600 RMII RCLK gate definitions dt-bindings: clock: Add AST2500 RMII RCLK definitions commit 74ca928886ccf2685f46b9bcf00b7c1466fb041f Merge: 130323106885 f1edb498bd9f fac3810fb0b2 606324409b26 b7c1b40abc66 bfd582aa8569 Author: Stephen Boyd Date: Wed Nov 27 08:14:17 2019 -0800 Merge branches 'clk-hisi', 'clk-amlogic', 'clk-samsung', 'clk-renesas' and 'clk-imx' into clk-next * clk-hisi: clk: hi6220: use CLK_OF_DECLARE_DRIVER * clk-amlogic: clk: meson: axg-audio: use devm_platform_ioremap_resource() to simplify code clk: meson: axg_audio: add sm1 support clk: meson: axg-audio: provide clk top signal name clk: meson: axg-audio: prepare sm1 addition clk: meson: axg-audio: fix regmap last register clk: meson: axg-audio: remove useless defines dt-bindings: clock: meson: add sm1 resets to the axg-audio controller dt-bindings: clk: axg-audio: add sm1 bindings clk: meson: g12a: set CLK_MUX_ROUND_CLOSEST on the cpu clock muxes clk: meson: g12a: fix cpu clock rate setting clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate * clk-samsung: clk: samsung: exynos5420: Add SET_RATE_PARENT flag to clocks on G3D path clk: samsung: exynos5420: Preserve CPU clocks configuration during suspend/resume clk: samsung: exynos5420: Add VPLL rate table clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU clk: samsung: exynos5433: Fix error paths * clk-renesas: (23 commits) clk: renesas: r8a7796: Add R8A77961 CPG/MSSR support clk: renesas: Rename CLK_R8A7796 to CLK_R8A77960 dt-bindings: clock: renesas: cpg-mssr: Document r8a77961 support clk: renesas: r8a77965: Remove superfluous semicolon dt-bindings: clock: renesas: rcar-usb2-clock-sel: Fix typo in example dt-bindings: clock: renesas: Remove R-Car Gen2 legacy DT bindings dt-bindings: clock: Add r8a77961 CPG Core Clock Definitions dt-bindings: power: Add r8a77961 SYSC power domain definitions clk: renesas: rcar-gen3: Switch SD clocks to .determine_rate() clk: renesas: rcar-gen3: Switch Z clocks to .determine_rate() clk: renesas: rcar-gen2: Switch Z clock to .determine_rate() clk: renesas: r8a774b1: Add TMU clock clk: renesas: cpg-mssr: Add r8a774b1 support dt-bindings: clock: renesas: cpg-mssr: Document r8a774b1 binding clk: renesas: rcar-gen3: Loop to find best rate in cpg_sd_clock_round_rate() clk: renesas: rcar-gen3: Absorb cpg_sd_clock_calc_div() clk: renesas: rcar-gen3: Avoid double table iteration in SD .set_rate() clk: renesas: rcar-gen3: Improve arithmetic divisions clk: renesas: rcar-gen2: Improve arithmetic divisions clk: renesas: Remove R-Car Gen2 legacy DT clock support ... * clk-imx: clk: imx: imx8mq: fix sys3_pll_out_sels clk: imx7ulp: do not export out IMX7ULP_CLK_MIPI_PLL clock clk: imx: imx6ul: use imx_obtain_fixed_clk_hw to simplify code clk: imx: imx6sx: use imx_obtain_fixed_clk_hw to simplify code clk: imx: imx6sll: use imx_obtain_fixed_clk_hw to simplify code clk: imx: imx7d: use imx_obtain_fixed_clk_hw to simplify code clk: imx7ulp: Correct DDR clock mux options clk: imx7ulp: Correct system clock source option #7 clk: imx: imx8mq: mark sys1/2_pll as fixed clock clk: imx: imx8mn: mark sys_pll1/2 as fixed clock clk: imx: imx8mm: mark sys_pll1/2 as fixed clock clk: imx8mn: Define gates for pll1/2 fixed dividers clk: imx8mm: Define gates for pll1/2 fixed dividers clk: imx8mq: Define gates for pll1/2 fixed dividers clk: imx: clk-pll14xx: Make two variables static clk: imx8mq: Add VIDEO2_PLL clock clk: imx8mn: Use common 1443X/1416X PLL clock structure clk: imx8mm: Move 1443X/1416X PLL clock structure to common place clk: imx: pll14xx: Fix quick switch of S/K parameter commit ae254888f3c39f66d09920b459112ba3eadf1dc4 Author: Kai Vehmanen Date: Wed Nov 27 18:12:40 2019 +0200 ALSA: hda: hdmi - fix regression in connect list handling Fix regression in how intel_haswell_fixup_connect_list() results are used in hda_read_pin_conn(). Use of snd_hda_get_raw_connections() in hda_read_pin_conn() bypasses the cache and thus also bypasses the overridden pin connection list. On platforms that require the connection list fixup, mux list will be empty and HDMI playback will fail to -EBUSY at open. Fix the regression in hda_read_pinn_conn(). Simplify code as suggested by Takashi Iwai to remove old intel_haswell_fixup_connect_list() and copy the cvt_nid list directly and not use snd_hda_override_conn_list() at all. Fixes: 9c32fea83692 ("ALSA: hda - Add DP-MST support for non-acomp codecs") BugLink: https://github.com/thesofproject/linux/issues/1537 Cc: Nikhil Mahale Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20191127161240.17026-1-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit 130323106885e5598197e99f93af2bf8fa4fdb48 Merge: 8ad1193eae4c 999915711188 06aeb3fb9f31 3bdf364ada33 793ee798cc47 Author: Stephen Boyd Date: Wed Nov 27 08:13:24 2019 -0800 Merge branches 'clk-rohm', 'clk-hisilicon', 'clk-marvell', 'clk-unused' and 'clk-devm-ioremap-resource' into clk-next - Prepare Armada 3700 for suspend to RAM by moving suspend/resume priority for PCIe - Drop unused variables, enums, etc. in various clk drivers - Convert various drivers to use devm_platform_ioremap_resource() * clk-rohm: clk: bd718x7: Add MODULE_ALIAS() * clk-hisilicon: clk: hisilicon: fix sparse warnings in clk-hi3660.c clk: hisilicon: fix sparse warnings in clk-hi3670.c * clk-marvell: dt-bindings: clk: armada3700: document the PCIe clock dt-bindings: clk: armada3700: fix typo in SoC name clk: mvebu: armada-37xx-periph: change suspend/resume time clk: mvebu: armada-37xx-periph: add PCIe gated clock * clk-unused: clk: armada-xp: remove unused code clk: imx: imx8mn: drop unused pll enum clk: ast2600: remove unused variable 'eclk_parent_names' * clk-devm-ioremap-resource: clk: sprd: Change to use devm_platform_ioremap_resource() clk: s3c2410: use devm_platform_ioremap_resource() to simplify code clk: axs10x: use devm_platform_ioremap_resource() to simplify code clk: mediatek: mt6797: use devm_platform_ioremap_resource() to simplify code clk: mediatek: mt7629: use devm_platform_ioremap_resource() to simplify code clk: mediatek: mt7622: use devm_platform_ioremap_resource() to simplify code clk: mediatek: mt8183: use devm_platform_ioremap_resource() to simplify code clk: mediatek: mt6779: use devm_platform_ioremap_resource() to simplify code clk: mediatek: mt2712: use devm_platform_ioremap_resource() to simplify code clk: davinci: use devm_platform_ioremap_resource() to simplify code clk: hisilicon: use devm_platform_ioremap_resource() to simplify code clk: bcm2835: use devm_platform_ioremap_resource() to simplify code commit 27ed14d0ecb38516b6f3c6fdcd62c25c9454f979 Author: Je Yen Tam Date: Wed Nov 27 15:53:01 2019 +0800 Revert "serial/8250: Add support for NI-Serial PXI/PXIe+485 devices" This reverts commit fdc2de87124f5183a98ea7eced1f76dbdba22951 ("serial/8250: Add support for NI-Serial PXI/PXIe+485 devices"). The commit fdc2de87124f ("serial/8250: Add support for NI-Serial PXI/PXIe+485 devices") introduced a breakage on NI-Serial PXI(e)-RS485 devices, RS-232 variants have no issue. The Linux system can enumerate the NI-Serial PXI(e)-RS485 devices, but it broke the R/W operation on the ports. However, the implementation is working on the NI internal Linux RT kernel but it does not work in the Linux main tree kernel. This is only affecting NI products, specifically the RS-485 variants. Reverting the upstream until a proper implementation that can apply to both NI internal Linux kernel and Linux mainline kernel is figured out. Signed-off-by: Je Yen Tam Fixes: fdc2de87124f ("serial/8250: Add support for NI-Serial PXI/PXIe+485 devices") Cc: stable Link: https://lore.kernel.org/r/20191127075301.9866-1-je.yen.tam@ni.com Signed-off-by: Greg Kroah-Hartman commit 45dfbf56975994822cce00b7475732a49f8aefed Author: Tzung-Bi Shih Date: Fri Nov 22 15:31:14 2019 +0800 ASoC: max98090: fix possible race conditions max98090_interrupt() and max98090_pll_work() run in 2 different threads. There are 2 possible races: Note: M98090_REG_DEVICE_STATUS = 0x01. Note: ULK == 0, PLL is locked; ULK == 1, PLL is unlocked. max98090_interrupt max98090_pll_work ---------------------------------------------- schedule max98090_pll_work restart max98090 codec receive ULK INT assert ULK == 0 schedule max98090_pll_work (1). In the case (1), the PLL is locked but max98090_interrupt unnecessarily schedules another max98090_pll_work. max98090_interrupt max98090_pll_work max98090 codec ---------------------------------------------------------------------- ULK = 1 receive ULK INT read 0x01 ULK = 0 (clear on read) schedule max98090_pll_work restart max98090 codec ULK = 1 receive ULK INT read 0x01 ULK = 0 (clear on read) read 0x01 assert ULK == 0 (2). In the case (2), both max98090_interrupt and max98090_pll_work read the same clear-on-read register. max98090_pll_work would falsely thought PLL is locked. Note: the case (2) race is introduced by the previous commit ("ASoC: max98090: exit workaround earlier if PLL is locked") to check the status and exit the loop earlier in max98090_pll_work. There are 2 possible solution options: A. turn off ULK interrupt before scheduling max98090_pll_work; and turn on again before exiting max98090_pll_work. B. remove the second thread of execution. Option A cannot fix the case (2) race because it still has 2 threads access the same clear-on-read register simultaneously. Although we could suppose the register is volatile and read the status via I2C could be much slower than the hardware raises the bits. Option B introduces a maximum 10~12 msec penalty delay in the interrupt handler. However, it could only punish the jack detection by extra 10~12 msec. Adopts option B which is the better solution overall. Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20191122073114.219945-4-tzungbi@google.com Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 6f49919d11690a9b5614445ba30fde18083fdd63 Author: Tzung-Bi Shih Date: Fri Nov 22 15:31:13 2019 +0800 ASoC: max98090: exit workaround earlier if PLL is locked According to the datasheet, PLL lock time typically takes 2 msec and at most takes 7 msec. Check the lock status every 1 msec and exit the workaround if PLL is locked. Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20191122073114.219945-3-tzungbi@google.com Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit acb874a7c049ec49d8fc66c893170fb42c01bdf7 Author: Tzung-Bi Shih Date: Fri Nov 22 15:31:12 2019 +0800 ASoC: max98090: remove msleep in PLL unlocked workaround It was observed Baytrail-based chromebooks could cause continuous PLL unlocked when using playback stream and capture stream simultaneously. Specifically, starting a capture stream after started a playback stream. As a result, the audio data could corrupt or turn completely silent. As the datasheet suggested, the maximum PLL lock time should be 7 msec. The workaround resets the codec softly by toggling SHDN off and on if PLL failed to lock for 10 msec. Notably, there is no suggested hold time for SHDN off. On Baytrail-based chromebooks, it would easily happen continuous PLL unlocked if there is a 10 msec delay between SHDN off and on. Removes the msleep(). Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20191122073114.219945-2-tzungbi@google.com Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 61acd19f9c56fa0809285346bd0bd4a926ab0da0 Author: Charles Keepax Date: Tue Nov 26 16:41:40 2019 +0000 spi: cadence: Correct handling of native chipselect To fix a regression on the Cadence SPI driver, this patch reverts commit 6046f5407ff0 ("spi: cadence: Fix default polarity of native chipselect"). This patch was not the correct fix for the issue. The SPI framework calls the set_cs line with the logic level it desires on the chip select line, as such the old is_high handling was correct. However, this was broken by the fact that before commit 3e5ec1db8bfe ("spi: Fix SPI_CS_HIGH setting when using native and GPIO CS") all controllers that offered the use of a GPIO chip select had SPI_CS_HIGH applied, even for hardware chip selects. This caused the value passed into the driver to be inverted. Which unfortunately makes it look like a logical enable the chip select value. Since the core was corrected to not unconditionally apply SPI_CS_HIGH, the Cadence driver, whilst using the hardware chip select, will deselect the chip select every time we attempt to communicate with the device, which results in failed communications. Fixes: 3e5ec1db8bfe ("spi: Fix SPI_CS_HIGH setting when using native and GPIO CS") Signed-off-by: Charles Keepax Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20191126164140.6240-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 4affd79a125ac91e6a53be843ea3960a8fc00cbb Author: Wen Yang Date: Sun Nov 24 22:58:35 2019 +0800 regulator: fix use after free issue This is caused by dereferencing 'rdev' after put_device() in the _regulator_get()/_regulator_put() functions. This patch just moves the put_device() down a bit to avoid the issue. Signed-off-by: Wen Yang Cc: Liam Girdwood Cc: Mark Brown Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/20191124145835.25999-1-wenyang@linux.alibaba.com Signed-off-by: Mark Brown commit 2a0bda276c64212e517cc1d65cf65719a9ab1ef6 Author: Michael Walle Date: Sat Nov 23 00:25:32 2019 +0100 ASoC: wm8904: fix automatic sysclk configuration The simple-card tries to signal the codec to disable rate constraints, see commit 2458adb8f92a ("SoC: simple-card-utils: set 0Hz to sysclk when shutdown"). This wasn't handled by the codec, instead it would set the FLL frequency to 0Hz which isn't working. Since we don't have any rate constraints just ignore this request. Fixes: 13409d27cb39 ("ASoC: wm8904: configure sysclk/FLL automatically") Signed-off-by: Michael Walle Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20191122232532.22258-1-michael@walle.cc Signed-off-by: Mark Brown commit fb3194413d1ef79732931a40f54da21a16505a76 Author: YueHaibing Date: Wed Nov 27 16:21:45 2019 +0800 ASoC: rt5677: Fix build error without CONFIG_SPI If CONFIG_SPI is n, SND_SOC_RT5677_SPI also is n, building fails: sound/soc/codecs/rt5677.o: In function `rt5677_irq': rt5677.c:(.text+0x2dbf): undefined reference to `rt5677_spi_hotword_detected' sound/soc/codecs/rt5677.o: In function `rt5677_dsp_work': rt5677.c:(.text+0x3709): undefined reference to `rt5677_spi_write' This adds stub helpers to fix this. Reported-by: Hulk Robot Fixes: 461c623270e4 ("ASoC: rt5677: Load firmware via SPI using delayed work") Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20191127082145.6100-1-yuehaibing@huawei.com Signed-off-by: Mark Brown commit 469b3ad672e27b28c5865c804426f65e69c5e41a Author: Daniel Baluta Date: Tue Nov 26 08:16:06 2019 -0600 ASoC: SOF: topology: Fix unload for SAI/ESAI Link unload now fails for ESAI/SAI DAIs with: "error: invalid DAI type 6" because DAI type is not properly handled. Fix this by correctly handling cases where type is ESAI or SAI. Fixes: a4eff5f86c9c5e7 ("ASoC: SOF: imx: Read ESAI parameters and send them to DSP") Signed-off-by: Daniel Baluta Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191126141606.21650-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit b81eb73be03ac736f1f8d27d64a372c62c7159e5 Author: Keyon Jie Date: Tue Nov 26 08:15:33 2019 -0600 ASoC: SOF: Intel: BYT: fix a copy/paste mistake in byt_dump() The shim registers in BYT/CHT/BSW are 64bits based, correct the copy/paste (from bdw.c where the shim registers are 32bits based) error in byt_dump(). Fixes: 3a9e204d4e36 ("ASoC: SOF: Intel: Add context data to any IPC timeout") Signed-off-by: Keyon Jie Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191126141533.21601-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 756ae8f237e19a014a1c20ad5a51b0686463d1f7 Author: Yu-Hsuan Hsu Date: Tue Nov 26 15:54:24 2019 +0800 ASoC: AMD: Enable clk in startup intead of hw_params Some usages only call startup and shutdown without setting hw_params (e.g. arecord --dump-hw-params). If we don't enable clk in startup, it will cause ref count error because the clk will be disabled in shutdown. For this reason, we should move enabling clk from hw_params to startup. In addition, the hw_params is fixed in this driver(48000 rate, 2 channels, S16_LE format) so we don't need to change the clk rate after the hw_params is set. Signed-off-by: Yu-Hsuan Hsu Acked-by: Akshu Agrawal Link: https://lore.kernel.org/r/20191126075424.80668-1-yuhsuan@chromium.org Signed-off-by: Mark Brown commit 5061bb7065d05efbac35a660eb30ed4c3100690b Author: Andrew Gabbasov Date: Wed Nov 27 05:06:22 2019 -0600 ALSA: aloop: Avoid pointer dereference before null-check Static analysis tools (cppcheck and PVS Studio) report an error in loopback_snd_timer_period_elapsed() regarding dpcm_play pointer dereference earlier than its null-check. And although this is a result of a formal check, and the pointer correctness is also protected by having a corresponding bit set in the "running" mask, re-ordering of the lines can imake the code even formally correct and eliminate those static analysis error reports. Fixes: 26c53379f98d ("ALSA: aloop: Support selection of snd_timer instead of jiffies") Reported-by: Eugeniu Rosca Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191127110622.26105-1-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit c1de0f25221c3abc7031fa482c109ccb079e7938 Author: Peter Gonda Date: Thu Nov 21 12:33:43 2019 -0800 KVM x86: Move kvm cpuid support out of svm Memory encryption support does not have module parameter dependencies and can be moved into the general x86 cpuid __do_cpuid_ent function. This changes maintains current behavior of passing through all of CPUID.8000001F. Suggested-by: Jim Mattson Signed-off-by: Peter Gonda Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 3e1b43586eae232157ca70e905cece0297f17bfd Author: Borislav Petkov Date: Sun Nov 24 17:12:25 2019 +0100 x86/entry/32: Remove unused 'restore_all_notrace' local label Signed-off-by: Borislav Petkov Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit 405b45376de90b3027aaf8c4de035c6bb721fa7e Author: Anthony Steinhauser Date: Sun Nov 24 21:48:38 2019 -0800 perf/x86: Implement immediate enforcement of /sys/devices/cpu/rdpmc value of 0 When you successfully write 0 to /sys/devices/cpu/rdpmc, the RDPMC instruction should be disabled unconditionally and immediately (after you close the SYSFS file) by the documentation. Instead, in the current implementation the PMU must be reloaded which happens only eventually some time in the future. Only after that the RDPMC instruction becomes disabled (on ring 3) on the respective core. This change makes the treatment of the 0 value as blocking and as unconditional as the current treatment of the 2 value, only the CR4.PCE bit is naturally set to false instead of true. Signed-off-by: Anthony Steinhauser Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: acme@kernel.org Link: https://lkml.kernel.org/r/20191125054838.137615-1-asteinhauser@google.com Signed-off-by: Ingo Molnar commit 74c166b58895a7b536d6434235b23b51e64adf68 Author: Enric Balletbo i Serra Date: Wed Nov 27 09:49:39 2019 +0100 platform/chrome: cros_ec: Add Kconfig default for cros-ec-sensorhub Like the other CrOS EC sub-drivers set that depends on his parent and set default to the parent's value. Signed-off-by: Enric Balletbo i Serra commit 8d66fcb7488486bf144eab852e87e03a45e0fd3a Author: Krzysztof Kozlowski Date: Wed Nov 20 21:43:32 2019 +0800 fuse: fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miklos Szeredi commit f1ebdeffc6f325e30e0ddb9f7a70f1370fa4b851 Author: Miklos Szeredi Date: Mon Nov 25 20:48:46 2019 +0100 fuse: fix leak of fuse_io_priv exit_aio() is sometimes stuck in wait_for_completion() after aio is issued with direct IO and the task receives a signal. The reason is failure to call ->ki_complete() due to a leaked reference to fuse_io_priv. This happens in fuse_async_req_send() if fuse_simple_background() returns an error (e.g. -EINTR). In this case the error value is propagated via io->err, so return success to not confuse callers. This issue is tracked as a virtio-fs issue: https://gitlab.com/virtio-fs/qemu/issues/14 Reported-by: Masayoshi Mizuma Fixes: 45ac96ed7c36 ("fuse: convert direct_io to simple api") Cc: # v5.4 Signed-off-by: Miklos Szeredi commit f830f7cf4752f6f0db48777b7e16c010bdc95083 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:39:40 2019 +0800 rtc: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133940.13881-1-krzk@kernel.org Signed-off-by: Alexandre Belloni commit fa60b7e838a9a38abdecfd79f123e357db4cff7d Author: Nobuhiro Iwamatsu Date: Sat Nov 23 18:02:34 2019 +0900 rtc: xgene: Remove unused struct device in struct xgene_rtc_dev struct device in struct xgene_rtc_dev is not used, remove it. Signed-off-by: Nobuhiro Iwamatsu Link: https://lore.kernel.org/r/20191123090234.32180-1-nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by: Alexandre Belloni commit 8532bd5d3fdcf2158c3965bed90b32185a437258 Author: Nobuhiro Iwamatsu Date: Sat Nov 23 18:05:38 2019 +0900 rtc: sun6i: Remove struct device from sun6i_rtc_dev struct device in struct sun6i_rtc_dev is not used, remove it. Signed-off-by: Nobuhiro Iwamatsu Link: https://lore.kernel.org/r/20191123090538.32364-1-nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by: Alexandre Belloni commit 4f8aadea23426a163aca42a9ce208bb8544b02c1 Author: Nobuhiro Iwamatsu Date: Sat Nov 23 18:12:41 2019 +0900 rtc: st-lpc: Remove struct resource from struct st_rtc struct resource in struct st_rtc is not used, remove it. Signed-off-by: Nobuhiro Iwamatsu Link: https://lore.kernel.org/r/20191123091241.1905-1-nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by: Alexandre Belloni commit 93966243cf90c055d89b5ebfbb8dee0f9ac6b0a2 Author: Nobuhiro Iwamatsu Date: Sat Nov 23 18:08:38 2019 +0900 rtc: pcf8523: Remove struct pcf8523 struct pcf8523 is referenced only by pcf8523_probe(). And member variable in this is not referenced by any function. Remove struct pcf8523. Signed-off-by: Nobuhiro Iwamatsu Link: https://lore.kernel.org/r/20191123090838.1619-1-nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by: Alexandre Belloni commit 60bd22fc90630e19b616a3f329ae3958f0878ac6 Author: Colin Ian King Date: Fri Nov 22 22:52:10 2019 +0000 rtc: meson: remove redundant assignment to variable retries The variable retries is being initialized with a value that is never read and it is being updated later with a new value in a for-loop. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20191122225210.109172-1-colin.king@canonical.com Signed-off-by: Alexandre Belloni commit 42397492fb0fe61a77b06f351a382309f8300aa6 Author: Alexandre Belloni Date: Fri Nov 22 11:22:12 2019 +0100 rtc: v3020: remove set but unused variable Fix the following warning: drivers/rtc/rtc-v3020.c: In function ‘rtc_probe’: drivers/rtc/rtc-v3020.c:287:6: warning: variable ‘temp’ set but not used [-Wunused-but-set-variable] Link: https://lore.kernel.org/r/20191122102212.400158-9-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 8321c2ecb2e879aada3e363bbdcbfa0f819803c7 Author: Alexandre Belloni Date: Fri Nov 22 11:22:11 2019 +0100 rtc: tegra: remove set but unused variable Fix the following warning: drivers/rtc/rtc-tegra.c: In function ‘tegra_rtc_read_time’: drivers/rtc/rtc-tegra.c:106:11: warning: variable ‘msec’ set but not used [-Wunused-but-set-variable] Cc: Thierry Reding Cc: Jonathan Hunter Acked-by: Thierry Reding Link: https://lore.kernel.org/r/20191122102212.400158-8-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 863d7b1851a12cf8ceb272d71c8e1bcfdaa26952 Author: Alexandre Belloni Date: Fri Nov 22 11:22:10 2019 +0100 rtc: pm8xxx: update kerneldoc for struct pm8xxx_rtc The change from u8 ctrl_reg to const struct pm8xxx_rtc_regs *regs; did not properly update the kerneldoc comment. Fixes: drivers/rtc/rtc-pm8xxx.c:64: warning: Function parameter or member 'regs' not described in 'pm8xxx_rtc' Fixes: c8d523a4b053 ("drivers/rtc/rtc-pm8xxx.c: rework to support pm8941 rtc") Link: https://lore.kernel.org/r/20191122102212.400158-7-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit e5b7d90fd09dd5db2ca91dd716e721e51c9a861f Author: Alexandre Belloni Date: Fri Nov 22 11:22:09 2019 +0100 rtc: m41t80: remove excess kerneldoc Fix the following warning: drivers/rtc/rtc-m41t80.c:716: warning: Excess function parameter 'inode' description in 'wdt_ioctl' Link: https://lore.kernel.org/r/20191122102212.400158-6-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 4ed3f1b8c4b7d5e75b22300351e103d9ddc0bb3d Author: Alexandre Belloni Date: Fri Nov 22 11:22:08 2019 +0100 rtc: ds1685: fix build error with make W=1 Fix the following parsing errors when building with W=1: drivers/rtc/rtc-ds1685.c:1053: error: Cannot parse struct or union! drivers/rtc/rtc-ds1685.c:1062: error: Cannot parse struct or union! drivers/rtc/rtc-ds1685.c:1363: warning: cannot understand function prototype: 'struct platform_driver ds1685_rtc_driver = ' Cc: Joshua Kinard Link: https://lore.kernel.org/r/20191122102212.400158-5-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 47401580449c1de65350bd17324f778c7e937ea1 Author: Alexandre Belloni Date: Fri Nov 22 11:22:07 2019 +0100 rtc: ds1685: remove set but unused variables Fix the following warnings: drivers/rtc/rtc-ds1685.c: In function ‘ds1685_rtc_read_time’: drivers/rtc/rtc-ds1685.c:264:5: warning: variable ‘ctrlb’ set but not used [-Wunused-but-set-variable] 264 | u8 ctrlb, century; | ^~~~~ drivers/rtc/rtc-ds1685.c: In function ‘ds1685_rtc_proc’: drivers/rtc/rtc-ds1685.c:758:19: warning: variable ‘ctrlc’ set but not used [-Wunused-but-set-variable] 758 | u8 ctrla, ctrlb, ctrlc, ctrld, ctrl4a, ctrl4b, ssn[8]; | ^~~~~ Cc: Joshua Kinard Acked-By: Joshua Kinard Link: https://lore.kernel.org/r/20191122102212.400158-4-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 75859ab1e7907d0515e515b956cd062b0fa6718c Author: Alexandre Belloni Date: Fri Nov 22 11:22:06 2019 +0100 rtc: ds1374: remove unused variable Fix warning: drivers/rtc/rtc-ds1374.c: In function ‘ds1374_wdt_disable’: drivers/rtc/rtc-ds1374.c:442:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] Link: https://lore.kernel.org/r/20191122102212.400158-3-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 6f6931928f257e6bf073515d8c90cf10be0ee7b6 Author: Alexandre Belloni Date: Fri Nov 22 11:22:05 2019 +0100 rtc: sysfs: fix hctosys_show kerneldoc Fix undocumented function parameters: drivers/rtc/sysfs.c:112: warning: Function parameter or member 'dev' not described in 'hctosys_show' drivers/rtc/sysfs.c:112: warning: Function parameter or member 'attr' not described in 'hctosys_show' drivers/rtc/sysfs.c:112: warning: Function parameter or member 'buf' not described in 'hctosys_show' Link: https://lore.kernel.org/r/20191122102212.400158-2-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 55dcf7a21dbcc743a0b39e01916f5d006736b1e1 Author: Alexandre Belloni Date: Wed Nov 27 09:29:32 2019 +0100 rtc: interface: fix kerneldoc comments Fix kerneldoc warnings: drivers/rtc/interface.c:619: warning: Function parameter or member 'num' not described in 'rtc_handle_legacy_irq' drivers/rtc/interface.c:619: warning: Function parameter or member 'mode' not described in 'rtc_handle_legacy_irq' drivers/rtc/interface.c:804: warning: Function parameter or member 'rtc' not described in 'rtc_timer_enqueue' drivers/rtc/interface.c:804: warning: Function parameter or member 'timer' not described in 'rtc_timer_enqueue' drivers/rtc/interface.c:864: warning: Function parameter or member 'rtc' not described in 'rtc_timer_remove' drivers/rtc/interface.c:864: warning: Function parameter or member 'timer' not described in 'rtc_timer_remove' drivers/rtc/interface.c:900: warning: Function parameter or member 'work' not described in 'rtc_timer_do_work' drivers/rtc/interface.c:1035: warning: Function parameter or member 'rtc' not described in 'rtc_read_offset' drivers/rtc/interface.c:1035: warning: Function parameter or member 'offset' not described in 'rtc_read_offset' drivers/rtc/interface.c:1070: warning: Function parameter or member 'rtc' not described in 'rtc_set_offset' drivers/rtc/interface.c:1070: warning: Function parameter or member 'offset' not described in 'rtc_set_offset' Link: https://lore.kernel.org/r/20191127082932.666869-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 3cc44feb9861d2f5267af9b962ae92c5ea1b48fd Author: Chris Wilson Date: Tue Nov 26 06:55:21 2019 +0000 drm/i915: Reduce nested prepare_remote_context() to a trylock On context retiring, we may invoke the kernel_context to unpin this context. Elsewhere, we may use the kernel_context to modify this context. This currently leads to an AB-BA lock inversion, so we need to back-off from the contended lock, and repeat. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111732 Signed-off-by: Chris Wilson Fixes: a9877da2d629 ("drm/i915/oa: Reconfigure contexts on the fly") Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191126065521.2331017-1-chris@chris-wilson.co.uk (cherry picked from commit 58b4c1a07ada7fb91ea757bdb9bd47df02207357) Signed-off-by: Joonas Lahtinen commit 8d15ede5cc6b66d5176856060b94196bc3382283 Author: Chris Wilson Date: Mon Nov 25 16:27:37 2019 +0000 drm/i915: Default to a more lenient forced preemption timeout Based on a sampling of a number of benchmarks across platforms, by default opt for a much more lenient timeout so that we should not adversely affect existing "good" clients. 640ms ought to be enough for anyone. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112169 Fixes: 3a7a92aba8fb ("drm/i915/execlists: Force preemption") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Eero Tamminen Cc: Dmitry Rogozhkin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191125162737.2161069-1-chris@chris-wilson.co.uk (cherry picked from commit 5766a5ffc6a69595903865518c43636bde0e4ac4) Signed-off-by: Joonas Lahtinen commit 6f07048c00fd100ed8cab66c225c157e0b6c0a50 Author: Michael Ellerman Date: Wed Nov 27 18:41:26 2019 +1100 powerpc: Define arch_is_kernel_initmem_freed() for lockdep Under certain circumstances, we hit a warning in lockdep_register_key: if (WARN_ON_ONCE(static_obj(key))) return; This occurs when the key falls into initmem that has since been freed and can now be reused. This has been observed on boot, and under memory pressure. Define arch_is_kernel_initmem_freed(), which allows lockdep to correctly identify this memory as dynamic. This fixes a bug picked up by the powerpc64 syzkaller instance where we hit the WARN via alloc_netdev_mqs. Reported-by: Qian Cai Reported-by: ppc syzbot c/o Andrew Donnellan Signed-off-by: Michael Ellerman Signed-off-by: Daniel Axtens Link: https://lore.kernel.org/r/87lfs4f7d6.fsf@dja-thinkpad.axtens.net commit 1591fadf857cdbaf2baa55e421af99a61354713c Author: Thomas Zimmermann Date: Tue Nov 26 11:15:29 2019 +0100 drm/mgag200: Add workaround for HW that does not support 'startadd' There's at least one system that does not interpret the value of the device's 'startadd' field correctly, which leads to incorrectly displayed scanout buffers. Always placing the active scanout buffer at offset 0 works around the problem. Signed-off-by: Thomas Zimmermann Reported-by: John Donnelly Tested-by: John Donnelly Reviewed-by: Daniel Vetter Fixes: 81da87f63a1e ("drm: Replace drm_gem_vram_push_to_system() with kunmap + unpin") Cc: Gerd Hoffmann Cc: Dave Airlie Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Sam Ravnborg Cc: "Y.C. Chen" Cc: Neil Armstrong Cc: Thomas Gleixner Cc: "José Roberto de Souza" Cc: Andrzej Pietrasiewicz Cc: dri-devel@lists.freedesktop.org Cc: # v5.3+ Link: https://gitlab.freedesktop.org/drm/misc/issues/7 Link: https://patchwork.freedesktop.org/patch/msgid/20191126101529.20356-4-tzimmermann@suse.de commit d6d437d97d54c85a1a93967b2745e31dff03365a Author: Thomas Zimmermann Date: Tue Nov 26 11:15:28 2019 +0100 drm/mgag200: Store flags from PCI driver data in device structure The flags field in struct mga_device has been unused so far. We now use it to store flag bits from the PCI driver. Signed-off-by: Thomas Zimmermann Reviewed-by: Daniel Vetter Fixes: 81da87f63a1e ("drm: Replace drm_gem_vram_push_to_system() with kunmap + unpin") Cc: John Donnelly Cc: Gerd Hoffmann Cc: Dave Airlie Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Sam Ravnborg Cc: "Y.C. Chen" Cc: Neil Armstrong Cc: Thomas Gleixner Cc: "José Roberto de Souza" Cc: Andrzej Pietrasiewicz Cc: dri-devel@lists.freedesktop.org Cc: # v5.3+ Link: https://patchwork.freedesktop.org/patch/msgid/20191126101529.20356-3-tzimmermann@suse.de commit 3a8a5aba142a44eaeba0cb0ec1b4a8f177b5e59a Author: Thomas Zimmermann Date: Tue Nov 26 11:15:27 2019 +0100 drm/mgag200: Extract device type from flags Adds a conversion function that extracts the device type from the PCI id-table flags. Allows for storing additional information in the other flag bits. Signed-off-by: Thomas Zimmermann Fixes: 81da87f63a1e ("drm: Replace drm_gem_vram_push_to_system() with kunmap + unpin") Reviewed-by: Daniel Vetter Cc: John Donnelly Cc: Gerd Hoffmann Cc: Dave Airlie Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Sam Ravnborg Cc: Emil Velikov Cc: "Y.C. Chen" Cc: Laurent Pinchart Cc: "José Roberto de Souza" Cc: Andrzej Pietrasiewicz Cc: dri-devel@lists.freedesktop.org Cc: # v5.3+ Link: https://patchwork.freedesktop.org/patch/msgid/20191126101529.20356-2-tzimmermann@suse.de commit 0c9acb1af77a3cb8707e43f45b72c95266903cee Author: Nicolas Pitre Date: Tue Nov 5 10:33:16 2019 +0100 vcs: prevent write access to vcsu devices Commit d21b0be246bf ("vt: introduce unicode mode for /dev/vcs") guarded against using devices containing attributes as this is not yet implemented. It however failed to guard against writes to any devices as this is also unimplemented. Reported-by: Or Cohen Signed-off-by: Nicolas Pitre Cc: # v4.19+ Cc: Jiri Slaby Fixes: d21b0be246bf ("vt: introduce unicode mode for /dev/vcs") Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.1911051030580.30289@knanqh.ubzr Signed-off-by: Greg Kroah-Hartman commit 68421940b0d66f3806bfd0cd0f78a6935c75cb55 Author: Gao, Fred Date: Wed Nov 27 00:08:29 2019 +0800 drm/i915/gvt: Update force-to-nonpriv register whitelist Host print below warning message when creating guest: "gvt: vgpu(1) Invalid FORCE_NONPRIV write 10002349". Add register 0x2348 in force-to-nonpriv whitelist as required by guest. Signed-off-by: Gao, Fred Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang commit 8a6b8f4d7a891ac66db4f97900a86b55c84a5802 Author: Dan Carpenter Date: Tue Nov 26 15:21:20 2019 +0300 crypto: hisilicon - fix a NULL vs IS_ERR() bug in sec_create_qp_ctx() The hisi_acc_create_sgl_pool() function returns error pointers, it never returns NULL pointers. Fixes: 416d82204df4 ("crypto: hisilicon - add HiSilicon SEC V2 driver") Signed-off-by: Dan Carpenter Signed-off-by: Herbert Xu commit dbc2e87bd8b6d3cc79730b3a49c5163b4c386b49 Author: Herbert Xu Date: Tue Nov 26 19:28:36 2019 +0800 crypto: talitos - Fix build error by selecting LIB_DES The talitos driver needs to select LIB_DES as it needs calls des_expand_key. Fixes: 9d574ae8ebc1 ("crypto: talitos/des - switch to new...") Cc: Signed-off-by: Herbert Xu Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 8394bfec51e0e565556101bcc4e2fe7551104cd8 Author: Jason A. Donenfeld Date: Mon Nov 25 11:31:12 2019 +0100 crypto: arch - conditionalize crypto api in arch glue for lib code For glue code that's used by Zinc, the actual Crypto API functions might not necessarily exist, and don't need to exist either. Before this patch, there are valid build configurations that lead to a unbuildable kernel. This fixes it to conditionalize those symbols on the existence of the proper config entry. Signed-off-by: Jason A. Donenfeld Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit aeab9eda04cd412791551eaad036143eec04e648 Author: Gao, Fred Date: Wed Nov 27 00:07:35 2019 +0800 drm/i915/gvt: Refine non privilege register address calucation The BitField of non privilege register address is only from bit 2 to 25. v2: use REG_GENMASK instead. (Zhenyu) Signed-off-by: Gao, Fred Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang commit 41c9479903c5bd91bb0cb7240a1227d00c42b41f Author: Tian Tao Date: Tue Oct 29 08:51:04 2019 +0800 mailbox: no need to set .owner platform_driver_register the platform_driver_register will set the .owner to THIS_MODULE Signed-off-by: Tian Tao Signed-off-by: Jassi Brar commit 0434d3f4525af32bc29f858f71300351041f552d Author: Brandon Maier Date: Sun Nov 17 14:36:49 2019 -0600 mailbox/omap: Handle if CONFIG_PM is disabled If CONFIG_PM is disabled, pm_runtime_put_sync() returns -ENOSYS. Signed-off-by: Brandon Maier Signed-off-by: Jassi Brar commit 89d57dddd7d319ded00415790a0bb3c954b7e386 Merge: 3f1b210a7f97 0ca40f41d795 Author: Linus Torvalds Date: Tue Nov 26 20:11:43 2019 -0800 Merge tag 'media/v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - uAPI documentation for stateless decoders - Added a new CEC ioctl together with its documentation - Improved IPU3 documentation - New i2c drivers: hi556 and imx290 - Added support on Vivid driver for meta streams - Added de-interlace support for sunxi subdriver - Added a few new remote controler keymaps - Added H.265 support for Sunxi Cedrus driver - Another round of random driver cleanups, fixes and improvements * tag 'media/v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (361 commits) media: Revert "media: mtk-vcodec: Remove extra area allocation in an input buffer on encoding" media: hantro: Set H264 FIELDPIC_FLAG_E flag correctly media: hantro: Remove now unused H264 pic_size media: hantro: Use output buffer width and height for H264 decoding media: hantro: Reduce H264 extra space for motion vectors media: hantro: Fix H264 motion vector buffer offset media: ti-vpe: vpe: fix compatible to match bindings media: dt-bindings: media: ti-vpe: Document VPE driver media: zr364xx: remove redundant assigmnent to idx, clean up code media: Documentation: media: *_DEFAULT targets for subdevs media: hantro: Fix s_fmt for dynamic resolution changes media: i2c: Use the correct style for SPDX License Identifier media: siano: Use the correct style for SPDX License Identifier media: vicodec: media_device_cleanup was called too early media: vim2m: media_device_cleanup was called too early media: cedrus: Increase maximum supported size media: cedrus: Fix H264 4k support media: cedrus: Properly signal size in mode register media: v4l2-ctrl: Lock main_hdl on operations of requests_queued. media: si470x-i2c: add missed operations in remove ... commit 3f1b210a7f97f7e75c56174ada476fba2d36f340 Merge: 361b0d286afe bf2aa5cadd1c Author: Linus Torvalds Date: Tue Nov 26 20:04:35 2019 -0800 Merge tag 'sound-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "There have been some significant changes in the core side, both for ALSA and ASoC, while lots of development have been seen in SOF, as well as many small fixes/improvements for ASoC codecs and platforms. Below is a highlight in this cycle: Core: - The unification of PCM vmalloc buffer allocation helpers into the standard API - Clean up of the default PCM mmap handling for vmalloc & SG-buffer - Fix potential races at ALSA timer open - A few new PCM API extensions; just preliminary core changes, the actual changes in drivers will be merged in 5.6 - Continued ASoC componentization works; now almost everything is a common ASoC component object. A lot of refactoring and simplification have been done along with it. ASoC: - Many fixes to the Sound Open Firmware (SOF) code - Wake on voice support for Chromebooks - SPI support and trigger word detection for RT5677 - New drivers for Analog Devices ADAU7118, Intel Cannonlake systems with RT1011 and RT5682, Texas Instruments TAS2562 and TAS2770 HD-audio: - Improved Intel DSP configuration / probe code for SOF - Plumbing the legacy HD-audio driver with Intel SOF HDMI - DP-MST support for Nvidia HDMI codecs - Realtek quirks cleanups and new additions as usual Others: - Lots of refactoring and cleanups for FireWire; period-size sharing, h/w IRQ interval configuration, clock recovery improvements, etc - USB-audio: Scarlett mixer quirks - Cleanups of PCM calls in various drivers (including media and USB) to adapt the core API changes" * tag 'sound-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (497 commits) ALSA: usb-audio: Fix Focusrite Scarlett 6i6 gen1 - input handling ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC ALSA: aloop: Fix dependency on timer API ASoC: DMI long name - avoid to add board name if matches with product name ASoC: improve the DMI long card code in asoc-core ASoC: rsnd: fix DALIGN register for SSIU ALSA: aloop: Avoid unexpected timer event callback tasklets ALSA: aloop: Remove redundant locking in timer open function ASoC: component: Add sync_stop PCM ops ASoC: pcm: Make ioctl ops optional ALSA: hda/hdmi - Clear codec->relaxed_resume flag at unbinding ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs ALSA: cs4236: fix error return comparison of an unsigned integer ALSA: usb-audio: Fix NULL dereference at parsing BADD ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop ALSA: hda/realtek - Move some alc236 pintbls to fallback table ALSA: hda/realtek - Move some alc256 pintbls to fallback table ALSA: docs: Update about the new PCM sync_stop ops ALSA: pcm: Add card sync_irq field ... commit 361b0d286afea0d867537536977a695b5557d133 Merge: 6e9f879684b4 1afc14032e54 Author: Linus Torvalds Date: Tue Nov 26 19:45:12 2019 -0800 Merge tag 'devprop-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties framework updates from Rafael Wysocki: "Add support for printing fwnode names using a new conversion specifier "%pfw" (Sakari Ailus), clean up the software node and efi/apple-properties code in preparation for improved software node reference properties handling (Dmitry Torokhov) and fix the struct fwnode_operations description (Heikki Krogerus)" * tag 'devprop-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (22 commits) software node: simplify property_entry_read_string_array() software node: unify PROPERTY_ENTRY_XXX macros software node: remove property_entry_read_uNN_array functions software node: get rid of property_set_pointer() software node: clean up property_copy_string_array() software node: mark internal macros with double underscores efi/apple-properties: use PROPERTY_ENTRY_U8_ARRAY_LEN software node: introduce PROPERTY_ENTRY_XXX_ARRAY_LEN() software node: remove DEV_PROP_MAX device property: Fix the description of struct fwnode_operations lib/test_printf: Add tests for %pfw printk modifier lib/vsprintf: Add %pfw conversion specifier for printing fwnode names lib/vsprintf: OF nodes are first and foremost, struct device_nodes lib/vsprintf: Make use of fwnode API to obtain node names and separators lib/vsprintf: Add a note on re-using %pf or %pF lib/vsprintf: Remove support for %pF and %pf in favour of %pS and %ps device property: Add a function to obtain a node's prefix device property: Add fwnode_get_name for returning the name of a node device property: Add functions for accessing node's parents device property: Move fwnode_get_parent() up ... commit 6e9f879684b46331f51d0c76ebee981c788417db Merge: 9e7a03233e02 782b59711e15 Author: Linus Torvalds Date: Tue Nov 26 19:25:25 2019 -0800 Merge tag 'acpi-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These update the ACPICA code in the kernel to upstream revision 20191018, add support for EFI specific purpose memory, update the ACPI EC driver to make it work on systems with hardware-reduced ACPI, improve ACPI-based device enumeration for some platforms, rework the lid blacklist handling in the button driver and add more lid quirks to it, unify ACPI _HID/_UID matching, fix assorted issues and clean up the code and documentation. Specifics: - Update the ACPICA code in the kernel to upstream revision 20191018 including: * Fixes for Clang warnings (Bob Moore) * Fix for possible overflow in get_tick_count() (Bob Moore) * Introduction of acpi_unload_table() (Bob Moore) * Debugger and utilities updates (Erik Schmauss) * Fix for unloading tables loaded via configfs (Nikolaus Voss) - Add support for EFI specific purpose memory to optionally allow either application-exclusive or core-kernel-mm managed access to differentiated memory (Dan Williams) - Fix and clean up processing of the HMAT table (Brice Goglin, Qian Cai, Tao Xu) - Update the ACPI EC driver to make it work on systems with hardware-reduced ACPI (Daniel Drake) - Always build in support for the Generic Event Device (GED) to allow one kernel binary to work both on systems with full hardware ACPI and hardware-reduced ACPI (Arjan van de Ven) - Fix the table unload mechanism to unregister platform devices created when the given table was loaded (Andy Shevchenko) - Rework the lid blacklist handling in the button driver and add more lid quirks to it (Hans de Goede) - Improve ACPI-based device enumeration for some platforms based on Intel BayTrail SoCs (Hans de Goede) - Add an OpRegion driver for the Cherry Trail Crystal Cove PMIC and prevent handlers from being registered for unhandled PMIC OpRegions (Hans de Goede) - Unify ACPI _HID/_UID matching (Andy Shevchenko) - Clean up documentation and comments (Cao jin, James Pack, Kacper Piwiński)" * tag 'acpi-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (52 commits) ACPI: OSI: Shoot duplicate word ACPI: HMAT: use %u instead of %d to print u32 values ACPI: NUMA: HMAT: fix a section mismatch ACPI: HMAT: don't mix pxm and nid when setting memory target processor_pxm ACPI: NUMA: HMAT: Register "soft reserved" memory as an "hmem" device ACPI: NUMA: HMAT: Register HMAT at device_initcall level device-dax: Add a driver for "hmem" devices dax: Fix alloc_dax_region() compile warning lib: Uplevel the pmem "region" ida to a global allocator x86/efi: Add efi_fake_mem support for EFI_MEMORY_SP arm/efi: EFI soft reservation to memblock x86/efi: EFI soft reservation to E820 enumeration efi: Common enable/disable infrastructure for EFI soft reservation x86/efi: Push EFI_MEMMAP check into leaf routines efi: Enumerate EFI_MEMORY_SP ACPI: NUMA: Establish a new drivers/acpi/numa/ directory ACPICA: Update version to 20191018 ACPICA: debugger: remove leading whitespaces when converting a string to a buffer ACPICA: acpiexec: initialize all simple types and field units from user input ACPICA: debugger: add field unit support for acpi_db_get_next_token ... commit 9e7a03233e02afd3ee061e373355f34d7254f1e6 Merge: c2da5bdc66a3 e350b60f4e0f Author: Linus Torvalds Date: Tue Nov 26 19:06:44 2019 -0800 Merge tag 'pm-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These include cpuidle changes to use nanoseconds (instead of microseconds) as the unit of time and to simplify checks for disabled idle states in the idle loop, some cpuidle fixes and governor updates, assorted cpufreq updates (driver updates mostly and a few core fixes and cleanups), devfreq updates (dominated by the tegra30 driver changes), new CPU IDs for the RAPL power capping driver, relatively minor updates of the generic power domains (genpd) and operation performance points (OPP) frameworks, and assorted fixes and cleanups. There are also two maintainer information updates: Chanwoo Choi will be maintaining the devfreq subsystem going forward and Todd Brandt is going to maintain the pm-graph utility (created by him). Specifics: - Use nanoseconds (instead of microseconds) as the unit of time in the cpuidle core and simplify checks for disabled idle states in the idle loop (Rafael Wysocki) - Fix and clean up the teo cpuidle governor (Rafael Wysocki) - Fix the cpuidle registration error code path (Zhenzhong Duan) - Avoid excessive vmexits in the ACPI cpuidle driver (Yin Fengwei) - Extend the idle injection infrastructure to be able to measure the requested duration in nanoseconds and to allow an exit latency limit for idle states to be specified (Daniel Lezcano) - Fix cpufreq driver registration and clarify a comment in the cpufreq core (Viresh Kumar) - Add NULL checks to the show() and store() methods of sysfs attributes exposed by cpufreq (Kai Shen) - Update cpufreq drivers: * Fix for a plain int as pointer warning from sparse in intel_pstate (Jamal Shareef) * Fix for a hardcoded number of CPUs and stack bloat in the powernv driver (John Hubbard) * Updates to the ti-cpufreq driver and DT files to support new platforms and migrate bindings from opp-v1 to opp-v2 (Adam Ford, H. Nikolaus Schaller) * Merging of the arm_big_little and vexpress-spc drivers and related cleanup (Sudeep Holla) * Fix for imx's default speed grade value (Anson Huang) * Minor cleanup of the s3c64xx driver (Nathan Chancellor) * CPU speed bin detection fix for sun50i (Ondrej Jirman) - Appoint Chanwoo Choi as the new devfreq maintainer. - Update the devfreq core: * Check NULL governor in available_governors_show sysfs to prevent showing wrong governor information and fix a race condition between devfreq_update_status() and trans_stat_show() (Leonard Crestez) * Add new 'interrupt-driven' flag for devfreq governors to allow interrupt-driven governors to prevent the devfreq core from polling devices for status (Dmitry Osipenko) * Improve an error message in devfreq_add_device() (Matthias Kaehlcke) - Update devfreq drivers: * tegra30 driver fixes and cleanups (Dmitry Osipenko) * Removal of unused property from dt-binding documentation for the exynos-bus driver (Kamil Konieczny) * exynos-ppmu cleanup and DT bindings update (Lukasz Luba, Marek Szyprowski) - Add new CPU IDs for CometLake Mobile and Desktop to the Intel RAPL power capping driver (Zhang Rui) - Allow device initialization in the generic power domains (genpd) framework to be more straightforward and clean it up (Ulf Hansson) - Add support for adjusting OPP voltages at run time to the OPP framework (Stephen Boyd) - Avoid freeing memory that has never been allocated in the hibernation core (Andy Whitcroft) - Clean up function headers in a header file and coding style in the wakeup IRQs handling code (Ulf Hansson, Xiaofei Tan) - Clean up the SmartReflex adaptive voltage scaling (AVS) driver for ARM (Ben Dooks, Geert Uytterhoeven) - Wrap power management documentation to fit in 80 columns (Bjorn Helgaas) - Add pm-graph utility entry to MAINTAINERS (Todd Brandt) - Update the cpupower utility: * Fix the handling of set and info subcommands (Abhishek Goel) * Fix build warnings (Nathan Chancellor) * Improve mperf_monitor handling (Janakarajan Natarajan)" * tag 'pm-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (83 commits) PM: Wrap documentation to fit in 80 columns cpuidle: Pass exit latency limit to cpuidle_use_deepest_state() cpuidle: Allow idle injection to apply exit latency limit cpuidle: Introduce cpuidle_driver_state_disabled() for driver quirks cpuidle: teo: Avoid code duplication in conditionals cpufreq: Register drivers only after CPU devices have been registered cpuidle: teo: Avoid using "early hits" incorrectly cpuidle: teo: Exclude cpuidle overhead from computations PM / Domains: Convert to dev_to_genpd_safe() in genpd_syscore_switch() mmc: tmio: Avoid boilerplate code in ->runtime_suspend() PM / Domains: Implement the ->start() callback for genpd PM / Domains: Introduce dev_pm_domain_start() ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition PM / wakeirq: remove unnecessary parentheses power: avs: smartreflex: Remove superfluous cast in debugfs_create_file() call cpuidle: Use nanoseconds as the unit of time PM / OPP: Support adjusting OPP voltages at runtime PM / core: Clean up some function headers in power.h cpufreq: Add NULL checks to show() and store() methods of cpufreq cpufreq: intel_pstate: Fix plain int as pointer warning from sparse ... commit 1eb9151eb7c58c2a4b995918271e13037ae278b9 Author: Gabriel Krisman Bertazi Date: Mon Nov 25 11:51:53 2019 -0500 scsi: MAINTAINERS: Add the linux-scsi mailing list to the ISCSI entry Most people who review iSCSI are following linux-scsi, but some are not in open-scsi. Make sure we are routing iSCSI patches to the right list. Link: https://lore.kernel.org/r/85h82rvqza.fsf@collabora.com Signed-off-by: Gabriel Krisman Bertazi Signed-off-by: Martin K. Petersen commit 73374b39b01e91b90ff683dc259b89f528c4f367 Author: YueHaibing Date: Mon Nov 25 22:44:54 2019 +0800 scsi: megaraid_sas: Make poll_aen_lock static Fix sparse warning: drivers/scsi/megaraid/megaraid_sas_base.c:187:12: warning: symbol 'poll_aen_lock' was not declared. Should it be static? Link: https://lore.kernel.org/r/20191125144454.22680-1-yuehaibing@huawei.com Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Martin K. Petersen commit a35989a0723c53b0364322e39c7a9495336ff7e6 Author: Damien Le Moal Date: Mon Nov 25 16:05:18 2019 +0900 scsi: sd_zbc: Improve report zones error printout In the case of a report zones command failure, instead of simply printing the host_byte and driver_byte values returned, print a message that is more human readable and useful, adding sense codes too. To do so, use the already defined sd_print_sense_hdr() and sd_print_result() functions by moving the declaration of these functions into sd.h. Link: https://lore.kernel.org/r/20191125070518.951717-1-damien.lemoal@wdc.com Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 45dc8f2d9c94ed74a5e31e63e9136a19a7e16081 Author: Huacai Chen Date: Thu Nov 21 13:40:47 2019 +0800 scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI Commit 4fa183455988 ("scsi: qla2xxx: Utilize pci_alloc_irq_vectors/ pci_free_irq_vectors calls.") use pci_alloc_irq_vectors() to replace pci_enable_msi() but it didn't handle the return value correctly. This bug make qla2x00 always fail to setup MSI if MSI-X fail, so fix it. BTW, improve the log message of return value in qla2x00_request_irqs() to avoid confusion. Fixes: 4fa183455988 ("scsi: qla2xxx: Utilize pci_alloc_irq_vectors/pci_free_irq_vectors calls.") Cc: Michael Hernandez Link: https://lore.kernel.org/r/1574314847-14280-1-git-send-email-chenhc@lemote.com Signed-off-by: Huacai Chen Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit c8a347931869bf4373bfd4036d297b8e11ab48ab Author: Martin Wilck Date: Fri Nov 22 22:19:24 2019 +0000 scsi: qla2xxx: unregister ports after GPN_FT failure When ports are lost due to unzoning them, and the initiator port is not part of any more zones, the GPN_FT command used for the fabric scan may fail. In this case, the current code simply gives up after a few retries. But if the zone is gone, all rports should actually be marked as lost. Fix this by jumping to the code that handles logout after GNN_FT after scan retries are exhausted. Fixes: f352eeb75419 ("scsi: qla2xxx: Add ability to use GPNFT/GNNFT for RSCN handling") Link: https://lore.kernel.org/r/20191122221912.20100-3-martin.wilck@suse.com Tested-by: Jason Orendorf Signed-off-by: Martin Wilck Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit d341e9a8f2cffe4000c610225c629f62c7489c74 Author: Martin Wilck Date: Fri Nov 22 22:19:22 2019 +0000 scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan In qla2x00_find_all_fabric_devs(), fcport->flags & FCF_LOGIN_NEEDED is a necessary condition for logging into new rports, but not for dropping lost ones. Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery") Link: https://lore.kernel.org/r/20191122221912.20100-2-martin.wilck@suse.com Tested-by: David Bond Signed-off-by: Martin Wilck Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 69b41f141dc4e465e2f5e98efa3b38f022dfbd4a Author: YueHaibing Date: Fri Nov 22 02:09:11 2019 +0000 scsi: pm80xx: Remove unused include of linux/version.h Remove #include . Don't need it. Link: https://lore.kernel.org/r/20191122020911.33269-1-yuehaibing@huawei.com Signed-off-by: YueHaibing Acked-by: Jack Wang Signed-off-by: Martin K. Petersen commit 0e7c353e1828819eb92af0a64fc9b2f4f778b76e Author: Colin Ian King Date: Wed Nov 20 13:50:31 2019 +0000 scsi: pm80xx: fix logic to break out of loop when register value is 2 or 3 The condition (reg_val != 2) || (reg_val != 3) will always be true because reg_val cannot be equal to two different values at the same time. Fix this by replacing the || operator with && so that the loop will loop if reg_val is not a 2 and not a 3 as was originally intended. Fixes: 50dc2f221455 ("scsi: pm80xx: Modified the logic to collect fatal dump") Link: https://lore.kernel.org/r/20191120135031.270708-1-colin.king@canonical.com Addresses-Coverity: ("Constant expression result") Signed-off-by: Colin Ian King Acked-by: Jack Wang Signed-off-by: Martin K. Petersen commit c2da5bdc66a377f0b82ee959f19f5a6774706b83 Merge: 168829ad09ca 0bcd7762727d Author: Linus Torvalds Date: Tue Nov 26 17:12:12 2019 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 merge fix from Ingo Molnar: "I missed one other semantic conflict that can result in build failures on certain stripped down x86 32-bit configs, for example 32-bit 'allnoconfig' where CONFIG_X86_IOPL_IOPERM gets turned off" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/iopl: Make 'struct tss_struct' constant size again commit d0f010434124598988ba1c97fbb0e4e820ff5d8c Author: Alexei Starovoitov Date: Tue Nov 26 15:01:06 2019 -0800 bpf: Fix static checker warning kernel/bpf/btf.c:4023 btf_distill_func_proto() error: potentially dereferencing uninitialized 't'. kernel/bpf/btf.c 4012 nargs = btf_type_vlen(func); 4013 if (nargs >= MAX_BPF_FUNC_ARGS) { 4014 bpf_log(log, 4015 "The function %s has %d arguments. Too many.\n", 4016 tname, nargs); 4017 return -EINVAL; 4018 } 4019 ret = __get_type_size(btf, func->type, &t); ^^ t isn't initialized for the first -EINVAL return This is unlikely path, since BTF should have been validated at this point. Fix it by returning 'void' BTF. Reported-by: Dan Carpenter Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191126230106.237179-1-ast@kernel.org commit 168829ad09ca9cdfdc664b2110d0e3569932c12d Merge: 1ae78780eda5 500543c53a54 Author: Linus Torvalds Date: Tue Nov 26 16:02:40 2019 -0800 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "The main changes in this cycle were: - A comprehensive rewrite of the robust/PI futex code's exit handling to fix various exit races. (Thomas Gleixner et al) - Rework the generic REFCOUNT_FULL implementation using atomic_fetch_* operations so that the performance impact of the cmpxchg() loops is mitigated for common refcount operations. With these performance improvements the generic implementation of refcount_t should be good enough for everybody - and this got confirmed by performance testing, so remove ARCH_HAS_REFCOUNT and REFCOUNT_FULL entirely, leaving the generic implementation enabled unconditionally. (Will Deacon) - Other misc changes, fixes, cleanups" * 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits) lkdtm: Remove references to CONFIG_REFCOUNT_FULL locking/refcount: Remove unused 'refcount_error_report()' function locking/refcount: Consolidate implementations of refcount_t locking/refcount: Consolidate REFCOUNT_{MAX,SATURATED} definitions locking/refcount: Move saturation warnings out of line locking/refcount: Improve performance of generic REFCOUNT_FULL code locking/refcount: Move the bulk of the REFCOUNT_FULL implementation into the header locking/refcount: Remove unused refcount_*_checked() variants locking/refcount: Ensure integer operands are treated as signed locking/refcount: Define constants for saturation and max refcount values futex: Prevent exit livelock futex: Provide distinct return value when owner is exiting futex: Add mutex around futex exit futex: Provide state handling for exec() as well futex: Sanitize exit state handling futex: Mark the begin of futex exit explicitly futex: Set task::futex_state to DEAD right after handling futex exit futex: Split futex_mm_release() for exit/exec exit/exec: Seperate mm_release() futex: Replace PF_EXITPIDONE with a state ... commit a95069ecb7092d03b2ea1c39ee04514fe9627540 Author: Jeroen de Borst Date: Tue Nov 26 15:36:19 2019 -0800 gve: Fix the queue page list allocated pages count In gve_alloc_queue_page_list(), when a page allocation fails, qpl->num_entries will be wrong. In this case priv->num_registered_pages can underflow in gve_free_queue_page_list(), causing subsequent calls to gve_alloc_queue_page_list() to fail. Fixes: f5cedc84a30d ("gve: Add transmit and receive support") Signed-off-by: Jeroen de Borst Reviewed-by: Catherine Sullivan Signed-off-by: David S. Miller commit 1ae78780eda54023a0fb49ee743dbba39da148e0 Merge: 77a05940eee7 43e0ae7ae0f5 Author: Linus Torvalds Date: Tue Nov 26 15:42:43 2019 -0800 Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RCU updates from Ingo Molnar: "The main changes in this cycle were: - Dynamic tick (nohz) updates, perhaps most notably changes to force the tick on when needed due to lengthy in-kernel execution on CPUs on which RCU is waiting. - Linux-kernel memory consistency model updates. - Replace rcu_swap_protected() with rcu_prepace_pointer(). - Torture-test updates. - Documentation updates. - Miscellaneous fixes" * 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (51 commits) security/safesetid: Replace rcu_swap_protected() with rcu_replace_pointer() net/sched: Replace rcu_swap_protected() with rcu_replace_pointer() net/netfilter: Replace rcu_swap_protected() with rcu_replace_pointer() net/core: Replace rcu_swap_protected() with rcu_replace_pointer() bpf/cgroup: Replace rcu_swap_protected() with rcu_replace_pointer() fs/afs: Replace rcu_swap_protected() with rcu_replace_pointer() drivers/scsi: Replace rcu_swap_protected() with rcu_replace_pointer() drm/i915: Replace rcu_swap_protected() with rcu_replace_pointer() x86/kvm/pmu: Replace rcu_swap_protected() with rcu_replace_pointer() rcu: Upgrade rcu_swap_protected() to rcu_replace_pointer() rcu: Suppress levelspread uninitialized messages rcu: Fix uninitialized variable in nocb_gp_wait() rcu: Update descriptions for rcu_future_grace_period tracepoint rcu: Update descriptions for rcu_nocb_wake tracepoint rcu: Remove obsolete descriptions for rcu_barrier tracepoint rcu: Ensure that ->rcu_urgent_qs is set before resched IPI workqueue: Convert for_each_wq to use built-in list check rcu: Several rcu_segcblist functions can be static rcu: Remove unused function hlist_bl_del_init_rcu() Documentation: Rename rcu_node_context_switch() to rcu_note_context_switch() ... commit 77a05940eee7e9891cd6add7a690a3e762ee21b0 Merge: 3f59dbcace56 de881a341c41 Author: Linus Torvalds Date: Tue Nov 26 15:23:14 2019 -0800 Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "The biggest changes in this cycle were: - Make kcpustat vtime aware (Frederic Weisbecker) - Rework the CFS load_balance() logic (Vincent Guittot) - Misc cleanups, smaller enhancements, fixes. The load-balancing rework is the most intrusive change: it replaces the old heuristics that have become less meaningful after the introduction of the PELT metrics, with a grounds-up load-balancing algorithm. As such it's not really an iterative series, but replaces the old load-balancing logic with the new one. We hope there are no performance regressions left - but statistically it's highly probable that there *is* going to be some workload that is hurting from these chnages. If so then we'd prefer to have a look at that workload and fix its scheduling, instead of reverting the changes" * 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (46 commits) rackmeter: Use vtime aware kcpustat accessor leds: Use all-in-one vtime aware kcpustat accessor cpufreq: Use vtime aware kcpustat accessors for user time procfs: Use all-in-one vtime aware kcpustat accessor sched/vtime: Bring up complete kcpustat accessor sched/cputime: Support other fields on kcpustat_field() sched/cpufreq: Move the cfs_rq_util_change() call to cpufreq_update_util() sched/fair: Add comments for group_type and balancing at SD_NUMA level sched/fair: Fix rework of find_idlest_group() sched/uclamp: Fix overzealous type replacement sched/Kconfig: Fix spelling mistake in user-visible help text sched/core: Further clarify sched_class::set_next_task() sched/fair: Use mul_u32_u32() sched/core: Simplify sched_class::pick_next_task() sched/core: Optimize pick_next_task() sched/core: Make pick_next_task_idle() more consistent sched/fair: Better document newidle_balance() leds: Use vtime aware kcpustat accessor to fetch CPUTIME_SYSTEM cpufreq: Use vtime aware kcpustat accessor to fetch CPUTIME_SYSTEM procfs: Use vtime aware kcpustat accessor to fetch CPUTIME_SYSTEM ... commit 66e2f5f7c7728862e9394769722231b9ce3d8672 Author: Maciej Żenczykowski Date: Tue Nov 26 14:44:16 2019 -0800 net: inet_is_local_reserved_port() port arg should be unsigned short Any argument outside of that range would result in an out of bound memory access, since the accessed array is 65536 bits long. Signed-off-by: Maciej Żenczykowski Signed-off-by: David S. Miller commit 4e81c0b3fa93d07653e2415fa71656b080a112fd Author: Paolo Abeni Date: Tue Nov 26 12:55:50 2019 +0100 openvswitch: fix flow command message size When user-space sets the OVS_UFID_F_OMIT_* flags, and the relevant flow has no UFID, we can exceed the computed size, as ovs_nla_put_identifier() will always dump an OVS_FLOW_ATTR_KEY attribute. Take the above in account when computing the flow command message size. Fixes: 74ed7ab9264c ("openvswitch: Add support for unique flow IDs.") Reported-by: Qi Jun Ding Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 3f59dbcace56fae7e4ed303bab90f1bedadcfdf4 Merge: df28204bb0f2 ceb9e77324fa Author: Linus Torvalds Date: Tue Nov 26 15:04:47 2019 -0800 Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates from Ingo Molnar: "The main kernel side changes in this cycle were: - Various Intel-PT updates and optimizations (Alexander Shishkin) - Prohibit kprobes on Xen/KVM emulate prefixes (Masami Hiramatsu) - Add support for LSM and SELinux checks to control access to the perf syscall (Joel Fernandes) - Misc other changes, optimizations, fixes and cleanups - see the shortlog for details. There were numerous tooling changes as well - 254 non-merge commits. Here are the main changes - too many to list in detail: - Enhancements to core tooling infrastructure, perf.data, libperf, libtraceevent, event parsing, vendor events, Intel PT, callchains, BPF support and instruction decoding. - There were updates to the following tools: perf annotate perf diff perf inject perf kvm perf list perf maps perf parse perf probe perf record perf report perf script perf stat perf test perf trace - And a lot of other changes: please see the shortlog and Git log for more details" * 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (279 commits) perf parse: Fix potential memory leak when handling tracepoint errors perf probe: Fix spelling mistake "addrees" -> "address" libtraceevent: Fix memory leakage in copy_filter_type libtraceevent: Fix header installation perf intel-bts: Does not support AUX area sampling perf intel-pt: Add support for decoding AUX area samples perf intel-pt: Add support for recording AUX area samples perf pmu: When using default config, record which bits of config were changed by the user perf auxtrace: Add support for queuing AUX area samples perf session: Add facility to peek at all events perf auxtrace: Add support for dumping AUX area samples perf inject: Cut AUX area samples perf record: Add aux-sample-size config term perf record: Add support for AUX area sampling perf auxtrace: Add support for AUX area sample recording perf auxtrace: Move perf_evsel__find_pmu() perf record: Add a function to test for kernel support for AUX area sampling perf tools: Add kernel AUX area sampling definitions perf/core: Make the mlock accounting simple again perf report: Jump to symbol source view from total cycles view ... commit df28204bb0f29cc475c0a8893c99b46a11a4903f Merge: 3f6128139092 2278f452a12d Author: Linus Torvalds Date: Tue Nov 26 14:52:11 2019 -0800 Merge branch 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI updates from Ingo Molnar: "The main changes in this cycle were: - Wire up the EFI RNG code for x86. This enables an additional source of entropy during early boot. - Enable the TPM event log code on ARM platforms. - Update Ard's email address" * 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: libstub/tpm: enable tpm eventlog function for ARM platforms x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table efi/random: use arch-independent efi_call_proto() MAINTAINERS: update Ard's email address to @kernel.org commit 3f6128139092286cf10e32bef8ccf56a004812d2 Merge: 2be7d348fe92 4b48512c2e9c Author: Linus Torvalds Date: Tue Nov 26 14:47:19 2019 -0800 Merge branch 'core-stacktrace-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull stacktrace cleanup from Ingo Molnar: "A minor cleanup" * 'core-stacktrace-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: stacktrace: Get rid of unneeded '!!' pattern commit 786c4a5372e11919b5ea010a7338bac9ef08c732 Author: Dan Murphy Date: Tue Nov 26 08:38:56 2019 -0600 net: phy: dp83869: Fix return paths to return proper values Fix the return paths for all I/O operations to ensure that the I/O completed successfully. Then pass the return to the caller for further processing Fixes: 01db923e8377 ("net: phy: dp83869: Add TI dp83869 phy") Reported-by: Andrew Lunn Signed-off-by: Dan Murphy Signed-off-by: David S. Miller commit 7eb9d7675c08937cd11d32b0b40442d4d731c5ee Author: Nikolay Aleksandrov Date: Wed Nov 27 00:16:44 2019 +0200 net: psample: fix skb_over_panic We need to calculate the skb size correctly otherwise we risk triggering skb_over_panic[1]. The issue is that data_len is added to the skb in a nl attribute, but we don't account for its header size (nlattr 4 bytes) and alignment. We account for it when calculating the total size in the > PSAMPLE_MAX_PACKET_SIZE comparison correctly, but not when allocating after that. The fix is simple - use nla_total_size() for data_len when allocating. To reproduce: $ tc qdisc add dev eth1 clsact $ tc filter add dev eth1 egress matchall action sample rate 1 group 1 trunc 129 $ mausezahn eth1 -b bcast -a rand -c 1 -p 129 < skb_over_panic BUG(), tail is 4 bytes past skb->end > [1] Trace: [ 50.459526][ T3480] skbuff: skb_over_panic: text:(____ptrval____) len:196 put:136 head:(____ptrval____) data:(____ptrval____) tail:0xc4 end:0xc0 dev: [ 50.474339][ T3480] ------------[ cut here ]------------ [ 50.481132][ T3480] kernel BUG at net/core/skbuff.c:108! [ 50.486059][ T3480] invalid opcode: 0000 [#1] PREEMPT SMP [ 50.489463][ T3480] CPU: 3 PID: 3480 Comm: mausezahn Not tainted 5.4.0-rc7 #108 [ 50.492844][ T3480] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014 [ 50.496551][ T3480] RIP: 0010:skb_panic+0x79/0x7b [ 50.498261][ T3480] Code: bc 00 00 00 41 57 4c 89 e6 48 c7 c7 90 29 9a 83 4c 8b 8b c0 00 00 00 50 8b 83 b8 00 00 00 50 ff b3 c8 00 00 00 e8 ae ef c0 fe <0f> 0b e8 2f df c8 fe 48 8b 55 08 44 89 f6 4c 89 e7 48 c7 c1 a0 22 [ 50.504111][ T3480] RSP: 0018:ffffc90000447a10 EFLAGS: 00010282 [ 50.505835][ T3480] RAX: 0000000000000087 RBX: ffff888039317d00 RCX: 0000000000000000 [ 50.507900][ T3480] RDX: 0000000000000000 RSI: ffffffff812716e1 RDI: 00000000ffffffff [ 50.509820][ T3480] RBP: ffffc90000447a60 R08: 0000000000000001 R09: 0000000000000000 [ 50.511735][ T3480] R10: ffffffff81d4f940 R11: 0000000000000000 R12: ffffffff834a22b0 [ 50.513494][ T3480] R13: ffffffff82c10433 R14: 0000000000000088 R15: ffffffff838a8084 [ 50.515222][ T3480] FS: 00007f3536462700(0000) GS:ffff88803eac0000(0000) knlGS:0000000000000000 [ 50.517135][ T3480] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.518583][ T3480] CR2: 0000000000442008 CR3: 000000003b222000 CR4: 00000000000006e0 [ 50.520723][ T3480] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 50.522709][ T3480] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 50.524450][ T3480] Call Trace: [ 50.525214][ T3480] skb_put.cold+0x1b/0x1b [ 50.526171][ T3480] psample_sample_packet+0x1d3/0x340 [ 50.527307][ T3480] tcf_sample_act+0x178/0x250 [ 50.528339][ T3480] tcf_action_exec+0xb1/0x190 [ 50.529354][ T3480] mall_classify+0x67/0x90 [ 50.530332][ T3480] tcf_classify+0x72/0x160 [ 50.531286][ T3480] __dev_queue_xmit+0x3db/0xd50 [ 50.532327][ T3480] dev_queue_xmit+0x18/0x20 [ 50.533299][ T3480] packet_sendmsg+0xee7/0x2090 [ 50.534331][ T3480] sock_sendmsg+0x54/0x70 [ 50.535271][ T3480] __sys_sendto+0x148/0x1f0 [ 50.536252][ T3480] ? tomoyo_file_ioctl+0x23/0x30 [ 50.537334][ T3480] ? ksys_ioctl+0x5e/0xb0 [ 50.540068][ T3480] __x64_sys_sendto+0x2a/0x30 [ 50.542810][ T3480] do_syscall_64+0x73/0x1f0 [ 50.545383][ T3480] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 50.548477][ T3480] RIP: 0033:0x7f35357d6fb3 [ 50.551020][ T3480] Code: 48 8b 0d 18 90 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 d3 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 eb f6 ff ff 48 89 04 24 [ 50.558547][ T3480] RSP: 002b:00007ffe0c7212c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 50.561870][ T3480] RAX: ffffffffffffffda RBX: 0000000001dac010 RCX: 00007f35357d6fb3 [ 50.565142][ T3480] RDX: 0000000000000082 RSI: 0000000001dac2a2 RDI: 0000000000000003 [ 50.568469][ T3480] RBP: 00007ffe0c7212f0 R08: 00007ffe0c7212d0 R09: 0000000000000014 [ 50.571731][ T3480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000082 [ 50.574961][ T3480] R13: 0000000001dac2a2 R14: 0000000000000001 R15: 0000000000000003 [ 50.578170][ T3480] Modules linked in: sch_ingress virtio_net [ 50.580976][ T3480] ---[ end trace 61a515626a595af6 ]--- CC: Yotam Gigi CC: Jiri Pirko CC: Jamal Hadi Salim CC: Simon Horman CC: Roopa Prabhu Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 14c59dcde6f8a633ccca5abfec8bc79c8bdf7b12 Merge: 82f31ebf61be 2eb1d3f4bcae Author: David S. Miller Date: Tue Nov 26 14:03:58 2019 -0800 Merge branch 'net-func-cast' Phong Tran says: ==================== Fix -Wcast-function-type usb net drivers Change log with v1: - Modify suffix of patch subject. - Did the checkpatch.pl (remove the space, add a blank line). ==================== Signed-off-by: David S. Miller commit 2eb1d3f4bcae6c83943214ccb26968a48360db06 Author: Phong Tran Date: Tue Nov 26 20:54:13 2019 +0700 net: usbnet: Fix -Wcast-function-type correct usage prototype of callback in tasklet_init(). Report by https://github.com/KSPP/linux/issues/20 Signed-off-by: Phong Tran Signed-off-by: David S. Miller commit 1d4a09dadbb9ea7baaf6be897d69020c729e7440 Author: Phong Tran Date: Tue Nov 26 20:54:12 2019 +0700 net: hso: Fix -Wcast-function-type correct usage prototype of callback in tasklet_init(). Report by https://github.com/KSPP/linux/issues/20 Signed-off-by: Phong Tran Signed-off-by: David S. Miller commit e944475e69849273ca8f1fe04a3ce81b5901d165 Author: Jens Axboe Date: Tue Nov 26 15:02:04 2019 -0700 io_uring: make poll->wait dynamically allocated In the quest to bring io_kiocb down to 3 cachelines, this one does the trick. Make the wait_queue_entry for the poll command come out of kmalloc instead of embedding it in struct io_poll_iocb, as the latter is the largest member of io_kiocb. Once we trim this down a bit, we're back at a healthy 192 bytes for struct io_kiocb. Signed-off-by: Jens Axboe commit 6206f0e180d4eddc0a178f57120ab1b913701f6e Author: Jens Axboe Date: Tue Nov 26 11:59:32 2019 -0700 io-wq: shrink io_wq_work a bit Currently we're using 40 bytes for the io_wq_work structure, and 16 of those is the doubly link list node. We don't need doubly linked lists, we always add to tail to keep things ordered, and any other use case is list traversal with deletion. For the deletion case, we can easily support any node deletion by keeping track of the previous entry. This shrinks io_wq_work to 32 bytes, and subsequently io_kiock from io_uring to 216 to 208 bytes. Signed-off-by: Jens Axboe commit 3fc50ab559f5ae400aa33bd0836b3602da7fa51b Author: Jann Horn Date: Tue Nov 26 19:10:20 2019 +0100 io-wq: fix handling of NUMA node IDs There are several things that can go wrong in the current code on NUMA systems, especially if not all nodes are online all the time: - If the identifiers of the online nodes do not form a single contiguous block starting at zero, wq->wqes will be too small, and OOB memory accesses will occur e.g. in the loop in io_wq_create(). - If a node comes online between the call to num_online_nodes() and the for_each_node() loop in io_wq_create(), an OOB write will occur. - If a node comes online between io_wq_create() and io_wq_enqueue(), a lookup is performed for an element that doesn't exist, and an OOB read will probably occur. Fix it by: - using nr_node_ids instead of num_online_nodes() for the allocation size; nr_node_ids is calculated by setup_nr_node_ids() to be bigger than the highest node ID that could possibly come online at some point, even if those nodes' identifiers are not a contiguous block - creating workers for all possible CPUs, not just all online ones This is basically what the normal workqueue code also does, as far as I can tell. Signed-off-by: Jann Horn Signed-off-by: Jens Axboe commit ad6e005ca68de7af76f9ed3e4c9b6f0aa2f842e3 Author: Jann Horn Date: Tue Nov 26 17:39:45 2019 +0100 io_uring: use kzalloc instead of kcalloc for single-element allocations These allocations are single-element allocations, so don't use the array allocation wrapper for them. Signed-off-by: Jann Horn Signed-off-by: Jens Axboe commit 7d009165550adc64e3561c65ecce564125052e00 Author: Pavel Begunkov Date: Mon Nov 25 23:14:40 2019 +0300 io_uring: cleanup io_import_fixed() Clean io_import_fixed() call site and make it return proper type. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit cf6fd4bd559ee61a4454b161863c8de6f30f8dca Author: Pavel Begunkov Date: Mon Nov 25 23:14:39 2019 +0300 io_uring: inline struct sqe_submit There is no point left in keeping struct sqe_submit. Inline it into struct io_kiocb, so any req->submit.field is now just req->field - moves initialisation of ring_file into io_get_req() - removes duplicated req->sequence. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit cc42e0ac17d3664a70e020dfe7897f14e7aa7453 Author: Pavel Begunkov Date: Mon Nov 25 23:14:38 2019 +0300 io_uring: store timeout's sqe->off in proper place Timeouts' sequence offset (i.e. sqe->off) is stored in req->submit.sequence under a false name. Keep it in timeout.data instead. The unused space for sequence will be reclaimed in the following patches. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d69e07793f891524c6bbf1e75b9ae69db4450953 Author: Jens Axboe Date: Mon Nov 25 17:04:13 2019 -0700 net: disallow ancillary data for __sys_{send,recv}msg_file() Only io_uring uses (and added) these, and we want to disallow the use of sendmsg/recvmsg for anything but regular data transfers. Use the newly added prep helper to split the msghdr copy out from the core function, to check for msg_control and msg_controllen settings. If either is set, we return -EINVAL. Acked-by: David S. Miller Signed-off-by: Jens Axboe commit 4257c8ca13b084550574b8c9a667d9c90ff746eb Author: Jens Axboe Date: Mon Nov 25 14:27:34 2019 -0700 net: separate out the msghdr copy from ___sys_{send,recv}msg() This is in preparation for enabling the io_uring helpers for sendmsg and recvmsg to first copy the header for validation before continuing with the operation. There should be no functional changes in this patch. Acked-by: David S. Miller Signed-off-by: Jens Axboe commit 82f31ebf61bed3077c9935308e0a4b6c44842c5a Author: Maciej Żenczykowski Date: Mon Nov 25 15:37:04 2019 -0800 net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port) Note that the sysctl write accessor functions guarantee that: net->ipv4.sysctl_ip_prot_sock <= net->ipv4.ip_local_ports.range[0] invariant is maintained, and as such the max() in selinux hooks is actually spurious. ie. even though if (snum < max(inet_prot_sock(sock_net(sk)), low) || snum > high) { per logic is the same as if ((snum < inet_prot_sock(sock_net(sk)) && snum < low) || snum > high) { it is actually functionally equivalent to: if (snum < low || snum > high) { which is equivalent to: if (snum < inet_prot_sock(sock_net(sk)) || snum < low || snum > high) { even though the first clause is spurious. But we want to hold on to it in case we ever want to change what what inet_port_requires_bind_service() means (for example by changing it from a, by default, [0..1024) range to some sort of set). Test: builds, git 'grep inet_prot_sock' finds no other references Cc: Eric Dumazet Signed-off-by: Maciej Żenczykowski Signed-off-by: David S. Miller commit e94a5d1681fcf6d857503a53febb4a54cee7e1d3 Merge: fb8223888e72 ff25dcb9a149 Author: David S. Miller Date: Tue Nov 26 13:19:31 2019 -0800 Merge branch 'ibmvnic-Harden-device-commands-and-queries' Thomas Falcon says: ==================== ibmvnic: Harden device commands and queries This patch series fixes some shortcomings with the current VNIC device command implementation. The first patch fixes the initialization of driver completion structures used for device commands. Additionally, all waits for device commands are bounded with a timeout in the event that the device does not respond or becomes inoperable. Finally, serialize queries to retain the integrity of device return codes. Changes in v2: - included header comment for ibmvnic_wait_for_completion - removed open-coded loop in patch 3/4, suggested by Jakub - ibmvnic_wait_for_completion accepts timeout value in milliseconds instead of jiffies - timeout calculations cleaned up and completed before wait loop - included missing mutex_destroy calls, suggested by Jakub - included comment before mutex declaration ==================== Signed-off-by: David S. Miller commit ff25dcb9a1492ecbe495de936765c7ff3441b601 Author: Thomas Falcon Date: Mon Nov 25 17:12:56 2019 -0600 ibmvnic: Serialize device queries Provide some serialization for device CRQ commands and queries to ensure that the shared variable used for storing return codes is properly synchronized. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit 476d96ca9cc59ad07dc452184880b635e4e29b06 Author: Thomas Falcon Date: Mon Nov 25 17:12:55 2019 -0600 ibmvnic: Bound waits for device queries Create a wrapper for wait_for_completion calls with additional driver checks to ensure that the driver does not wait on a disabled device. In those cases or if the device does not respond in an extended amount of time, this will allow the driver an opportunity to recover. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit 2147e3d09e9ba6edc54b1b4bb7d8fc3cca96776b Author: Thomas Falcon Date: Mon Nov 25 17:12:54 2019 -0600 ibmvnic: Terminate waiting device threads after loss of service If we receive a notification that the device has been deactivated or removed, force a completion of all waiting threads. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit 070eca955c4af1248cb78a216463ff757a5dc511 Author: Thomas Falcon Date: Mon Nov 25 17:12:53 2019 -0600 ibmvnic: Fix completion structure initialization Fix multiple calls to init_completion for device completion structures. Instead, initialize them during device probe and reinitialize them later as needed. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit fb8223888e72eacd69948069f05c77a01e5a1b05 Author: Maciej Żenczykowski Date: Mon Nov 25 15:09:37 2019 -0800 net-sctp: replace some sock_net(sk) with just 'net' It already existed in part of the function, but move it to a higher level and use it consistently throughout. Safe since sk is never written to. Signed-off-by: Maciej Żenczykowski Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit ac71676c493f738ed04b0db9dc67aa03de7f2722 Author: Maciej Żenczykowski Date: Mon Nov 25 14:48:00 2019 -0800 net: Fix a documentation bug wrt. ip_unprivileged_port_start It cannot overlap with the local port range - ie. with autobind selectable ports - and not with reserved ports. Indeed 'ip_local_reserved_ports' isn't even a range, it's a (by default empty) set. Fixes: 4548b683b781 ("Introduce a sysctl that modifies the value of PROT_SOCK.") Signed-off-by: Maciej Żenczykowski Signed-off-by: David S. Miller commit 56f2ab41b652251f336a0f471b1033afeaedd161 Author: Andy Lutomirski Date: Wed Jul 17 06:44:16 2019 -0700 x86/ptrace: Document FSBASE and GSBASE ABI oddities Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Signed-off-by: Ingo Molnar commit 8e05f1b4f27d07a0f93e7c6fd28525a5d082b85c Author: Andy Lutomirski Date: Mon Jul 15 10:08:48 2019 -0700 x86/ptrace: Remove set_segment_reg() implementations for current seg_segment_reg() should be unreachable with task == current. Rather than confusingly trying to make it work, just explicitly disable this case. (regset->get is used for current in the coredump code, but the ->set interface is only used for ptrace, and you can't ptrace yourself.) Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Signed-off-by: Ingo Molnar commit 0337b7ebfcb8efb4ea0a9f2b2f284217a1c0e62d Author: Andy Lutomirski Date: Mon Nov 25 22:37:44 2019 -0800 x86/traps: die() instead of panicking on a double fault A double fault has a decent chance of being recoverable by killing the offending thread. Use die() so that we at least try to recover. Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Signed-off-by: Ingo Molnar commit 7d8d8cfdee9a7bd6f9682f253fa98efdd8048a9e Author: Andy Lutomirski Date: Wed Nov 20 23:06:41 2019 -0800 x86/doublefault/32: Rewrite the x86_32 #DF handler and unify with 64-bit The old x86_32 doublefault_fn() was old and crufty, and it did not even try to recover. do_double_fault() is much nicer. Rewrite the 32-bit double fault code to sanitize CPU state and call do_double_fault(). This is mostly an exercise i386 archaeology. With this patch applied, 32-bit double faults get a real stack trace, just like 64-bit double faults. [ mingo: merged the patch to a later kernel base. ] Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Signed-off-by: Ingo Molnar commit dc4e0021b00b5a4ecba56fae509217776592b0aa Author: Andy Lutomirski Date: Tue Nov 26 18:27:16 2019 +0100 x86/doublefault/32: Move #DF stack and TSS to cpu_entry_area There are three problems with the current layout of the doublefault stack and TSS. First, the TSS is only cacheline-aligned, which is not enough -- if the hardware portion of the TSS (struct x86_hw_tss) crosses a page boundary, horrible things happen [0]. Second, the stack and TSS are global, so simultaneous double faults on different CPUs will cause massive corruption. Third, the whole mechanism won't work if user CR3 is loaded, resulting in a triple fault [1]. Let the doublefault stack and TSS share a page (which prevents the TSS from spanning a page boundary), make it percpu, and move it into cpu_entry_area. Teach the stack dump code about the doublefault stack. [0] Real hardware will read past the end of the page onto the next *physical* page if a task switch happens. Virtual machines may have any number of bugs, and I would consider it reasonable for a VM to summarily kill the guest if it tries to task-switch to a page-spanning TSS. [1] Real hardware triple faults. At least some VMs seem to hang. I'm not sure what's going on. Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Signed-off-by: Ingo Molnar commit e99b6f46ee5c127d39d2f3a2682fdeef10386316 Author: Andy Lutomirski Date: Thu Nov 21 09:42:30 2019 -0800 x86/doublefault/32: Rename doublefault.c to doublefault_32.c doublefault.c now only contains 32-bit code. Rename it to doublefault_32.c. Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Signed-off-by: Ingo Molnar commit 93efbde2c331004d8053f04b4bf0ca3e630b474a Author: Andy Lutomirski Date: Wed Nov 20 22:12:38 2019 -0800 x86/traps: Disentangle the 32-bit and 64-bit doublefault code The 64-bit doublefault handler is much nicer than the 32-bit one. As a first step toward unifying them, make the 64-bit handler self-contained. This should have no effect no functional effect except in the odd case of x86_64 with CONFIG_DOUBLEFAULT=n in which case it will change the logging a bit. This also gets rid of CONFIG_DOUBLEFAULT configurability on 64-bit kernels. It didn't do anything useful -- CONFIG_DOUBLEFAULT=n didn't actually disable doublefault handling on x86_64. Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Signed-off-by: Ingo Molnar commit b09511c253e5c739a60952b97c071a93e92b2e88 Author: Andy Lutomirski Date: Sun Nov 24 21:18:04 2019 -0800 lkdtm: Add a DOUBLE_FAULT crash type on x86 The DOUBLE_FAULT crash does INT $8, which is a decent approximation of a double fault. This is useful for testing the double fault handling. Use it like: Signed-off-by: Andy Lutomirski Cc: Kees Cook Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Signed-off-by: Ingo Molnar commit 3300c4f3afbb59a1f4bfdbe0f0b6c91e241541b1 Author: Andy Lutomirski Date: Wed Nov 20 12:22:46 2019 -0800 selftests/x86/single_step_syscall: Check SYSENTER directly We used to test SYSENTER only through the vDSO. Test it directly too, just in case. Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Signed-off-by: Ingo Molnar commit 9a62d20027da3164a22244d9f022c0c987261687 Author: Joerg Roedel Date: Tue Nov 26 11:09:42 2019 +0100 x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all() The job of vmalloc_sync_all() is to help the lazy freeing of vmalloc() ranges: before such vmap ranges are reused we make sure that they are unmapped from every task's page tables. This is really easy on pagetable setups where the kernel page tables are shared between all tasks - this is the case on 32-bit kernels with SHARED_KERNEL_PMD = 1. But on !SHARED_KERNEL_PMD 32-bit kernels this involves iterating over the pgd_list and clearing all pmd entries in the pgds that are cleared in the init_mm.pgd, which is the reference pagetable that the vmalloc() code uses. In that context the current practice of vmalloc_sync_all() iterating until FIX_ADDR_TOP is buggy: for (address = VMALLOC_START & PMD_MASK; address >= TASK_SIZE_MAX && address < FIXADDR_TOP; address += PMD_SIZE) { struct page *page; Because iterating up to FIXADDR_TOP will involve a lot of non-vmalloc address ranges: VMALLOC -> PKMAP -> LDT -> CPU_ENTRY_AREA -> FIX_ADDR This is mostly harmless for the FIX_ADDR and CPU_ENTRY_AREA ranges that don't clear their pmds, but it's lethal for the LDT range, which relies on having different mappings in different processes, and 'synchronizing' them in the vmalloc sense corrupts those pagetable entries (clearing them). This got particularly prominent with PTI, which turns SHARED_KERNEL_PMD off and makes this the dominant mapping mode on 32-bit. To make LDT working again vmalloc_sync_all() must only iterate over the volatile parts of the kernel address range that are identical between all processes. So the correct check in vmalloc_sync_all() is "address < VMALLOC_END" to make sure the VMALLOC areas are synchronized and the LDT mapping is not falsely overwritten. The CPU_ENTRY_AREA and the FIXMAP area are no longer synced either, but this is not really a proplem since their PMDs get established during bootup and never change. This change fixes the ldt_gdt selftest in my setup. [ mingo: Fixed up the changelog to explain the logic and modified the copying to only happen up until VMALLOC_END. ] Reported-by: Borislav Petkov Tested-by: Borislav Petkov Signed-off-by: Joerg Roedel Cc: Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Dave Hansen Cc: Joerg Roedel Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: hpa@zytor.com Fixes: 7757d607c6b3: ("x86/pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32") Link: https://lkml.kernel.org/r/20191126111119.GA110513@gmail.com Signed-off-by: Ingo Molnar commit 0bcd7762727dd8ba9b9b6f828e5a4cbd5da4f725 Author: Ingo Molnar Date: Tue Nov 26 21:49:04 2019 +0100 x86/iopl: Make 'struct tss_struct' constant size again After the following commit: 05b042a19443: ("x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise") 'struct cpu_entry_area' has to be Kconfig invariant, so that we always have a matching CPU_ENTRY_AREA_PAGES size. This commit added a CONFIG_X86_IOPL_IOPERM dependency to tss_struct: 111e7b15cf10: ("x86/ioperm: Extend IOPL config to control ioperm() as well") Which, if CONFIG_X86_IOPL_IOPERM is turned off, reduces the size of cpu_entry_area by two pages, triggering the assert: ./include/linux/compiler.h:391:38: error: call to ‘__compiletime_assert_202’ declared with attribute error: BUILD_BUG_ON failed: (CPU_ENTRY_AREA_PAGES+1)*PAGE_SIZE != CPU_ENTRY_AREA_MAP_SIZE Simplify the Kconfig dependencies and make cpu_entry_area constant size on 32-bit kernels again. Fixes: 05b042a19443: ("x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise") Cc: Thomas Gleixner Cc: Borislav Petkov Cc: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Andy Lutomirski Signed-off-by: Ingo Molnar commit a8de1304b7df30e3a14f2a8b9709bb4ff31a0385 Author: Masahiro Yamada Date: Wed Nov 13 16:12:02 2019 +0900 libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h The DTC v1.5.1 added references to (U)INT32_MAX. This is no problem for user-space programs since defines (U)INT32_MAX along with (u)int32_t. For the kernel space, libfdt_env.h needs to be adjusted before we pull in the changes. In the kernel, we usually use s/u32 instead of (u)int32_t for the fixed-width types. Accordingly, we already have S/U32_MAX for their max values. So, we should not add (U)INT32_MAX to any more. Instead, add them to the in-kernel libfdt_env.h to compile the latest libfdt. Signed-off-by: Masahiro Yamada Signed-off-by: Rob Herring commit 396bbe1427828be1025fb052b7e04b42f421352d Author: Diego Elio Pettenò Date: Tue Nov 19 21:37:09 2019 +0000 sr_vendor: support Beurer GL50 evo CD-on-a-chip devices. The Beurer GL50 evo uses a Cygnal-manufactured CD-on-a-chip that only accepts a subset of SCSI commands, and supports neither audio commands nor generic packet commands. Actually sending those commands bring the device to an unrecoverable state that causes the device to hang and reset. To: Jens Axboe Cc: linux-kernel@vger.kernel.org Cc: linux-scsi@vger.kernel.org Signed-off-by: Diego Elio Pettenò Signed-off-by: Jens Axboe commit 366ba7c71ef77c08d06b18ad61b26e2df7352338 Author: Diego Elio Pettenò Date: Tue Nov 19 21:37:08 2019 +0000 cdrom: respect device capabilities during opening action Reading the TOC only works if the device can play audio, otherwise these commands fail (and possibly bring the device to an unhealthy state.) Similarly, cdrom_mmc3_profile() should only be called if the device supports generic packet commands. To: Jens Axboe Cc: linux-kernel@vger.kernel.org Cc: linux-scsi@vger.kernel.org Signed-off-by: Diego Elio Pettenò Signed-off-by: Jens Axboe commit c2d9aa3b6e56de56c7f1ed9026ca6ec7cfbeef19 Author: Max Filippov Date: Thu Nov 14 15:05:40 2019 -0800 xtensa: fix syscall_set_return_value syscall return value is in the register a2, not a0. Cc: stable@vger.kernel.org # v5.0+ Fixes: 9f24f3c1067c ("xtensa: implement tracehook functions and enable HAVE_ARCH_TRACEHOOK") Signed-off-by: Max Filippov commit 6859ad379439df609915fd2e0c44dc39605c6618 Author: Stefan Wahren Date: Sun Nov 24 18:48:53 2019 +0100 MAINTAINERS: Make Nicolas Saenz Julienne the new bcm2835 maintainer Eric isn't active any more and i don't have the necessary free time. Nicolas already made contributions to bcm2835 and is pleased to take over the maintainership. My thanks go to both of them. Signed-off-by: Stefan Wahren Acked-by: Nicolas Saenz Julienne Reviewed-by: Eric Anholt Signed-off-by: Florian Fainelli commit 2be7d348fe924f0c5583c6a805bd42cecda93104 Author: Linus Torvalds Date: Tue Nov 26 11:34:06 2019 -0800 Revert "vfs: properly and reliably lock f_pos in fdget_pos()" This reverts commit 0be0ee71816b2b6725e2b4f32ad6726c9d729777. I was hoping it would be benign to switch over entirely to FMODE_STREAM, and we'd have just a couple of small fixups we'd need, but it looks like we're not quite there yet. While it worked fine on both my desktop and laptop, they are fairly similar in other respects, and run mostly the same loads. Kenneth Crudup reports that it seems to break both his vmware installation and the KDE upower service. In both cases apparently leading to timeouts due to waitinmg for the f_pos lock. There are a number of character devices in particular that definitely want stream-like behavior, but that currently don't get marked as streams, and as a result get the exclusion between concurrent read()/write() on the same file descriptor. Which doesn't work well for them. The most obvious example if this is /dev/console and /dev/tty, which use console_fops and tty_fops respectively (and ptmx_fops for the pty master side). It may be that it's just this that causes problems, but we clearly weren't ready yet. Because there's a number of other likely common cases that don't have llseek implementations and would seem to act as stream devices: /dev/fuse (fuse_dev_operations) /dev/mcelog (mce_chrdev_ops) /dev/mei0 (mei_fops) /dev/net/tun (tun_fops) /dev/nvme0 (nvme_dev_fops) /dev/tpm0 (tpm_fops) /proc/self/ns/mnt (ns_file_operations) /dev/snd/pcm* (snd_pcm_f_ops[]) and while some of these could be trivially automatically detected by the vfs layer when the character device is opened by just noticing that they have no read or write operations either, it often isn't that obvious. Some character devices most definitely do use the file position, even if they don't allow seeking: the firmware update code, for example, uses simple_read_from_buffer() that does use f_pos, but doesn't allow seeking back and forth. We'll revisit this when there's a better way to detect the problem and fix it (possibly with a coccinelle script to do more of the FMODE_STREAM annotations). Reported-by: Kenneth R. Crudup Cc: Kirill Smelkov Signed-off-by: Linus Torvalds commit d80a505348472093cce6698b837c2b83b5e90390 Author: Max Filippov Date: Mon Nov 25 12:57:02 2019 -0800 xtensa: drop unneeded headers from coprocessor.S A bunch of irrelevant headers is included into coprocessor.S. Remove them and add necessary asm/regs.h. Signed-off-by: Max Filippov commit 8b5d7e5242de1db7c08335a512ad260fb3cd0b39 Author: Valentin Schneider Date: Mon Sep 23 15:36:20 2019 +0100 xtensa: entry: Remove unneeded need_resched() loop Since the enabling and disabling of IRQs within preempt_schedule_irq() is contained in a need_resched() loop, we don't need the outer arch code loop. Acked-by: Max Filippov Signed-off-by: Valentin Schneider Message-Id: <20190923143620.29334-10-valentin.schneider@arm.com> Signed-off-by: Max Filippov commit e64681b487c897ec871465083bf0874087d47b66 Author: Max Filippov Date: Wed Nov 13 16:06:42 2019 -0800 xtensa: use MEMBLOCK_ALLOC_ANYWHERE for KASAN shadow map KASAN shadow map doesn't need to be accessible through the linear kernel mapping, allocate its pages with MEMBLOCK_ALLOC_ANYWHERE so that high memory can be used. This frees up to ~100MB of low memory on xtensa configurations with KASAN and high memory. Cc: stable@vger.kernel.org # v5.1+ Fixes: f240ec09bb8a ("memblock: replace memblock_alloc_base(ANYWHERE) with memblock_phys_alloc") Reviewed-by: Mike Rapoport Signed-off-by: Max Filippov commit 36de10c4788efc6efe6ff9aa10d38cb7eea4c818 Author: Max Filippov Date: Wed Nov 13 13:18:31 2019 -0800 xtensa: fix TLB sanity checker Virtual and translated addresses retrieved by the xtensa TLB sanity checker must be consistent, i.e. correspond to the same state of the checked TLB entry. KASAN shadow memory is mapped dynamically using auto-refill TLB entries and thus may change TLB state between the virtual and translated address retrieval, resulting in false TLB insanity report. Move read_xtlb_translation close to read_xtlb_virtual to make sure that read values are consistent. Cc: stable@vger.kernel.org Fixes: a99e07ee5e88 ("xtensa: check TLB sanity on return to userspace") Signed-off-by: Max Filippov commit f5ee2567921dec4f489c16d4fe22c3a7222d0ce6 Author: Mike Rapoport Date: Tue Nov 5 16:33:20 2019 +0200 xtensa: get rid of __ARCH_USE_5LEVEL_HACK xtensa has 2-level page tables and already uses pgtable-nopmd for page table folding. Add walks of p4d level where appropriate and drop usage of __ARCH_USE_5LEVEL_HACK. Signed-off-by: Mike Rapoport Message-Id: <1572964400-16542-3-git-send-email-rppt@kernel.org> Signed-off-by: Max Filippov [fix up arch/xtensa/include/asm/fixmap.h and arch/xtensa/mm/tlb.c] commit f0d1eab8c2e1f9240cf4ae4753d7947c65e60bd7 Author: Mike Rapoport Date: Tue Nov 5 16:33:19 2019 +0200 xtensa: mm: fix PMD folding implementation There was a definition of pmd_offset() in arch/xtensa/include/asm/pgtable.h that shadowed the generic implementation defined in include/asm-generic/pgtable-nopmd.h. As the result, xtensa had shortcuts in page table traversal in several places instead of doing level unfolding. Remove local override for pmd_offset() and add page table unfolding where necessary. Signed-off-by: Mike Rapoport Message-Id: <1572964400-16542-2-git-send-email-rppt@kernel.org> Signed-off-by: Max Filippov commit 8951eb1530ddf83dbb815d38e97afddc6a0d1140 Author: Max Filippov Date: Tue Nov 12 08:43:25 2019 -0800 xtensa: make stack dump size configurable Introduce Kconfig symbol PRINT_STACK_DEPTH and use it to initialize kstack_depth_to_print. Reviewed-by: Petr Mladek Signed-off-by: Max Filippov commit c5fccebc138b1f5a5b57acecdbf1530e41ebea17 Author: Max Filippov Date: Tue Nov 12 08:47:48 2019 -0800 xtensa: improve stack dumping Calculate printable stack size and use print_hex_dump instead of opencoding it. Drop extra newline output in show_trace as its output format does not depend on CONFIG_KALLSYMS. Reviewed-by: Petr Mladek Signed-off-by: Max Filippov commit 5eff6ca2e39662114675e7cca6a01e15d6c0b5d1 Author: Max Filippov Date: Wed Oct 16 00:49:54 2019 -0700 xtensa: use "m" constraint instead of "r" in futex.h assembly Use "m" constraint instead of "r" for the address, as "m" allows compiler to access adjacent locations using base + offset, while "r" requires updating the base register every time. Signed-off-by: Max Filippov commit cf3b3baa712517c4972339b150f79fa88099e5db Author: Max Filippov Date: Wed Oct 16 00:49:54 2019 -0700 xtensa: use "m" constraint instead of "a" in cmpxchg.h assembly Use "m" constraint instead of "r" for the address, as "m" allows compiler to access adjacent locations using base + offset, while "r" requires updating the base register every time. Signed-off-by: Max Filippov commit 812e708a4c2d29664a009805671d98cbe7c756b1 Author: Max Filippov Date: Wed Oct 16 01:52:38 2019 -0700 xtensa: use named assembly arguments in cmpxchg.h Numeric assembly arguments are hard to understand and assembly code that uses them is hard to modify. Use named arguments in __cmpxchg_u32 and xchg_u32. Signed-off-by: Max Filippov commit 13e28135d6fb4906af9cd1d54f22172ad5e4a0dd Author: Max Filippov Date: Wed Oct 16 00:49:54 2019 -0700 xtensa: use "m" constraint instead of "a" in atomic.h assembly Use "m" constraint instead of "r" for the address, as "m" allows compiler to access adjacent locations using base + offset, while "r" requires updating the base register every time. Signed-off-by: Max Filippov commit 643d6976ff0b950fc6e5d65adfda497ba792b149 Author: Max Filippov Date: Wed Oct 16 00:33:10 2019 -0700 xtensa: use named assembly arguments in atomic.h Numeric assembly arguments are hard to understand and assembly code that uses them is hard to modify. Use named arguments in ATOMIC_OP, ATOMIC_OP_RETURN and ATOMIC_FETCH_OP macros. Signed-off-by: Max Filippov commit 5bf67094a3a2d99d5f96db30be286f6c41988177 Author: Max Filippov Date: Tue Oct 15 22:17:33 2019 -0700 xtensa: use "m" constraint instead of "a" in bitops.h assembly Use "m" constraint instead of "r" for the address, as "m" allows compiler to access adjacent locations using base + offset, while "r" requires updating the base register every time. Signed-off-by: Max Filippov commit e444917019258ef3bd564d0b4a432add2c26a2ae Author: Max Filippov Date: Tue Oct 15 22:14:15 2019 -0700 xtensa: use named assembly arguments in bitops.h Numeric assembly arguments are hard to understand and assembly code that uses them is hard to modify. Use named arguments in BIT_OP and TEST_AND_BIT_OP macros. Signed-off-by: Max Filippov commit b387dc044efaa07cd8a47316c83fe2a5c08f9650 Author: Max Filippov Date: Tue Oct 15 22:04:13 2019 -0700 xtensa: use macros to generate *_bit and test_and_*_bit functions Parameterize macros with function name, opcode and inversion pattern. This reduces code duplication removing 2/3 of definitions. Signed-off-by: Max Filippov commit cbc6e28703c44a321e9d8a8894ec11bc6e7e473d Author: Max Filippov Date: Tue Oct 15 14:03:03 2019 -0700 xtensa: use "m" constraint instead of "a" in uaccess.h assembly Use "m" constraint instead of "r" for the address, as "m" allows compiler to access adjacent locations using base + offset, while "r" requires updating the base register every time. Use %[mem] * 0 + v to replace offset part of %[mem] expansion with v. It is impossible to change address alignment through the offset part on xtensa, so just ignore offset in alignment checks. Signed-off-by: Max Filippov commit f5fae6790fd3199e45ead10f7004311abdf539e5 Author: Max Filippov Date: Mon Oct 14 11:33:44 2019 -0700 xtensa: merge .fixup with .text Section .fixup contains pieces of code, merge it with the rest of the .text section. Signed-off-by: Max Filippov commit 7af710d988775aadf440222ecbe0c10eecf3eb54 Author: Max Filippov Date: Tue Jan 3 17:57:51 2017 -0800 xtensa: add XIP kernel support XIP (eXecute In Place) kernel image is the image that can be run directly from ROM, using RAM only for writable data. XIP xtensa kernel differs from regular xtensa kernel in the following ways: - it has exception/IRQ vectors merged into text section. No vectors relocation takes place at kernel startup. - .data/.bss location must be specified in the kernel configuration, its content is copied there in the _startup function. - .init.text is merged with the rest of text and is executed from ROM. - when MMU is used the virtual address where the kernel will be mapped must be specified in the kernel configuration. It may be in the KSEG or in the KIO, __pa macro is adjusted to be able to handle both. Signed-off-by: Max Filippov commit 30a3e01d4cbbfedac48d69a415136000a36910c7 Author: Rob Herring Date: Tue Nov 19 14:31:25 2019 -0600 dt-bindings: arm: Remove leftover axentia.txt The bindings described in axentia.txt are already covered by atmel-at91.yaml, so remove the file. Cc: Peter Rosin Cc: Nicolas Ferre Cc: Alexandre Belloni Cc: Ludovic Desroches Signed-off-by: Rob Herring commit 2aacace6dbbb6b6ce4e177e6c7ea901f389c0472 Author: Erhard Furtner Date: Tue Nov 26 02:48:04 2019 +0100 of: unittest: fix memory leak in attach_node_and_children In attach_node_and_children memory is allocated for full_name via kasprintf. If the condition of the 1st if is not met the function returns early without freeing the memory. Add a kfree() to fix that. This has been detected with kmemleak: Link: https://bugzilla.kernel.org/show_bug.cgi?id=205327 It looks like the leak was introduced by this commit: Fixes: 5babefb7f7ab ("of: unittest: allow base devicetree to have symbol metadata") Signed-off-by: Erhard Furtner Reviewed-by: Michael Ellerman Reviewed-by: Tyrel Datwyler Signed-off-by: Rob Herring commit 637392a8506a3a7dd24ab9094a14f7522adb73b4 Author: Frank Rowand Date: Thu Nov 21 13:16:56 2019 -0600 of: overlay: add_changeset_property() memory leak No changeset entries are created for #address-cells and #size-cells properties, but the duplicated properties are never freed. This results in a memory leak which is detected by kmemleak: unreferenced object 0x85887180 (size 64): backtrace: kmem_cache_alloc_trace+0x1fb/0x1fc __of_prop_dup+0x25/0x7c add_changeset_property+0x17f/0x370 build_changeset_next_level+0x29/0x20c of_overlay_fdt_apply+0x32b/0x6b4 ... Fixes: 6f75118800ac ("of: overlay: validate overlay properties #address-cells and #size-cells") Reported-by: Vincent Whitchurch Signed-off-by: Frank Rowand Tested-by: Vincent Whitchurch Signed-off-by: Rob Herring commit cf7d88fb867c107a6b93c8a180ce9831fd4dc6fb Author: Rob Herring Date: Thu Nov 21 17:06:47 2019 -0600 dt-bindings: interrupt-controller: arm,gic-v3: Add missing type to interrupt-partition-* nodes Add missing 'type: object' schema to interrupt-partition-* nodes. Found with fix to meta-schema checks. Cc: Thomas Gleixner Cc: Jason Cooper Acked-by: Marc Zyngier Signed-off-by: Rob Herring commit cb6192d647f79ae76128bce5216ea4f4e1776727 Author: Rob Herring Date: Thu Nov 21 16:57:03 2019 -0600 dt-bindings: firmware: ixp4xx: Drop redundant minItems/maxItems The minItems/maxItems default to the number of items in an 'items' list, so drop the redundant specifying of them here. Signed-off-by: Rob Herring commit d17f8338fe778722cf8fcb8513698faf1ac4c37e Author: Krzysztof Kozlowski Date: Wed Nov 20 08:59:56 2019 +0100 dt-bindings: power: Rename back power_domain.txt bindings to fix references With split of power domain controller bindings to power-domain.yaml, the consumer part was renamed to power-domain.txt breaking the references. Undo the renaming. Reported-by: Geert Uytterhoeven Fixes: 5279a3d8bede ("dt-bindings: power: Convert Generic Power Domain bindings to json-schema") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Reviewed-by: Ulf Hansson Signed-off-by: Rob Herring commit 191d6f91f283dfb007499bb8529d54c3ac434bd7 Author: Palmer Dabbelt Date: Fri Oct 25 08:10:38 2019 +0200 PCI: Remove PCI_MSI_IRQ_DOMAIN architecture whitelist The only apparent reason for the PCI_MSI_IRQ_DOMAIN architecture whitelist was that it requires msi.h. Now that msi.h is mandatory in asm-generic/Kbuild, every arch should have at least the default version, so remove the whitelist. Built for all the architectures that play nice with make.cross, but not boot tested anywhere. Link: https://lore.kernel.org/r/514e7b040be8ccd69088193aba260da1b89e919c.1571983829.git.michal.simek@xilinx.com Signed-off-by: Palmer Dabbelt Signed-off-by: Michal Simek Signed-off-by: Bjorn Helgaas Acked-by: Waiman Long commit a1b39bae16a62ce4aae02d958224f19316d98b24 Author: Michal Simek Date: Fri Oct 25 08:10:37 2019 +0200 asm-generic: Make msi.h a mandatory include/asm header msi.h is generic for all architectures except x86, which has its own version. Enabling MSI by adding msi.h to every architecture's Kbuild is just an additional step which doesn't need to be done. Make msi.h mandatory in the asm-generic/Kbuild so we don't have to do it for each architecture. Suggested-by: Christoph Hellwig Link: https://lore.kernel.org/r/c991669e29a79b1a8e28c3b4b3a125801a693de8.1571983829.git.michal.simek@xilinx.com Tested-by: Paul Walmsley # build only, rv32/rv64 Signed-off-by: Michal Simek Signed-off-by: Bjorn Helgaas Reviewed-by: Masahiro Yamada Acked-by: Waiman Long Acked-by: Paul Walmsley # arch/riscv commit 655e7aee1f0398602627a485f7dca6c29cc96cae Author: Jian-Hong Pan Date: Thu Oct 31 17:34:09 2019 +0800 Revert "nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T" Since e045fa29e893 ("PCI/MSI: Fix incorrect MSI-X masking on resume") is merged, we can revert the previous quirk now. This reverts commit 19ea025e1d28c629b369c3532a85b3df478cc5c6. Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=204887 Fixes: 19ea025e1d28 ("nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T") Link: https://lore.kernel.org/r/20191031093408.9322-1-jian-hong@endlessm.com Signed-off-by: Jian-Hong Pan Signed-off-by: Bjorn Helgaas Acked-by: Christoph Hellwig Cc: stable@vger.kernel.org commit ab851d49f6bfc781edd8bd44c72ec1e49211670b Merge: 1d87200446f1 e3cb0c7102f0 Author: Linus Torvalds Date: Tue Nov 26 11:12:02 2019 -0800 Merge branch 'x86-iopl-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 iopl updates from Ingo Molnar: "This implements a nice simplification of the iopl and ioperm code that Thomas Gleixner discovered: we can implement the IO privilege features of the iopl system call by using the IO permission bitmap in permissive mode, while trapping CLI/STI/POPF/PUSHF uses in user-space if they change the interrupt flag. This implements that feature, with testing facilities and related cleanups" [ "Simplification" may be an over-statement. The main goal is to avoid the cli/sti of iopl by effectively implementing the IO port access parts of iopl in terms of ioperm. This may end up not workign well in case people actually depend on cli/sti being available, or if there are mixed uses of iopl and ioperm. We will see.. - Linus ] * 'x86-iopl-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (22 commits) x86/ioperm: Fix use of deprecated config option x86/entry/32: Clarify register saving in __switch_to_asm() selftests/x86/iopl: Extend test to cover IOPL emulation x86/ioperm: Extend IOPL config to control ioperm() as well x86/iopl: Remove legacy IOPL option x86/iopl: Restrict iopl() permission scope x86/iopl: Fixup misleading comment selftests/x86/ioperm: Extend testing so the shared bitmap is exercised x86/ioperm: Share I/O bitmap if identical x86/ioperm: Remove bitmap if all permissions dropped x86/ioperm: Move TSS bitmap update to exit to user work x86/ioperm: Add bitmap sequence number x86/ioperm: Move iobitmap data into a struct x86/tss: Move I/O bitmap data into a seperate struct x86/io: Speedup schedule out of I/O bitmap user x86/ioperm: Avoid bitmap allocation if no permissions are set x86/ioperm: Simplify first ioperm() invocation logic x86/iopl: Cleanup include maze x86/tss: Fix and move VMX BUILD_BUG_ON() x86/cpu: Unify cpu_init() ... commit e045fa29e89383c717e308609edd19d2fd29e1be Author: Jian-Hong Pan Date: Tue Oct 8 11:42:39 2019 +0800 PCI/MSI: Fix incorrect MSI-X masking on resume When a driver enables MSI-X, msix_program_entries() reads the MSI-X Vector Control register for each vector and saves it in desc->masked. Each register is 32 bits and bit 0 is the actual Mask bit. When we restored these registers during resume, we previously set the Mask bit if *any* bit in desc->masked was set instead of when the Mask bit itself was set: pci_restore_state pci_restore_msi_state __pci_restore_msix_state for_each_pci_msi_entry msix_mask_irq(entry, entry->masked) <-- entire u32 word __pci_msix_desc_mask_irq(desc, flag) mask_bits = desc->masked & ~PCI_MSIX_ENTRY_CTRL_MASKBIT if (flag) <-- testing entire u32, not just bit 0 mask_bits |= PCI_MSIX_ENTRY_CTRL_MASKBIT writel(mask_bits, desc_addr + PCI_MSIX_ENTRY_VECTOR_CTRL) This means that after resume, MSI-X vectors were masked when they shouldn't be, which leads to timeouts like this: nvme nvme0: I/O 978 QID 3 timeout, completion polled On resume, set the Mask bit only when the saved Mask bit from suspend was set. This should remove the need for 19ea025e1d28 ("nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T"). [bhelgaas: commit log, move fix to __pci_msix_desc_mask_irq()] Link: https://bugzilla.kernel.org/show_bug.cgi?id=204887 Link: https://lore.kernel.org/r/20191008034238.2503-1-jian-hong@endlessm.com Fixes: f2440d9acbe8 ("PCI MSI: Refactor interrupt masking code") Signed-off-by: Jian-Hong Pan Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org commit 901c4ddbe277a766fd081ffbbd526d7b4bdbacdf Author: Bjorn Helgaas Date: Mon Oct 14 16:17:05 2019 -0500 PCI/MSI: Move power state check out of pci_msi_supported() 27e20603c54b ("PCI/MSI: Move D0 check into pci_msi_check_device()") moved the power state check into pci_msi_check_device(), which was subsequently renamed to pci_msi_supported(). This didn't change the behavior, since both callers checked the power state. However, it doesn't fit the current "pci_msi_supported()" name, which should return what the device is capable of, independent of the power state. Move the power state check back into the callers for readability. No functional change intended. Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit d41b0e64d206f8948212b4d0f30c330db95c9636 Author: Greg Kroah-Hartman Date: Mon Oct 14 12:04:52 2019 +0200 PCI/MSI: Remove unused pci_irq_get_node() The function pci_irq_get_node() is not used by anyone in the tree, so just delete it. Link: https://lore.kernel.org/r/20191014100452.GA6699@kroah.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Bjorn Helgaas Reviewed-by: Andrew Murray commit 61a47c1ad3a4dc6882f01ebdc88138ac62d0df03 Author: Eric W. Biederman Date: Tue Oct 1 13:01:19 2019 -0500 sysctl: Remove the sysctl system call This system call has been deprecated almost since it was introduced, and in a survey of the linux distributions I can no longer find any of them that enable CONFIG_SYSCTL_SYSCALL. The only indication that I can find that anyone might care is that a few of the defconfigs in the kernel enable CONFIG_SYSCTL_SYSCALL. However this appears in only 31 of 414 defconfigs in the kernel, so I suspect this symbols presence is simply because it is harmless to include rather than because it is necessary. As there appear to be no users of the sysctl system call, remove the code. As this removes one of the few uses of the internal kernel mount of proc I hope this allows for even more simplifications of the proc filesystem. Cc: Alex Smith Cc: Anders Berg Cc: Apelete Seketeli Cc: Arnd Bergmann Cc: Chee Nouk Phoon Cc: Chris Zankel Cc: Christian Ruppert Cc: Greg Ungerer Cc: Harvey Hunt Cc: Helge Deller Cc: Hongliang Tao Cc: Hua Yan Cc: Huacai Chen Cc: John Crispin Cc: Jonas Jensen Cc: Josh Boyer Cc: Jun Nie Cc: Kevin Hilman Cc: Kevin Wells Cc: Kumar Gala Cc: Lars-Peter Clausen Cc: Ley Foon Tan Cc: Linus Walleij Cc: Markos Chandras Cc: Max Filippov Cc: Noam Camus Cc: Olof Johansson Cc: Paul Burton Cc: Paul Mundt Cc: Phil Edworthy Cc: Pierrick Hascoet Cc: Ralf Baechle Cc: Roland Stigge Cc: Santosh Shilimkar Cc: Scott Telford Cc: Stephen Boyd Cc: Steven J. Hill Cc: Tanmay Inamdar Cc: Vineet Gupta Cc: Wolfram Sang Acked-by: Andi Kleen Reviewed-by: Kees Cook Signed-off-by: "Eric W. Biederman" commit 1d87200446f1d10dfe9672ca8edb027a82612f8c Merge: 5c4a1c090d86 f01ec4fca820 Author: Linus Torvalds Date: Tue Nov 26 10:42:40 2019 -0800 Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm updates from Ingo Molnar: "The main changes in this cycle were: - Cross-arch changes to move the linker sections for NOTES and EXCEPTION_TABLE into the RO_DATA area, where they belong on most architectures. (Kees Cook) - Switch the x86 linker fill byte from x90 (NOP) to 0xcc (INT3), to trap jumps into the middle of those padding areas instead of sliding execution. (Kees Cook) - A thorough cleanup of symbol definitions within x86 assembler code. The rather randomly named macros got streamlined around a (hopefully) straightforward naming scheme: SYM_START(name, linkage, align...) SYM_END(name, sym_type) SYM_FUNC_START(name) SYM_FUNC_END(name) SYM_CODE_START(name) SYM_CODE_END(name) SYM_DATA_START(name) SYM_DATA_END(name) etc - with about three times of these basic primitives with some label, local symbol or attribute variant, expressed via postfixes. No change in functionality intended. (Jiri Slaby) - Misc other changes, cleanups and smaller fixes" * 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (67 commits) x86/entry/64: Remove pointless jump in paranoid_exit x86/entry/32: Remove unused resume_userspace label x86/build/vdso: Remove meaningless CFLAGS_REMOVE_*.o m68k: Convert missed RODATA to RO_DATA x86/vmlinux: Use INT3 instead of NOP for linker fill bytes x86/mm: Report actual image regions in /proc/iomem x86/mm: Report which part of kernel image is freed x86/mm: Remove redundant address-of operators on addresses xtensa: Move EXCEPTION_TABLE to RO_DATA segment powerpc: Move EXCEPTION_TABLE to RO_DATA segment parisc: Move EXCEPTION_TABLE to RO_DATA segment microblaze: Move EXCEPTION_TABLE to RO_DATA segment ia64: Move EXCEPTION_TABLE to RO_DATA segment h8300: Move EXCEPTION_TABLE to RO_DATA segment c6x: Move EXCEPTION_TABLE to RO_DATA segment arm64: Move EXCEPTION_TABLE to RO_DATA segment alpha: Move EXCEPTION_TABLE to RO_DATA segment x86/vmlinux: Move EXCEPTION_TABLE to RO_DATA segment x86/vmlinux: Actually use _etext for the end of the text segment vmlinux.lds.h: Allow EXCEPTION_TABLE to live in RO_DATA ... commit 3b1313eb32c499d46dc4c3e896d19d9564c879c4 Author: Vladimir Kondratiev Date: Sun Nov 24 16:07:31 2019 +0200 mips: cacheinfo: report shared CPU map Report L1 caches as shared per core; L2 - per cluster. This fixes "perf" that went crazy if shared_cpu_map attribute not reported on sysfs, in form of /sys/devices/system/cpu/cpu*/cache/index*/shared_cpu_list /sys/devices/system/cpu/cpu*/cache/index*/shared_cpu_map Signed-off-by: Vladimir Kondratiev Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 02a65a0bfbef5c644f520885a0a85b45b9703cf3 Author: Piotr Maziarz Date: Tue Nov 26 11:06:31 2019 +0100 tracing: Fix __print_hex_dump scope undef is needed for parsing __print_hex_dump in traceevent lib. Link: http://lkml.kernel.org/r/1574762791-14883-1-git-send-email-piotrx.maziarz@linux.intel.com Signed-off-by: Piotr Maziarz Signed-off-by: Cezary Rojewski Signed-off-by: Steven Rostedt (VMware) commit 5c4a1c090d8676d8b84e2ac40671602be44afdfc Merge: 53a07a148fd0 4a13b0e3e109 Author: Linus Torvalds Date: Tue Nov 26 10:12:28 2019 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "These are the fixes left over from the v5.4 cycle: - Various low level 32-bit entry code fixes and improvements by Andy Lutomirski, Peter Zijlstra and Thomas Gleixner. - Fix 32-bit Xen PV breakage, by Jan Beulich" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/entry/32: Fix FIXUP_ESPFIX_STACK with user CR3 x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise selftests/x86/sigreturn/32: Invalidate DS and ES when abusing the kernel selftests/x86/mov_ss_trap: Fix the SYSENTER test x86/entry/32: Fix NMI vs ESPFIX x86/entry/32: Unwind the ESPFIX stack earlier on exception entry x86/entry/32: Move FIXUP_FRAME after pushing %fs in SAVE_ALL x86/entry/32: Use %ss segment where required x86/entry/32: Fix IRET exception x86/cpu_entry_area: Add guard page for entry stack on 32bit x86/pti/32: Size initial_page_table correctly x86/doublefault/32: Fix stack canaries in the double fault handler x86/xen/32: Simplify ring check in xen_iret_crit_fixup() x86/xen/32: Make xen_iret_crit_fixup() independent of frame layout x86/stackframe/32: Repair 32-bit Xen PV commit 53a07a148fd05dc6d317745688270bc79fe73121 Merge: da42761df5ce cd5a2aa89e84 Author: Linus Torvalds Date: Tue Nov 26 10:11:01 2019 -0800 Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 PTI updates from Ingo Molnar: "Fix reporting bugs of the MDS and TAA mitigation status, if one or both are set via a boot option. No change to mitigation behavior intended" * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/speculation: Fix redundant MDS mitigation message x86/speculation: Fix incorrect MDS/TAA mitigation status commit fd567ac20cb0377ff466d3337e6e9ac5d0cb15e4 Author: John Rutherford Date: Tue Nov 26 13:52:55 2019 +1100 tipc: fix link name length check In commit 4f07b80c9733 ("tipc: check msg->req data len in tipc_nl_compat_bearer_disable") the same patch code was copied into routines: tipc_nl_compat_bearer_disable(), tipc_nl_compat_link_stat_dump() and tipc_nl_compat_link_reset_stats(). The two link routine occurrences should have been modified to check the maximum link name length and not bearer name length. Fixes: 4f07b80c9733 ("tipc: check msg->reg data len in tipc_nl_compat_bearer_disable") Signed-off-by: John Rutherford Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 801b787a693ba643b23608cf2bf8dcfab3608795 Author: Andrew Jeffery Date: Thu Oct 10 12:36:55 2019 +1030 clk: aspeed: Add RMII RCLK gates for both AST2500 MACs RCLK is a fixed 50MHz clock derived from HPLL that is described by a single gate for each MAC. Signed-off-by: Andrew Jeffery Link: https://lkml.kernel.org/r/20191010020655.3776-3-andrew@aj.id.au Reviewed-by: Joel Stanley Signed-off-by: Stephen Boyd commit c869e494ef8b5846d9ba91f1e922c23cd444f0c1 Author: James Smart Date: Thu Nov 21 09:59:37 2019 -0800 nvme-fc: fix double-free scenarios on hw queues If an error occurs on one of the ios used for creating an association, the creating routine has error paths that are invoked by the command failure and the error paths will free up the controller resources created to that point. But... the io was ultimately determined by an asynchronous completion routine that detected the error and which unconditionally invokes the error_recovery path which calls delete_association. Delete association deletes all outstanding io then tears down the controller resources. So the create_association thread can be running in parallel with the error_recovery thread. What was seen was the LLDD received a call to delete a queue, causing the LLDD to do a free of a resource, then the transport called the delete queue again causing the driver to repeat the free call. The second free routine corrupted the allocator. The transport shouldn't be making the duplicate call, and the delete queue is just one of the resources being freed. To fix, it is realized that the create_association path is completely serialized with one command at a time. So the failed io completion will always be seen by the create_association path and as of the failure, there are no ios to terminate and there is no reason to be manipulating queue freeze states, etc. The serialized condition stays true until the controller is transitioned to the LIVE state. Thus the fix is to change the error recovery path to check the controller state and only invoke the teardown path if not already in the CONNECTING state. Reviewed-by: Himanshu Madhani Reviewed-by: Ewan D. Milne Signed-off-by: James Smart Signed-off-by: Keith Busch commit da42761df5ceed2f8b0527bc4c1b2760be45ddb9 Merge: 1c134b198daa 7a56b81c4746 Author: Linus Torvalds Date: Tue Nov 26 09:52:37 2019 -0800 Merge branch 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updates from Ingo Molnar: "UV platform updates (with a 'hubless' variant) and Jailhouse updates for better UART support" * 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/jailhouse: Only enable platform UARTs if available x86/jailhouse: Improve setup data version comparison x86/platform/uv: Account for UV Hubless in is_uvX_hub Ops x86/platform/uv: Check EFI Boot to set reboot type x86/platform/uv: Decode UVsystab Info x86/platform/uv: Add UV Hubbed/Hubless Proc FS Files x86/platform/uv: Setup UV functions for Hubless UV Systems x86/platform/uv: Add return code to UV BIOS Init function x86/platform/uv: Return UV Hubless System Type x86/platform/uv: Save OEM_ID from ACPI MADT probe commit 1c134b198daa81cb689f881dcf2900061914085a Merge: 24ee25a6da84 7f264dab5b60 Author: Linus Torvalds Date: Tue Nov 26 09:50:14 2019 -0800 Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Ingo Molnar: "The main changes in this cycle were: - A PAT series from Davidlohr Bueso, which simplifies the memtype rbtree by using the interval tree helpers. (There's more cleanups in this area queued up, but they didn't make the merge window.) - Also flip over CONFIG_X86_5LEVEL to default-y. This might draw in a few more testers, as all the major distros are going to have 5-level paging enabled by default in their next iterations. - Misc cleanups" * 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm/pat: Rename pat_rbtree.c to pat_interval.c x86/mm/pat: Drop the rbt_ prefix from external memtype calls x86/mm/pat: Do not pass 'rb_root' down the memtype tree helper functions x86/mm/pat: Convert the PAT tree to a generic interval tree x86/mm: Clean up the pmd_read_atomic() comments x86/mm: Fix function name typo in pmd_read_atomic() comment x86/cpu: Clean up intel_tlb_table[] x86/mm: Enable 5-level paging support by default commit c80b36cd9576efa861a080b05382856173a02ae9 Author: Edmund Nadolski Date: Mon Nov 25 09:06:12 2019 -0700 nvme: else following return is not needed Remove unnecessary keyword in nvme_create_queue(). Reviewed-by: Christoph Hellwig Signed-off-by: Edmund Nadolski Signed-off-by: Keith Busch commit a8157ff3607eccb21efd4eb2ca46ff0cc488d12d Author: James Smart Date: Thu Nov 21 09:58:10 2019 -0800 nvme: add error message on mismatching controller ids We've seen a few devices that return different controller id's to the Fabric Connect command vs the Identify(controller) command. It's currently hard to identify this failure by existing error messages. It comes across as a (re)connect attempt in the transport that fails with a -22 (-EINVAL) status. The issue is compounded by older kernels not having the controller id check or had the identify command overwrite the fabrics controller id value before it checked. Both resulted in cases where the devices appeared fine until more recent kernels. Clarify the reject by adding an error message on controller id mismatches. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Ewan D. Milne Signed-off-by: James Smart Signed-off-by: Keith Busch commit 863fbae929c7a5b64e96b8a3ffb34a29eefb9f8f Author: James Smart Date: Thu Nov 14 15:15:26 2019 -0800 nvme_fc: add module to ops template to allow module references In nvme-fc: it's possible to have connected active controllers and as no references are taken on the LLDD, the LLDD can be unloaded. The controller would enter a reconnect state and as long as the LLDD resumed within the reconnect timeout, the controller would resume. But if a namespace on the controller is the root device, allowing the driver to unload can be problematic. To reload the driver, it may require new io to the boot device, and as it's no longer connected we get into a catch-22 that eventually fails, and the system locks up. Fix this issue by taking a module reference for every connected controller (which is what the core layer did to the transport module). Reference is cleared when the controller is removed. Acked-by: Himanshu Madhani Reviewed-by: Christoph Hellwig Signed-off-by: James Smart Signed-off-by: Keith Busch commit 24ee25a6da84d83a25d93af52b5fef7407030b20 Merge: 64d6a12094f3 9eff303725da Author: Linus Torvalds Date: Tue Nov 26 09:48:19 2019 -0800 Merge branch 'x86-kdump-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 kdump updates from Ingo Molnar: "This solves a kdump artifact where encrypted memory contents are dumped, instead of unencrypted ones. The solution also happens to simplify the kdump code, to everyone's delight" * 'x86-kdump-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/crash: Align function arguments on opening braces x86/kdump: Remove the backup region handling x86/kdump: Always reserve the low 1M when the crashkernel option is specified x86/crash: Add a forward declaration of struct kimage commit 64d6a12094f35d644540c15440874723b1887f9d Merge: cd4771f77092 4df4cb9e99f8 Author: Linus Torvalds Date: Tue Nov 26 09:43:34 2019 -0800 Merge branch 'x86-hyperv-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 hyperv updates from Ingo Molnar: "Misc updates to the hyperv guest code: - Rework clockevents initialization to better support hibernation - Allow guests to enable InvariantTSC - Micro-optimize send_ipi_one" * 'x86-hyperv-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/hyperv: Initialize clockevents earlier in CPU onlining x86/hyperv: Allow guests to enable InvariantTSC x86/hyperv: Micro-optimize send_ipi_one() commit 88cfd30e188fcf6fd8304586c936a6f22fb665e5 Author: Johannes Thumshirn Date: Tue Nov 26 09:28:47 2019 -0800 iomap: remove unneeded variable in iomap_dio_rw() The 'start' variable indicates the start of a filemap and is set to the iocb's position, which we have already cached as 'pos', upon function entry. 'pos' is used as a cursor indicating the current position and updated later in iomap_dio_rw(), but not before the last use of 'start'. Remove 'start' as it's synonym for 'pos' before we're entering the loop calling iomapp_apply(). Signed-off-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit f550ee9b85fd47f85e31965b908a7c1044c531aa Author: Jan Kara Date: Tue Nov 26 09:28:47 2019 -0800 iomap: Do not create fake iter in iomap_dio_bio_actor() iomap_dio_bio_actor() copies iter to a local variable and then limits it to a file extent we have mapped. When IO is submitted, iomap_dio_bio_actor() advances the original iter while the copied iter is advanced inside bio_iov_iter_get_pages(). This logic is non-obvious especially because both iters still point to same shared structures (such as pipe info) so if iov_iter_advance() changes anything in the shared structure, this scheme breaks. Let's just truncate and reexpand the original iter as needed instead of playing games with copying iters and keeping them in sync. Signed-off-by: Jan Kara Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit cd4771f7709211082cbc41dc1f5b2be774ef1604 Merge: a25bbc2644f0 f53e2cd0b8ab Author: Linus Torvalds Date: Tue Nov 26 09:25:36 2019 -0800 Merge branch 'x86-entry-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 syscall entry updates from Ingo Molnar: "These changes relate to the preparatory cleanup of syscall function type signatures - to fix indirect call mismatches with Control-Flow Integrity (CFI) checking. No change in behavior intended" * 'x86-entry-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Use the correct function type for native_set_fixmap() syscalls/x86: Fix function types in COND_SYSCALL syscalls/x86: Use the correct function type for sys_ni_syscall syscalls/x86: Use COMPAT_SYSCALL_DEFINE0 for IA32 (rt_)sigreturn syscalls/x86: Wire up COMPAT_SYSCALL_DEFINE0 syscalls/x86: Use the correct function type in SYSCALL_DEFINE0 commit c38402fe6c4dbb235bef405209c2195ee9cd679c Author: Timothy Pearson Date: Sun Nov 24 13:15:16 2019 -0600 amdgpu: Enable KFD on POWER systems KFD has been verified to function on POWER systems (Talos II / Vega 64). It should be available as a kernel configuration option on these systems. Signed-off-by: Timothy Pearson Signed-off-by: Alex Deucher commit 29a39c90baaa1d8f28123932d3ea1bbe7c22f325 Author: Felix Kuehling Date: Mon Jul 15 16:18:03 2019 -0400 drm/amdgpu: Optimize KFD page table reservation Be less pessimistic about estimated page table use for KFD. Most allocations use 2MB pages and therefore need less VRAM for page tables. This allows more VRAM to be used for applications especially on large systems with many GPUs and hundreds of GB of system memory. Example: 8 GPUs with 32GB VRAM each + 256GB system memory = 512GB Old page table reservation per GPU: 1GB New page table reservation per GPU: 32MB Signed-off-by: Felix Kuehling Reviewed-by: xinhui pan Signed-off-by: Alex Deucher commit dea8b900293df57b6545bc195b50bbb649fe9741 Author: Alex Deucher Date: Mon Nov 25 11:11:18 2019 -0500 drm/amdgpu: flag vram lost on baco reset for VI/CIK VI/CIK BACO was inflight when this fix landed for SOC15/NV. Add the fix to VI/CIK as well. Acked-by: Evan Quan Acked-by: Christian König Signed-off-by: Alex Deucher commit a0c2a84ddaf176425d2e0285ae46d4b6057d047d Author: Alex Deucher Date: Fri Nov 22 14:16:55 2019 -0500 MAINTAINERS: Drop Rex Zhu for amdgpu powerplay No longer works on the driver. Reviewed-by: Christian König Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 5985ebbe78bba0058429c1482442aa64d14c1ce2 Author: John Clements Date: Mon Nov 25 18:24:17 2019 +0800 drm/amdgpu: Resolved offchip EEPROM I/O issue Updated target I2C address Reviewed-by: Hawking Zhang Signed-off-by: John Clements Signed-off-by: Alex Deucher commit 946621691f9919c263b4679b77f81f06019d3636 Author: Alex Deucher Date: Tue Nov 19 15:54:17 2019 -0500 drm/amd/display: add default clocks if not able to fetch them dm_pp_get_clock_levels_by_type needs to add the default clocks to the powerplay case as well. This was accidently dropped. Fixes: b3ea88fef321de ("drm/amd/powerplay: add get_clock_by_type interface for display") Bug: https://gitlab.freedesktop.org/drm/amd/issues/906 Reviewed-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 52e6d8ed16fdf9f1d2923a2b036222a5ac834b1d Author: Israel Rukshin Date: Sun Nov 24 18:38:32 2019 +0200 nvmet-loop: Avoid preallocating big SGL for data nvme_loop_create_io_queues() preallocates a big buffer for the IO SGL based on SG_CHUNK_SIZE. Modern DMA engines are often capable of dealing with very big segments so the SG_CHUNK_SIZE is often too big. SG_CHUNK_SIZE results in a static 4KB SGL allocation per command. If a controller has lots of deep queues, preallocation for the sg list can consume substantial amounts of memory. For nvmet-loop, nr_hw_queues can be 128 and each queue's depth 128. This means the resulting preallocation for the data SGL is 128*128*4K = 64MB per controller. Switch to runtime allocation for SGL for lists longer than 2 entries. This is the approach used by NVMe PCI so it should be reasonable for NVMeOF as well. Runtime SGL allocation has always been the case for the legacy I/O path so this is nothing new. Tested-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Max Gurtovoy Signed-off-by: Israel Rukshin Signed-off-by: Keith Busch commit b1ae1a238900474a9f51431c0f7f169ade1faa19 Author: Israel Rukshin Date: Sun Nov 24 18:38:31 2019 +0200 nvme-fc: Avoid preallocating big SGL for data nvme_fc_create_io_queues() preallocates a big buffer for the IO SGL based on SG_CHUNK_SIZE. Modern DMA engines are often capable of dealing with very big segments so the SG_CHUNK_SIZE is often too big. SG_CHUNK_SIZE results in a static 4KB SGL allocation per command. If a controller has lots of deep queues, preallocation for the sg list can consume substantial amounts of memory. For nvme-fc, nr_hw_queues can be 128 and each queue's depth 128. This means the resulting preallocation for the data SGL is 128*128*4K = 64MB per controller. Switch to runtime allocation for SGL for lists longer than 2 entries. This is the approach used by NVMe PCI so it should be reasonable for NVMeOF as well. Runtime SGL allocation has always been the case for the legacy I/O path so this is nothing new. Reviewed-by: Max Gurtovoy Reviewed-by: James Smart Signed-off-by: Israel Rukshin Signed-off-by: Keith Busch commit 38e1800275d3af607e4df92ff49dc2cf442586a4 Author: Israel Rukshin Date: Sun Nov 24 18:38:30 2019 +0200 nvme-rdma: Avoid preallocating big SGL for data nvme_rdma_alloc_tagset() preallocates a big buffer for the IO SGL based on SG_CHUNK_SIZE. Modern DMA engines are often capable of dealing with very big segments so the SG_CHUNK_SIZE is often too big. SG_CHUNK_SIZE results in a static 4KB SGL allocation per command. If a controller has lots of deep queues, preallocation for the sg list can consume substantial amounts of memory. For nvme-rdma, nr_hw_queues can be 128 and each queue's depth 128. This means the resulting preallocation for the data SGL is 128*128*4K = 64MB per controller. Switch to runtime allocation for SGL for lists longer than 2 entries. This is the approach used by NVMe PCI so it should be reasonable for NVMeOF as well. Runtime SGL allocation has always been the case for the legacy I/O path so this is nothing new. The preallocated small SGL depends on SG_CHAIN so if the ARCH doesn't support SG_CHAIN, use only runtime allocation for the SGL. We didn't notice of a performance degradation, since for small IOs we'll use the inline SG and for the bigger IOs the allocation of a bigger SGL from slab is fast enough. Suggested-by: Christoph Hellwig Reviewed-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Israel Rukshin Signed-off-by: Keith Busch commit a25bbc2644f01a9e680af4f760b54bd4834fdfec Merge: 85fbf15bc9ac db8c33f8b5be 446e693ca30b Author: Linus Torvalds Date: Tue Nov 26 08:58:08 2019 -0800 Merge branches 'x86-cpu-for-linus' and 'x86-fpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu and fpu updates from Ingo Molnar: - math-emu fixes - CPUID updates - sanity-check RDRAND output to see whether the CPU at least pretends to produce random data - various unaligned-access across cachelines fixes in preparation of hardware level split-lock detection - fix MAXSMP constraints to not allow !CPUMASK_OFFSTACK kernels with larger than 512 NR_CPUS - misc FPU related cleanups * 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Align the x86_capability array to size of unsigned long x86/cpu: Align cpu_caps_cleared and cpu_caps_set to unsigned long x86/umip: Make the comments vendor-agnostic x86/Kconfig: Rename UMIP config parameter x86/Kconfig: Enforce limit of 512 CPUs with MAXSMP and no CPUMASK_OFFSTACK x86/cpufeatures: Add feature bit RDPRU on AMD x86/math-emu: Limit MATH_EMULATION to 486SX compatibles x86/math-emu: Check __copy_from_user() result x86/rdrand: Sanity-check RDRAND output * 'x86-fpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Use XFEATURE_FP/SSE enum values instead of hardcoded numbers x86/fpu: Shrink space allocated for xstate_comp_offsets x86/fpu: Update stale variable name in comment commit 85fbf15bc9ac458f014fe70b38fa5773ee6aca9d Merge: fd2615908dfd b3c72fc9a78e Author: Linus Torvalds Date: Tue Nov 26 08:40:20 2019 -0800 Merge branch 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Ingo Molnar: "The main changes were: - Extend the boot protocol to allow future extensions without hitting the setup_header size limit. - Add quirk to devicetree systems to disable the RTC unless it's listed as a supported device. - Fix ld.lld linker pedantry" * 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Introduce setup_indirect x86/boot: Introduce kernel_info.setup_type_max x86/boot: Introduce kernel_info x86/init: Allow DT configured systems to disable RTC at boot time x86/realmode: Explicitly set entry point via ENTRY in linker script commit fd2615908dfd0586ea40692a99c44e34b7e869bc Merge: be2eca94d144 700c1018b86d b41d62201b97 2579a4eefc04 Author: Linus Torvalds Date: Tue Nov 26 08:21:54 2019 -0800 Merge branches 'core-objtool-for-linus', 'x86-cleanups-for-linus' and 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 objtool, cleanup, and apic updates from Ingo Molnar: "Objtool: - Fix a gawk 5.0 incompatibility in gen-insn-attr-x86.awk. Most distros are still on gawk 4.2.x. Cleanup: - Misc cleanups, plus the removal of obsolete code such as Calgary IOMMU support, which code hasn't seen any real testing in a long time and there's no known users left. apic: - Two changes: a cleanup and a fix for an (old) race for oneshot threaded IRQ handlers" * 'core-objtool-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/insn: Fix awk regexp warnings * 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86: Remove unused asm/rio.h x86: Fix typos in comments x86/pci: Remove #ifdef __KERNEL__ guard from x86/pci: Remove pci_64.h x86: Remove the calgary IOMMU driver x86/apic, x86/uprobes: Correct parameter names in kernel-doc comments x86/kdump: Remove the unused crash_copy_backup_region() x86/nmi: Remove stale EDAC include leftover * 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/ioapic: Rename misnamed functions x86/ioapic: Prevent inconsistent state when moving an interrupt commit 8218df93b7c4b1c6d02c4f726029e10efa4b7ca2 Author: Alex Deucher Date: Fri Nov 22 16:43:53 2019 -0500 ALSA: hda/hdmi - enable automatic runtime pm for AMD HDMI codecs by default So that we can power down the GPU and audio to save power. Reviewed-by: Takashi Iwai Acked-by: Evan Quan Signed-off-by: Alex Deucher Link: https://lore.kernel.org/r/20191122214353.582899-5-alexander.deucher@amd.com Signed-off-by: Takashi Iwai commit 73b1422bdfbb379332b2a5529148cda58e84315a Author: Alex Deucher Date: Fri Nov 22 16:43:52 2019 -0500 ALSA: hda/hdmi - enable runtime pm for newer AMD display audio We are able to power down the GPU and audio via the GPU driver so flag these asics as supporting runtime pm. Reviewed-by: Takashi Iwai Acked-by: Evan Quan Signed-off-by: Alex Deucher Link: https://lore.kernel.org/r/20191122214353.582899-4-alexander.deucher@amd.com Signed-off-by: Takashi Iwai commit 8d68a87244a812323ce3f7d5022f9deda9db54b5 Author: Alex Deucher Date: Fri Nov 22 16:43:51 2019 -0500 ALSA: hda/hdmi - Add new pci ids for AMD GPU display audio These are needed so we can enable runtime pm in a subsequent patch. Reviewed-by: Takashi Iwai Signed-off-by: Alex Deucher Link: https://lore.kernel.org/r/20191122214353.582899-3-alexander.deucher@amd.com Signed-off-by: Takashi Iwai commit 586bc4aab878efcf672536f0cdec3d04b6990c94 Author: Alex Deucher Date: Fri Nov 22 16:43:50 2019 -0500 ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD Only enable the vga_switcheroo logic on systems with the ATPX ACPI method. This logic is not needed for asics that are not part of a PX (PowerXpress)/HG (Hybrid Graphics) platform. Reviewed-by: Takashi Iwai Acked-by: Evan Quan Signed-off-by: Alex Deucher Link: https://lore.kernel.org/r/20191122214353.582899-2-alexander.deucher@amd.com Signed-off-by: Takashi Iwai commit 484e0d2b11e1fdd0d17702b282eb2ed56148385f Author: Diego Calleja Date: Tue Nov 26 14:00:31 2019 +0200 dm: add dm-clone to the documentation index Fixes: 7431b7835f554 ("dm: add clone target") Signed-off-by: Diego Calleja Signed-off-by: Nikos Tsironis Signed-off-by: Mike Snitzer commit dbaf971c9cdf10843071a60dcafc1aaab3162354 Author: Mike Snitzer Date: Tue Nov 26 10:08:29 2019 -0500 dm mpath: remove harmful bio-based optimization Removes the branching for edge-case where no SCSI device handler exists. The __map_bio_fast() method was far too limited, by only selecting a new pathgroup or path IFF there was a path failure, fix this be eliminating it in favor of __map_bio(). __map_bio()'s extra SCSI device handler specific MPATHF_PG_INIT_REQUIRED test is not in the fast path anyway. This change restores full path selector functionality for bio-based configurations that don't haave a SCSI device handler. But it should be noted that the path selectors do have an impact on performance for certain networks that are extremely fast (and don't require frequent switching). Fixes: 8d47e65948dd ("dm mpath: remove unnecessary NVMe branching in favor of scsi_dh checks") Cc: stable@vger.kernel.org Reported-by: Drew Hastings Suggested-by: Martin Wilck Signed-off-by: Mike Snitzer commit 7b65e2034fde011d090d4ec472902b71129c6cbd Author: Jiri Olsa Date: Tue Nov 26 13:12:53 2019 +0100 perf tools: Allow to link with libbpf dynamicaly Currently we support only static linking with kernel's libbpf (tools/lib/bpf). This patch adds libbpf package detection and support to link perf with it dynamically. The libbpf package status is displayed with: $ make VF=1 Auto-detecting system features: ... ... libbpf: [ on ] It's not checked by default, because it's quite new. Once it's on most distros we can switch it on. For the same reason it's not added to the test-all check. Perf does not need advanced version of libbpf, so we can check just for the base bpf_object__open function. Adding new compile variable to detect libbpf package and link bpf dynamically: $ make LIBBPF_DYNAMIC=1 ... LINK perf $ ldd perf | grep bpf libbpf.so.0 => /lib64/libbpf.so.0 (0x00007f46818bc000) If libbpf is not installed, build stops with: Makefile.config:486: *** Error: No libbpf devel library found,\ please install libbpf-devel. Stop. Committer testing: $ make LIBBPF_DYNAMIC=1 -C tools/perf O=/tmp/build/perf make: Entering directory '/home/acme/git/perf/tools/perf' BUILD: Doing 'make -j8' parallel build Makefile.config:493: *** Error: No libbpf devel library found, please install libbpf-devel. Stop. make[1]: *** [Makefile.perf:225: sub-make] Error 2 make: *** [Makefile:70: all] Error 2 make: Leaving directory '/home/acme/git/perf/tools/perf' $ Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Toke Høiland-Jørgensen Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Jesper Dangaard Brouer Cc: Martin KaFai Lau Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Yonghong Song Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Link: http://lore.kernel.org/lkml/20191126121253.28253-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a5732681e0e6ea0c3024f9d23bcf99b9237189ee Author: Arnaldo Carvalho de Melo Date: Mon Nov 25 22:33:02 2019 -0300 perf tests: Rename tests/map_groups.c to tests/maps.c One more step in mergint the maps and map_groups structs. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-bw6aagubqxc47m54k2maezfu@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 6d38267cf996bafdbc99eda6ad8c406fc3dcec93 Author: Arnaldo Carvalho de Melo Date: Mon Nov 25 22:29:18 2019 -0300 perf tests: Rename thread-mg-share to thread-maps-share One more step in merging 'struct maps' with 'struct map_groups'. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-naxsl3g4ou3fyxb8l8e0pn5e@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c54d241b35c57d19e798e0381dc4838d7447214b Author: Arnaldo Carvalho de Melo Date: Mon Nov 25 22:24:10 2019 -0300 perf maps: Rename map_groups.h to maps.h One more step in the merge of 'struct maps' with 'struct map_groups'. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-9ibtn3vua76f934t7woyf26w@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 9a29ceee6bb14aeb58ab2222c8e792576fe90fb8 Author: Arnaldo Carvalho de Melo Date: Mon Nov 25 22:21:28 2019 -0300 perf maps: Rename 'mg' variables to 'maps' Continuing the merge of 'struct maps' with 'struct map_groups'. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-z8d14wrw393a0fbvmnk1bqd9@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f2eaea09d684177f57db55a9ce2b67d048083fd5 Author: Arnaldo Carvalho de Melo Date: Mon Nov 25 22:15:35 2019 -0300 perf map_symbol: Rename ms->mg to ms->maps One more step on the merge of 'struct maps' with 'struct map_groups'. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-61rra2wg392rhvdgw421wzpt@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 694520dfeb474619402620b68edf08e60ca36a17 Author: Arnaldo Carvalho de Melo Date: Mon Nov 25 22:11:20 2019 -0300 perf addr_location: Rename al->mg to al->maps One more step on the merge of 'struct maps' with 'struct map_groups'. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-foo95pyyp3bhocbt7yd8qrvq@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit fe87797dea79b59e97a4ea67441bf91f2905bf23 Author: Arnaldo Carvalho de Melo Date: Mon Nov 25 22:07:43 2019 -0300 perf thread: Rename thread->mg to thread->maps One more step on the merge of 'struct maps' with 'struct map_groups'. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-69vcr8pubpym90skxhmbwhiw@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 79b6bb73f888933cbcd20b0ef3976cde67951b72 Author: Arnaldo Carvalho de Melo Date: Mon Nov 25 21:58:33 2019 -0300 perf maps: Merge 'struct maps' with 'struct map_groups' And pick the shortest name: 'struct maps'. The split existed because we used to have two groups of maps, one for functions and one for variables, but that only complicated things, sometimes we needed to figure out what was at some address and then had to first try it on the functions group and if that failed, fall back to the variables one. That split is long gone, so for quite a while we had only one struct maps per struct map_groups, simplify things by combining those structs. First patch is the minimum needed to merge both, follow up patches will rename 'thread->mg' to 'thread->maps', etc. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-hom6639ro7020o708trhxh59@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 9adab0348803e4b0522d8d9f73c9a18134f12381 Author: Adrian Hunter Date: Mon Nov 25 14:50:43 2019 +0200 x86/insn: perf tools: Add some more instructions to the new instructions test Add to the "x86 instruction decoder - new instructions" test the following instructions: v4fmaddps v4fmaddss v4fnmaddps v4fnmaddss vaesdec vaesdeclast vaesenc vaesenclast vcvtne2ps2bf16 vcvtneps2bf16 vdpbf16ps gf2p8affineinvqb vgf2p8affineinvqb gf2p8affineqb vgf2p8affineqb gf2p8mulb vgf2p8mulb vp2intersectd vp2intersectq vp4dpwssd vp4dpwssds vpclmulqdq vpcompressb vpcompressw vpdpbusd vpdpbusds vpdpwssd vpdpwssds vpexpandb vpexpandw vpopcntb vpopcntd vpopcntq vpopcntw vpshldd vpshldq vpshldvd vpshldvq vpshldvw vpshldw vpshrdd vpshrdq vpshrdvd vpshrdvq vpshrdvw vpshrdw vpshufbitqmb For information about the instructions, refer Intel SDM May 2019 (325462-070US) and Intel Architecture Instruction Set Extensions May 2019 (319433-037). Committer testing: $ perf test x86 61: x86 rdpmc : Ok 64: x86 instruction decoder - new instructions : Ok 66: x86 bp modify : Ok $ Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Acked-by: Masami Hiramatsu Cc: Andi Kleen Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yu-cheng Yu Cc: x86@kernel.org Link: http://lore.kernel.org/lkml/20191125125044.31879-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit af4933c121a9721bc9d2d048ac99b587b6c8d26c Author: Adrian Hunter Date: Mon Nov 25 14:50:44 2019 +0200 x86/insn: Add some more Intel instructions to the opcode map Add to the opcode map the following instructions: v4fmaddps v4fmaddss v4fnmaddps v4fnmaddss vaesdec vaesdeclast vaesenc vaesenclast vcvtne2ps2bf16 vcvtneps2bf16 vdpbf16ps gf2p8affineinvqb vgf2p8affineinvqb gf2p8affineqb vgf2p8affineqb gf2p8mulb vgf2p8mulb vp2intersectd vp2intersectq vp4dpwssd vp4dpwssds vpclmulqdq vpcompressb vpcompressw vpdpbusd vpdpbusds vpdpwssd vpdpwssds vpexpandb vpexpandw vpopcntb vpopcntd vpopcntq vpopcntw vpshldd vpshldq vpshldvd vpshldvq vpshldvw vpshldw vpshrdd vpshrdq vpshrdvd vpshrdvq vpshrdvw vpshrdw vpshufbitqmb For information about the instructions, refer Intel SDM May 2019 (325462-070US) and Intel Architecture Instruction Set Extensions May 2019 (319433-037). The instruction decoding can be tested using the perf tools' "x86 instruction decoder - new instructions" test e.g. $ perf test -v "new " 2>&1 | grep -i 'v4fmaddps' Decoded ok: 62 f2 7f 48 9a 20 v4fmaddps (%eax),%zmm0,%zmm4 Decoded ok: 62 f2 7f 48 9a a4 c8 78 56 34 12 v4fmaddps 0x12345678(%eax,%ecx,8),%zmm0,%zmm4 Decoded ok: 62 f2 7f 48 9a 20 v4fmaddps (%rax),%zmm0,%zmm4 Decoded ok: 67 62 f2 7f 48 9a 20 v4fmaddps (%eax),%zmm0,%zmm4 Decoded ok: 62 f2 7f 48 9a a4 c8 78 56 34 12 v4fmaddps 0x12345678(%rax,%rcx,8),%zmm0,%zmm4 Decoded ok: 67 62 f2 7f 48 9a a4 c8 78 56 34 12 v4fmaddps 0x12345678(%eax,%ecx,8),%zmm0,%zmm4 Signed-off-by: Adrian Hunter Acked-by: Masami Hiramatsu Cc: Andi Kleen Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yu-cheng Yu Cc: x86@kernel.org Link: http://lore.kernel.org/lkml/20191125125044.31879-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a82f15e39a4b75482d48d0910f6abe5e4f869b76 Author: Arnaldo Carvalho de Melo Date: Mon Nov 25 10:42:38 2019 -0300 perf map: Remove unused functions At some point those stopped being used, prune them. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-p2k98mj3ff2uk1z95sbl5r6e@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 805fcbc4fb669036e0137c9a655c8bf0dd08cb5b Author: Arnaldo Carvalho de Melo Date: Fri Nov 22 12:48:24 2019 -0300 perf map: Remove needless struct forward declarations At some point we may have needed that, not anymore. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-hnao13231bsl7xml5wn8h4iu@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 40df3897f0867f2e3700b4f216698288495053ef Author: Arnaldo Carvalho de Melo Date: Fri Nov 22 12:44:10 2019 -0300 perf map: Ditch leftover map__reloc_vmlinux() prototype In 39b12f781271 ("perf tools: Make it possible to read object code from vmlinux") the actual function was removed, but we forgot to remove the prototype, fix it. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-35yy50cgpcx8cjorluwd5j53@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 540a63ea30c86b2785769b9ae713efbfa7547fde Author: Arnaldo Carvalho de Melo Date: Fri Nov 22 12:39:06 2019 -0300 perf script: Move map__fprintf_srccode() to near its only user No need to have it elsewhere. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-8cw846pudpxo0xdkvi9qnvrh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 2ea352d5960ad469f5712cf3e293db97beac4e01 Merge: ceb9e77324fa be2eca94d144 Author: Arnaldo Carvalho de Melo Date: Tue Nov 26 11:06:19 2019 -0300 Merge remote-tracking branch 'torvalds/master' into perf/core To pick up BPF changes we'll need. Signed-off-by: Arnaldo Carvalho de Melo commit 0ca40f41d795fd91811e44506bb73d0b9ca33bdd Merge: 3e84a18a259e dca6b3733a4a Author: Mauro Carvalho Chehab Date: Tue Nov 26 14:37:47 2019 +0100 Merge branch 'patchwork' into v4l_for_linus * patchwork: (360 commits) media: Revert "media: mtk-vcodec: Remove extra area allocation in an input buffer on encoding" media: hantro: Set H264 FIELDPIC_FLAG_E flag correctly media: hantro: Remove now unused H264 pic_size media: hantro: Use output buffer width and height for H264 decoding media: hantro: Reduce H264 extra space for motion vectors media: hantro: Fix H264 motion vector buffer offset media: ti-vpe: vpe: fix compatible to match bindings media: dt-bindings: media: ti-vpe: Document VPE driver media: zr364xx: remove redundant assigmnent to idx, clean up code media: Documentation: media: *_DEFAULT targets for subdevs media: hantro: Fix s_fmt for dynamic resolution changes media: i2c: Use the correct style for SPDX License Identifier media: siano: Use the correct style for SPDX License Identifier media: vicodec: media_device_cleanup was called too early media: vim2m: media_device_cleanup was called too early media: cedrus: Increase maximum supported size media: cedrus: Fix H264 4k support media: cedrus: Properly signal size in mode register media: v4l2-ctrl: Lock main_hdl on operations of requests_queued. media: si470x-i2c: add missed operations in remove ... commit 8305e90a894f82c278c17e51a28459deee78b263 Author: Wen Yang Date: Mon Nov 25 23:54:09 2019 +0800 firmware: arm_scmi: Avoid double free in error flow If device_register() fails, both put_device() and kfree() are called, ending with a double free of the scmi_dev. Calling kfree() is needed only when a failure happens between the allocation of the scmi_dev and its registration, so move it to there and remove it from the error flow. Fixes: 46edb8d1322c ("firmware: arm_scmi: provide the mandatory device release callback") Signed-off-by: Wen Yang Signed-off-by: Sudeep Holla commit 877b911a5ba0733f62239055ee869f2e117b57da Author: Dexuan Cui Date: Sun Nov 24 21:33:54 2019 -0800 PCI: hv: Avoid a kmemleak false positive caused by the hbus buffer With the recent 59bb47985c1d ("mm, sl[aou]b: guarantee natural alignment for kmalloc(power-of-two)"), kzalloc() is able to allocate a 4KB buffer that is guaranteed to be 4KB-aligned. Here the size and alignment of hbus is important because hbus's field retarget_msi_interrupt_params must not cross a 4KB page boundary. Here we prefer kzalloc to get_zeroed_page(), because a buffer allocated by the latter is not tracked and scanned by kmemleak, and hence kmemleak reports the pointer contained in the hbus buffer (i.e. the hpdev struct, which is created in new_pcichild_device() and is tracked by hbus->children) as memory leak (false positive). If the kernel doesn't have 59bb47985c1d, get_zeroed_page() *must* be used to allocate the hbus buffer and we can avoid the kmemleak false positive by using kmemleak_alloc() and kmemleak_free() to ask kmemleak to track and scan the hbus buffer. Reported-by: Lili Deng Signed-off-by: Dexuan Cui Signed-off-by: Lorenzo Pieralisi Reviewed-by: Michael Kelley commit 14ef39fddd2367523de25b87dccfe6422c3f3efa Author: Dexuan Cui Date: Sun Nov 24 21:33:53 2019 -0800 PCI: hv: Change pci_protocol_version to per-hbus A VM can have multiple Hyper-V hbus. It's incorrect to set the global variable 'pci_protocol_version' when *every* hbus is initialized in hv_pci_protocol_negotiation(). This is not an issue in practice since every hbus should have the same value of hbus->protocol_version, but we should make the variable per-hbus, so in case we have busses with different protocol versions, the driver can still work correctly. Signed-off-by: Dexuan Cui Signed-off-by: Lorenzo Pieralisi Reviewed-by: Michael Kelley commit ac82fc83270884adea31d9dec22db09392058bf7 Author: Dexuan Cui Date: Sun Nov 24 21:33:52 2019 -0800 PCI: hv: Add hibernation support Add suspend() and resume() functions so that Hyper-V virtual PCI devices are handled properly when the VM hibernates and resumes from hibernation. Note that the suspend() function must make sure there are no pending work items before calling vmbus_close(), since it runs in a process context as a callback in dpm_suspend(). When it starts to run, the channel callback hv_pci_onchannelcallback(), which runs in a tasklet context, can be still running concurrently and scheduling new work items onto hbus->wq in hv_pci_devices_present() and hv_pci_eject_device(), and the work item handlers can access the vmbus channel, which can be being closed by hv_pci_suspend(), e.g. the work item handler pci_devices_present_work() -> new_pcichild_device() writes to the vmbus channel. To eliminate the race, hv_pci_suspend() disables the channel callback tasklet, sets hbus->state to hv_pcibus_removing, and re-enables the tasklet. This way, when hv_pci_suspend() proceeds, it knows that no new work item can be scheduled, and then it flushes hbus->wq and safely closes the vmbus channel. Signed-off-by: Dexuan Cui Signed-off-by: Lorenzo Pieralisi Reviewed-by: Michael Kelley commit a8e37506e79a7a08d0ee217f389fa1710e7a2ea4 Author: Dexuan Cui Date: Sun Nov 24 21:33:51 2019 -0800 PCI: hv: Reorganize the code in preparation of hibernation There is no functional change. This is just preparatory for a later patch which adds the hibernation support for the pci-hyperv driver. Signed-off-by: Dexuan Cui Signed-off-by: Lorenzo Pieralisi Reviewed-by: Michael Kelley commit 782b59711e1561ee0da06bc478ca5e8249aa8d09 Merge: 995e2ef08280 0f1839d08887 Author: Rafael J. Wysocki Date: Tue Nov 26 10:31:02 2019 +0100 Merge branch 'acpi-mm' * acpi-mm: ACPI: HMAT: use %u instead of %d to print u32 values ACPI: NUMA: HMAT: fix a section mismatch ACPI: HMAT: don't mix pxm and nid when setting memory target processor_pxm ACPI: NUMA: HMAT: Register "soft reserved" memory as an "hmem" device ACPI: NUMA: HMAT: Register HMAT at device_initcall level device-dax: Add a driver for "hmem" devices dax: Fix alloc_dax_region() compile warning lib: Uplevel the pmem "region" ida to a global allocator x86/efi: Add efi_fake_mem support for EFI_MEMORY_SP arm/efi: EFI soft reservation to memblock x86/efi: EFI soft reservation to E820 enumeration efi: Common enable/disable infrastructure for EFI soft reservation x86/efi: Push EFI_MEMMAP check into leaf routines efi: Enumerate EFI_MEMORY_SP ACPI: NUMA: Establish a new drivers/acpi/numa/ directory commit 995e2ef08280dab8de6c517acd836613678fe2a3 Merge: 1fca7e0e6fe6 ae5e6c6439c3 cb0701acfa7e b5b42b24d783 2e127203d116 Author: Rafael J. Wysocki Date: Tue Nov 26 10:30:49 2019 +0100 Merge branches 'acpi-utils', 'acpi-platform', 'acpi-video' and 'acpi-doc' * acpi-utils: iommu/amd: Switch to use acpi_dev_hid_uid_match() mmc: sdhci-acpi: Switch to use acpi_dev_hid_uid_match() ACPI / LPSS: Switch to use acpi_dev_hid_uid_match() ACPI / utils: Introduce acpi_dev_hid_uid_match() helper ACPI / utils: Move acpi_dev_get_first_match_dev() under CONFIG_ACPI ACPI / utils: Describe function parameters in kernel-doc * acpi-platform: ACPI: platform: Unregister stale platform devices ACPI: Always build evged in * acpi-video: ACPI: video: update doc for acpi_video_bus_DOS() * acpi-doc: ACPI: Documentation: Minor spelling fix in namespace.rst commit 1fca7e0e6fe6804294f51991f2ea82432ea5ed1b Merge: 713608a30b0a 406857f773b0 6025e2fae3dd cefe6aac29ff e346d0cf2c0a Author: Rafael J. Wysocki Date: Tue Nov 26 10:30:12 2019 +0100 Merge branches 'acpi-ec', 'acpi-soc', 'acpi-pmic' and 'acpi-button' * acpi-ec: ACPI: EC: add support for hardware-reduced systems ACPI: EC: tweak naming in preparation for GpioInt support * acpi-soc: ACPI: LPSS: Add dmi quirk for skipping _DEP check for some device-links ACPI: LPSS: Add LNXVIDEO -> BYT I2C1 to lpss_device_links ACPI: LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links * acpi-pmic: ACPI / PMIC: Add Cherry Trail Crystal Cove PMIC OpRegion driver ACPI / PMIC: Add byt prefix to Crystal Cove PMIC OpRegion driver ACPI / PMIC: Do not register handlers for unhandled OpRegions * acpi-button: ACPI: button: Remove unused acpi_lid_notifier_[un]register() functions ACPI: button: Add DMI quirk for Asus T200TA ACPI: button: Add DMI quirk for Medion Akoya E2215T ACPI: button: Turn lid_blacklst DMI table into a generic quirk table ACPI: button: Allow disabling LID support with the lid_init_state module option ACPI: button: Refactor lid_init_state module parsing code commit 713608a30b0a5f5b0866a7c4f462e51b362ee06d Merge: b4447c0dcd0d c7ccf10bb92e Author: Rafael J. Wysocki Date: Tue Nov 26 10:29:54 2019 +0100 Merge branch 'acpica' * acpica: ACPICA: Update version to 20191018 ACPICA: debugger: remove leading whitespaces when converting a string to a buffer ACPICA: acpiexec: initialize all simple types and field units from user input ACPICA: debugger: add field unit support for acpi_db_get_next_token ACPICA: debugger: surround field unit output with braces '{' ACPICA: debugger: add command to dump all fields of particular subtype ACPICA: utilities: add flag to only display data when dumping buffers ACPICA: make acpi_load_table() return table index ACPICA: Add new external interface, acpi_unload_table() ACPICA: More Clang changes ACPICA: Win OSL: Replace get_tick_count with get_tick_count64 ACPICA: Results from Clang commit e350b60f4e0f089f585d738e27213c8133fe9093 Merge: 5a97aa5bbcc1 2079fe6ea8cb 1992b66d2f55 9581e24c3f00 Author: Rafael J. Wysocki Date: Tue Nov 26 10:28:34 2019 +0100 Merge branches 'pm-avs', 'pm-docs' and 'pm-tools' * pm-avs: ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition power: avs: smartreflex: Remove superfluous cast in debugfs_create_file() call * pm-docs: PM: Wrap documentation to fit in 80 columns * pm-tools: cpupower: ToDo: Update ToDo with ideas for per_cpu_schedule handling cpupower: mperf_monitor: Update cpupower to use the RDPRU instruction cpupower: mperf_monitor: Introduce per_cpu_schedule flag cpupower: Move needs_root variable into a sub-struct cpupower : Handle set and info subcommands correctly pm-graph info added to MAINTAINERS tools/power/cpupower: Fix initializer override in hsw_ext_cstates commit 5a97aa5bbcc1249df2a6fd5d32a477f6981ccba6 Merge: fa6a599eb34d 01ca4827a748 fe0c2baae0bd 16c71c511328 f84fdcbc8ec0 Author: Rafael J. Wysocki Date: Tue Nov 26 10:27:49 2019 +0100 Merge branches 'pm-sleep', 'pm-domains', 'pm-opp' and 'powercap' * pm-sleep: PM / wakeirq: remove unnecessary parentheses PM / core: Clean up some function headers in power.h PM / hibernate: memory_bm_find_bit(): Tighten node optimisation * pm-domains: PM / Domains: Convert to dev_to_genpd_safe() in genpd_syscore_switch() mmc: tmio: Avoid boilerplate code in ->runtime_suspend() PM / Domains: Implement the ->start() callback for genpd PM / Domains: Introduce dev_pm_domain_start() * pm-opp: PM / OPP: Support adjusting OPP voltages at runtime * powercap: powercap/intel_rapl: add support for Cometlake desktop powercap/intel_rapl: add support for CometLake Mobile commit fa6a599eb34dec23aadccda6e374cc3ec3e9b7ee Merge: c48b90f84a11 2b328421e4ed Author: Rafael J. Wysocki Date: Tue Nov 26 10:27:17 2019 +0100 Merge branch 'pm-devfreq' * pm-devfreq: (26 commits) PM / devfreq: tegra30: Tune up MCCPU boost-down coefficient PM / devfreq: tegra30: Support variable polling interval PM / devfreq: Add new interrupt_driven flag for governors PM / devfreq: tegra30: Use kHz units for dependency threshold PM / devfreq: tegra30: Disable consecutive interrupts when appropriate PM / devfreq: tegra30: Don't enable already enabled consecutive interrupts PM / devfreq: tegra30: Include appropriate header PM / devfreq: tegra30: Constify structs PM / devfreq: tegra30: Don't enable consecutive-down interrupt on startup PM / devfreq: tegra30: Reset boosting on startup PM / devfreq: tegra30: Move clk-notifier's registration to governor's start PM / devfreq: tegra30: Use CPUFreq notifier PM / devfreq: tegra30: Use kHz units uniformly in the code PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out PM / devfreq: tegra30: Drop write-barrier PM / devfreq: tegra30: Handle possible round-rate error PM / devfreq: tegra30: Keep interrupt disabled while governor is stopped PM / devfreq: tegra30: Change irq type to unsigned int PM / devfreq: exynos-ppmu: remove useless assignment PM / devfreq: Lock devfreq in trans_stat_show ... commit c48b90f84a11ddcd6fee133c4929d8da037667ac Merge: 62214039525a 46770be0cf94 Author: Rafael J. Wysocki Date: Tue Nov 26 10:27:01 2019 +0100 Merge branch 'pm-cpufreq' * pm-cpufreq: (23 commits) cpufreq: Register drivers only after CPU devices have been registered cpufreq: Add NULL checks to show() and store() methods of cpufreq cpufreq: intel_pstate: Fix plain int as pointer warning from sparse cpufreq: sun50i: Fix CPU speed bin detection cpufreq: powernv: fix stack bloat and hard limit on number of CPUs cpufreq: Clarify the comment in cpufreq_set_policy() cpufreq: vexpress-spc: find and skip duplicates when merging frequencies cpufreq: vexpress-spc: use macros instead of hardcoded values for cluster ids cpufreq: s3c64xx: Remove pointless NULL check in s3c64xx_cpufreq_driver_init cpufreq: imx-cpufreq-dt: Correct i.MX8MN's default speed grade value cpufreq: vexpress-spc: fix some coding style issues cpufreq: vexpress-spc: remove lots of debug messages cpufreq: vexpress-spc: drop unnessary cpufreq_arm_bL_ops abstraction cpufreq: merge arm_big_little and vexpress-spc cpufreq: scpi: remove stale/outdated comment about the driver ARM: dts: Add OPP-V2 table for AM3517 cpufreq: ti-cpufreq: Add support for AM3517 ARM: dts: omap36xx: using OPP1G needs to control the abb_ldo cpufreq: ti-cpufreq: omap36xx use "cpu0","vbb" if run in multi_regulator mode ARM: dts: omap3: bulk convert compatible to be explicitly ti,omap3430 or ti,omap3630 or ti,am3517 ... commit 62214039525a621aa0eca3fe9160e809ec0e45d3 Merge: 05ff1ba412fd 5aa9ba6312e3 Author: Rafael J. Wysocki Date: Tue Nov 26 10:26:26 2019 +0100 Merge branch 'pm-cpuidle' * pm-cpuidle: cpuidle: Pass exit latency limit to cpuidle_use_deepest_state() cpuidle: Allow idle injection to apply exit latency limit cpuidle: Introduce cpuidle_driver_state_disabled() for driver quirks cpuidle: teo: Avoid code duplication in conditionals cpuidle: teo: Avoid using "early hits" incorrectly cpuidle: teo: Exclude cpuidle overhead from computations cpuidle: Use nanoseconds as the unit of time cpuidle: Consolidate disabled state checks ACPI: processor_idle: Skip dummy wait if kernel is in guest cpuidle: Do not unset the driver if it is there already cpuidle: teo: Fix "early hits" handling for disabled idle states cpuidle: teo: Consider hits and misses metrics of disabled states cpuidle: teo: Rename local variable in teo_select() cpuidle: teo: Ignore disabled idle states that are too deep commit 0725d9a31869e6c80630e99da366ede2848295cc Author: Chris Wilson Date: Mon Nov 18 23:02:40 2019 +0000 drm/i915/gt: Make intel_ring_unpin() safe for concurrent pint In order to avoid some nasty mutex inversions, commit 09c5ab384f6f ("drm/i915: Keep rings pinned while the context is active") allowed the intel_ring unpinning to be run concurrently with the next context pinning it. Thus each step in intel_ring_unpin() needed to be atomic and ordered in a nice onion with intel_ring_pin() so that the lifetimes overlapped and were always safe. Sadly, a few steps in intel_ring_unpin() were overlooked, such as closing the read/write pointers of the ring and discarding the intel_ring.vaddr, as these steps were not serialised with intel_ring_pin() and so could leave the ring in disarray. Fixes: 09c5ab384f6f ("drm/i915: Keep rings pinned while the context is active") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191118230254.2615942-6-chris@chris-wilson.co.uk (cherry picked from commit a266bf42006004306dd48a9082c35dfbff153307) Signed-off-by: Joonas Lahtinen commit be2eca94d144e3ffed565c483a58ecc76a869c98 Merge: a11b696975f2 8e6a5c833333 Author: Linus Torvalds Date: Mon Nov 25 21:41:48 2019 -0800 Merge tag 'for-linus-5.5-1' of git://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Some small fixes accumulated for IPMI, nothing major" * tag 'for-linus-5.5-1' of git://github.com/cminyard/linux-ipmi: ipmi: fix ipmb_poll()'s return type ipmi: kill off 'timespec' usage again drivers: ipmi: Support for both IPMB Req and Resp ipmi: Fix memory leak in __ipmi_bmc_register ipmi: bt-bmc: use devm_platform_ioremap_resource() to simplify code ipmi: use %*ph to print small buffer ipmi: Don't allow device module unload when in use commit a11b696975f257ad2410cbb26f288cc52724f81a Merge: ae2dc032773d ae24f2b6f828 Author: Linus Torvalds Date: Mon Nov 25 21:39:23 2019 -0800 Merge tag 'i3c/for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Boris Brezillon: "Minor fixes and MAINTAINERS updates" * tag 'i3c/for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: MAINTAINERS: add myself as maintainer of Cadence I3C master controller driver MAINTAINERS: Mark linux-i3c mailing list moderated i3c: Spelling s/dicovered/discovered/ i3c: master: use i3c_dev_get_master() commit ae2dc032773da914911f4e2a6075f31d1cbc9ca0 Merge: a86f69d33495 bd9d6e0371d1 Author: Linus Torvalds Date: Mon Nov 25 21:35:46 2019 -0800 Merge branch 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull pcmcia updates from Dominik Brodowski: "Just a few odd fixes and improvements to the PCMCIA core" * 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: pcmcia: remove unused dprintk definition pcmcia: include for pcmcia_parse_tuple pcmcia: include cs_internal.h for missing declarations pcmcia: Use dev_get_drvdata where possible pcmcia: clean an indentation issues, remove extraneous spaces commit a86f69d3349569a610eb9ff3b9e4bd1c40fe62f2 Merge: d873a0cd21db e2ce328b282d Author: Linus Torvalds Date: Mon Nov 25 21:32:37 2019 -0800 Merge tag 'spi-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "Lots of stuff going on in the core for SPI this time around, the two big changes both being around time in different forms: - A rework of delay times from Alexandru Ardelean which makes the ways in which they are specified more consistent between drivers so that what's available to clients is less dependent on the hardware implementation. - Support for PTP timestamping of transfers from Vladimir Oltean, useful for use with precision clocks with SPI control interfaces. - Big cleanups for the Atmel, PXA2xx and Zynq QSPI drivers" * tag 'spi-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (119 commits) dt-bindings: spi: Convert stm32 QSPI bindings to json-schema spi: pic32: Retire dma_request_slave_channel_compat() spi: Fix Kconfig indentation spi: mediatek: add SPI_CS_HIGH support spi: st-ssc4: add missed pm_runtime_disable spi: tegra20-slink: add missed clk_unprepare spi: tegra20-slink: Use dma_request_chan() directly for channel request spi: tegra114: Use dma_request_chan() directly for channel request spi: s3c64xx: Use dma_request_chan() directly for channel request spi: qup: Use dma_request_chan() directly for channel request spi: pl022: Use dma_request_chan() directly for channel request spi: imx: Use dma_request_chan() directly for channel request spi: fsl-lpspi: Use dma_request_chan() directly for channel request spi: atmel: Use dma_request_chan() directly for channel request spi: at91-usart: Use dma_request_chan() directly for channel request spi: fsl-cpm: Correct the free:ing spi: Fix regression to return zero on success instead of positive value spi: pxa2xx: Add missed security checks spi: nxp-fspi: Use devm API to fix missed unregistration of controller spi: omap2-mcspi: Remove redundant checks ... commit d873a0cd21dbe2502873feb4b12e3e0ee9a78ac9 Merge: 3b397c7ccafe a21da94f617b Author: Linus Torvalds Date: Mon Nov 25 21:11:55 2019 -0800 Merge tag 'regulator-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "Another fairly quiet release for the regulator API, some work all around including some core work but mostly in specialist or driver specific code: - Fix for powering off boot-on regulators - Enhancements to the coupled regulator support introduced in the last release - Conversion of a bunch of drivers to the fwnode API for GPIOs - Mode support for DA9062 - New device support for Qualcomm PM1650, PM8004 and PM895 and Silergy SR83X - Removal of obsolete AB8505 support" * tag 'regulator-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (49 commits) regulator: da9062: Return REGULATOR_MODE_INVALID for invalid mode regulator: Fix Kconfig indentation regulator: tps6105x: add optional devicetree support tps6105x: add optional devicetree support regulator: rn5t618: fix rc5t619 ldo10 enable regulator: vexpress: Use PTR_ERR_OR_ZERO() to simplify code dt-bindings: mfd: da9062: describe buck modes regulator: da9062: add of_map_mode support for bucks regulator: da9062: refactor buck modes into header regulator: stpmic1: Set a default ramp delay value regulator: core: Let boot-on regulators be powered off regulator: core: Don't try to remove device links if add failed regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id regulator: ab8500: Remove AB8505 USB regulator regulator: fan53555: add chip id for Silergy SYR83X regulator: fixed: add off-on-delay dt-bindings: regulator: fixed: add off-on-delay-us property regulator: core: Allow generic coupling only for always-on regulators regulator: core: Release coupled_rdevs on regulator_init_coupling() error regulator: bd70528: Add MODULE_ALIAS to allow module auto loading ... commit 3b397c7ccafe0624018cb09fc96729f8f6165573 Merge: 386403a115f9 a20db58f3e6e Author: Linus Torvalds Date: Mon Nov 25 21:10:05 2019 -0800 Merge tag 'regmap-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap update from Mark Brown: "Just one patch for this release removing some dead code" * tag 'regmap-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: regmap-w1: Drop unreachable code commit 386403a115f95997c2715691226e11a7b5cffcfd Merge: 642356cb5f4a 622dc5ad8052 Author: Linus Torvalds Date: Mon Nov 25 20:02:57 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from David Miller: "Another merge window, another pull full of stuff: 1) Support alternative names for network devices, from Jiri Pirko. 2) Introduce per-netns netdev notifiers, also from Jiri Pirko. 3) Support MSG_PEEK in vsock/virtio, from Matias Ezequiel Vara Larsen. 4) Allow compiling out the TLS TOE code, from Jakub Kicinski. 5) Add several new tracepoints to the kTLS code, also from Jakub. 6) Support set channels ethtool callback in ena driver, from Sameeh Jubran. 7) New SCTP events SCTP_ADDR_ADDED, SCTP_ADDR_REMOVED, SCTP_ADDR_MADE_PRIM, and SCTP_SEND_FAILED_EVENT. From Xin Long. 8) Add XDP support to mvneta driver, from Lorenzo Bianconi. 9) Lots of netfilter hw offload fixes, cleanups and enhancements, from Pablo Neira Ayuso. 10) PTP support for aquantia chips, from Egor Pomozov. 11) Add UDP segmentation offload support to igb, ixgbe, and i40e. From Josh Hunt. 12) Add smart nagle to tipc, from Jon Maloy. 13) Support L2 field rewrite by TC offloads in bnxt_en, from Venkat Duvvuru. 14) Add a flow mask cache to OVS, from Tonghao Zhang. 15) Add XDP support to ice driver, from Maciej Fijalkowski. 16) Add AF_XDP support to ice driver, from Krzysztof Kazimierczak. 17) Support UDP GSO offload in atlantic driver, from Igor Russkikh. 18) Support it in stmmac driver too, from Jose Abreu. 19) Support TIPC encryption and auth, from Tuong Lien. 20) Introduce BPF trampolines, from Alexei Starovoitov. 21) Make page_pool API more numa friendly, from Saeed Mahameed. 22) Introduce route hints to ipv4 and ipv6, from Paolo Abeni. 23) Add UDP segmentation offload to cxgb4, Rahul Lakkireddy" * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1857 commits) libbpf: Fix usage of u32 in userspace code mm: Implement no-MMU variant of vmalloc_user_node_flags slip: Fix use-after-free Read in slip_open net: dsa: sja1105: fix sja1105_parse_rgmii_delays() macvlan: schedule bc_work even if error enetc: add support Credit Based Shaper(CBS) for hardware offload net: phy: add helpers phy_(un)lock_mdio_bus mdio_bus: don't use managed reset-controller ax88179_178a: add ethtool_op_get_ts_info() mlxsw: spectrum_router: Fix use of uninitialized adjacency index mlxsw: spectrum_router: After underlay moves, demote conflicting tunnels bpf: Simplify __bpf_arch_text_poke poke type handling bpf: Introduce BPF_TRACE_x helper for the tracing tests bpf: Add bpf_jit_blinding_enabled for !CONFIG_BPF_JIT bpf, testing: Add various tail call test cases bpf, x86: Emit patchable direct jump as tail call bpf: Constant map key tracking for prog array pokes bpf: Add poke dependency tracking for prog array maps bpf: Add initial poke descriptor table for jit images bpf: Move owner type, jited info into array auxiliary data ... commit 642356cb5f4a8c82b5ca5ebac288c327d10df236 Merge: f838767555d4 4ee812f6143d Author: Linus Torvalds Date: Mon Nov 25 19:49:58 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Add library interfaces of certain crypto algorithms for WireGuard - Remove the obsolete ablkcipher and blkcipher interfaces - Move add_early_randomness() out of rng_mutex Algorithms: - Add blake2b shash algorithm - Add blake2s shash algorithm - Add curve25519 kpp algorithm - Implement 4 way interleave in arm64/gcm-ce - Implement ciphertext stealing in powerpc/spe-xts - Add Eric Biggers's scalar accelerated ChaCha code for ARM - Add accelerated 32r2 code from Zinc for MIPS - Add OpenSSL/CRYPTOGRAMS poly1305 implementation for ARM and MIPS Drivers: - Fix entropy reading failures in ks-sa - Add support for sam9x60 in atmel - Add crypto accelerator for amlogic GXL - Add sun8i-ce Crypto Engine - Add sun8i-ss cryptographic offloader - Add a host of algorithms to inside-secure - Add NPCM RNG driver - add HiSilicon HPRE accelerator - Add HiSilicon TRNG driver" * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (285 commits) crypto: vmx - Avoid weird build failures crypto: lib/chacha20poly1305 - use chacha20_crypt() crypto: x86/chacha - only unregister algorithms if registered crypto: chacha_generic - remove unnecessary setkey() functions crypto: amlogic - enable working on big endian kernel crypto: sun8i-ce - enable working on big endian crypto: mips/chacha - select CRYPTO_SKCIPHER, not CRYPTO_BLKCIPHER hwrng: ks-sa - Enable COMPILE_TEST crypto: essiv - remove redundant null pointer check before kfree crypto: atmel-aes - Change data type for "lastc" buffer crypto: atmel-tdes - Set the IV after {en,de}crypt crypto: sun4i-ss - fix big endian issues crypto: sun4i-ss - hide the Invalid keylen message crypto: sun4i-ss - use crypto_ahash_digestsize crypto: sun4i-ss - remove dependency on not 64BIT crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c MAINTAINERS: Add maintainer for HiSilicon SEC V2 driver crypto: hisilicon - add DebugFS for HiSilicon SEC Documentation: add DebugFS doc for HiSilicon SEC crypto: hisilicon - add SRIOV for HiSilicon SEC ... commit f838767555d40f29bc4771c5c8cc63193094b7cc Merge: 436b2a8039ac 0e672adc87e5 Author: Linus Torvalds Date: Mon Nov 25 19:43:48 2019 -0800 Merge tag 'livepatching-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching updates from Petr Mladek: - New API to track system state changes done be livepatch callbacks. It helps to maintain compatibility between livepatches. - Update Kconfig help text. ORC is another reliable unwinder. - Disable generic selftest timeout. Livepatch selftests have their own per-operation fine-grained timeouts. * tag 'livepatching-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: x86/stacktrace: update kconfig help text for reliable unwinders livepatch: Selftests of the API for tracking system state changes livepatch: Documentation of the new API for tracking system state changes livepatch: Allow to distinguish different version of system state changes livepatch: Basic API to track system state changes livepatch: Keep replaced patches until post_patch callback is called selftests/livepatch: Disable the timeout commit 436b2a8039ac00f8dc6ae8f3bd2be83748f72312 Merge: 1b96a41b4209 1d28122131b2 Author: Linus Torvalds Date: Mon Nov 25 19:40:40 2019 -0800 Merge tag 'printk-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk Pull printk updates from Petr Mladek: - Allow to print symbolic error names via new %pe modifier. - Use pr_warn() instead of the remaining pr_warning() calls. Fix formatting of the related lines. - Add VSPRINTF entry to MAINTAINERS. * tag 'printk-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk: (32 commits) checkpatch: don't warn about new vsprintf pointer extension '%pe' MAINTAINERS: Add VSPRINTF tools lib api: Renaming pr_warning to pr_warn ASoC: samsung: Use pr_warn instead of pr_warning lib: cpu_rmap: Use pr_warn instead of pr_warning trace: Use pr_warn instead of pr_warning dma-debug: Use pr_warn instead of pr_warning vgacon: Use pr_warn instead of pr_warning fs: afs: Use pr_warn instead of pr_warning sh/intc: Use pr_warn instead of pr_warning scsi: Use pr_warn instead of pr_warning platform/x86: intel_oaktrail: Use pr_warn instead of pr_warning platform/x86: asus-laptop: Use pr_warn instead of pr_warning platform/x86: eeepc-laptop: Use pr_warn instead of pr_warning oprofile: Use pr_warn instead of pr_warning of: Use pr_warn instead of pr_warning macintosh: Use pr_warn instead of pr_warning idsn: Use pr_warn instead of pr_warning ide: Use pr_warn instead of pr_warning crypto: n2: Use pr_warn instead of pr_warning ... commit 1b96a41b420972f8ba563373de8154d59d5b2208 Merge: 9391edee8667 40363cf13999 Author: Linus Torvalds Date: Mon Nov 25 19:23:46 2019 -0800 Merge branch 'for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: "There are several notable changes here: - Single thread migrating itself has been optimized so that it doesn't need threadgroup rwsem anymore. - Freezer optimization to avoid unnecessary frozen state changes. - cgroup ID unification so that cgroup fs ino is the only unique ID used for the cgroup and can be used to directly look up live cgroups through filehandle interface on 64bit ino archs. On 32bit archs, cgroup fs ino is still the only ID in use but it is only unique when combined with gen. - selftest and other changes" * 'for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (24 commits) writeback: fix -Wformat compilation warnings docs: cgroup: mm: Fix spelling of "list" cgroup: fix incorrect WARN_ON_ONCE() in cgroup_setup_root() cgroup: use cgrp->kn->id as the cgroup ID kernfs: use 64bit inos if ino_t is 64bit kernfs: implement custom exportfs ops and fid type kernfs: combine ino/id lookup functions into kernfs_find_and_get_node_by_id() kernfs: convert kernfs_node->id from union kernfs_node_id to u64 kernfs: kernfs_find_and_get_node_by_ino() should only look up activated nodes kernfs: use dumber locking for kernfs_find_and_get_node_by_ino() netprio: use css ID instead of cgroup ID writeback: use ino_t for inodes in tracepoints kernfs: fix ino wrap-around detection kselftests: cgroup: Avoid the reuse of fd after it is deallocated cgroup: freezer: don't change task and cgroups status unnecessarily cgroup: use cgroup->last_bstat instead of cgroup->bstat_pending for consistency cgroup: remove cgroup_enable_task_cg_lists() optimization cgroup: pids: use atomic64_t for pids->limit selftests: cgroup: Run test_core under interfering stress selftests: cgroup: Add task migration tests ... commit 9391edee8667733e22baa50d182191ba3a00d5e1 Merge: 0acefef58451 49e9d1a9faf2 Author: Linus Torvalds Date: Mon Nov 25 18:57:12 2019 -0800 Merge branch 'for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: "There have been sporadic reports of sanity checks in destroy_workqueue() failing spuriously over the years. This contains the fix and its follow-up changes / fixes. There's also a RCU annotation improvement" * 'for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Add RCU annotation for pwq list walk workqueue: Fix pwq ref leak in rescuer_thread() workqueue: more destroy_workqueue() fixes workqueue: Minor follow-ups to the rescuer destruction change workqueue: Fix missing kfree(rescuer) in destroy_workqueue() workqueue: Fix spurious sanity check failures in destroy_workqueue() commit 8042d6ce8c40df0abb0d91662a754d074a3d3f16 Author: Hrvoje Zeba Date: Mon Nov 25 14:40:22 2019 -0500 io_uring: remove superfluous check for sqe->off in io_accept() This field contains a pointer to addrlen and checking to see if it's set returns -EINVAL if the caller sets addr & addrlen pointers. Fixes: 17f2fe35d080 ("io_uring: add support for IORING_OP_ACCEPT") Signed-off-by: Hrvoje Zeba Signed-off-by: Jens Axboe commit 181e448d8709e517c9c7b523fcd209f24eb38ca7 Author: Jens Axboe Date: Mon Nov 25 08:52:30 2019 -0700 io_uring: async workers should inherit the user creds If we don't inherit the original task creds, then we can confuse users like fuse that pass creds in the request header. See link below on identical aio issue. Link: https://lore.kernel.org/linux-fsdevel/26f0d78e-99ca-2f1b-78b9-433088053a61@scylladb.com/T/#u Signed-off-by: Jens Axboe commit 576a347b7af8abfbddc80783fb6629c2894d036e Author: Jens Axboe Date: Mon Nov 25 08:49:20 2019 -0700 io-wq: have io_wq_create() take a 'data' argument We currently pass in 4 arguments outside of the bounded size. In preparation for adding one more argument, let's bundle them up in a struct to make it more readable. No functional changes in this patch. Signed-off-by: Jens Axboe commit 311ae9e159d81a1ec1cf645daf40b39ae5a0bd84 Author: Pavel Begunkov Date: Sun Nov 24 11:58:24 2019 +0300 io_uring: fix dead-hung for non-iter fixed rw Read/write requests to devices without implemented read/write_iter using fixed buffers can cause general protection fault, which totally hangs a machine. io_import_fixed() initialises iov_iter with bvec, but loop_rw_iter() accesses it as iovec, dereferencing random address. kmap() page by page in this case Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit f8e85cf255ad57d65eeb9a9d0e59e3dec55bdd9e Author: Jens Axboe Date: Sat Nov 23 14:24:24 2019 -0700 io_uring: add support for IORING_OP_CONNECT This allows an application to call connect() in an async fashion. Like other opcodes, we first try a non-blocking connect, then punt to async context if we have to. Note that we can still return -EINPROGRESS, and in that case the caller should use IORING_OP_POLL_ADD to do an async wait for completion of the connect request (just like for regular connect(2), except we can do it async here too). Signed-off-by: Jens Axboe commit bd3ded3146daa2cbb57ed353749ef99cf75371b0 Author: Jens Axboe Date: Sat Nov 23 14:17:16 2019 -0700 net: add __sys_connect_file() helper This is identical to __sys_connect(), except it takes a struct file instead of an fd, and it also allows passing in extra file->f_flags flags. The latter is done to support masking in O_NONBLOCK without manipulating the original file flags. No functional changes in this patch. Cc: netdev@vger.kernel.org Acked-by: David S. Miller Signed-off-by: Jens Axboe commit c4a2ed72c9a61594b6afc23e1fbc78878d32b5a3 Author: Jens Axboe Date: Thu Nov 21 21:01:26 2019 -0700 io_uring: only return -EBUSY for submit on non-flushed backlog We return -EBUSY on submit when we have a CQ ring overflow backlog, but that can be a bit problematic if the application is using pure userspace poll of the CQ ring. For that case, if the ring briefly overflowed and we have pending entries in the backlog, the submit flushes the backlog successfully but still returns -EBUSY. If we're able to fully flush the CQ ring backlog, let the submission proceed. Reported-by: Dan Melnic Signed-off-by: Jens Axboe commit f9bd67f69af56d712bfd498f5ad9cf7bb177d600 Author: Pavel Begunkov Date: Thu Nov 21 23:21:03 2019 +0300 io_uring: only !null ptr to io_issue_sqe() Pass only non-null @nxt to io_issue_sqe() and handle it at the caller's side. And propagate it. - kiocb_done() is only called from io_read() and io_write(), which are only called from io_issue_sqe(), so it's @nxt != NULL - io_put_req_find_next() is called either with explicitly non-null local nxt, or from one of the functions in io_issue_sqe() switch (or their callees). Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit b18fdf71e01fba29a804d63f8c1e2ed61011170d Author: Pavel Begunkov Date: Thu Nov 21 23:21:02 2019 +0300 io_uring: simplify io_req_link_next() "if (nxt)" is always true, as it was checked in the while's condition. io_wq_current_is_worker() is unnecessary, as non-async callers don't pass nxt, so io_queue_async_work() will be called for them anyway. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 944e58bfeda0e9b97cd611adafc823c78e0bc464 Author: Pavel Begunkov Date: Thu Nov 21 23:21:01 2019 +0300 io_uring: pass only !null to io_req_find_next() Make io_req_find_next() and io_req_link_next() to accept only non-null nxt, and handle it in callers. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 70cf9f3270a5c5148e93a526dc1e51965259e70c Author: Pavel Begunkov Date: Thu Nov 21 23:21:00 2019 +0300 io_uring: remove io_free_req_find_next() There is only one one-liner user of io_free_req_find_next(). Inline it. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 9835d6fafba58e6d9386a6d5af800789bdb52e5b Author: Pavel Begunkov Date: Thu Nov 21 21:24:56 2019 +0300 io_uring: add likely/unlikely in io_get_sqring() The number of SQEs to submit is specified by a user, so io_get_sqring() in most of the cases succeeds. Hint compilers about that. Checking ASM genereted by gcc 9.2.0 for x64, there is one branch misprediction. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d732447fed7d6b4c22907f630cd25d574bae5276 Author: Pavel Begunkov Date: Thu Nov 21 21:24:36 2019 +0300 io_uring: rename __io_submit_sqe() __io_submit_sqe() is issuing requests, so call it as such. Moreover, it ends by calling io_iopoll_req_issued(). Rename it and make terminology clearer. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 915967f69c591b34c5a18d6618af021a81ffd700 Author: Jens Axboe Date: Thu Nov 21 09:01:20 2019 -0700 io_uring: improve trace_io_uring_defer() trace point We don't have shadow requests anymore, so get rid of the shadow argument. Add the user_data argument, as that's often useful to easily match up requests, instead of having to look at request pointers. Signed-off-by: Jens Axboe commit 1b4a51b6d03d21f55effbcf609ba5526d87d9e9d Author: Pavel Begunkov Date: Thu Nov 21 11:54:28 2019 +0300 io_uring: drain next sqe instead of shadowing There's an issue with the shadow drain logic in that we drop the completion lock after deciding to defer a request, then re-grab it later and assume that the state is still the same. In the mean time, someone else completing a request could have found and issued it. This can cause a stall in the queue, by having a shadow request inserted that nobody is going to drain. Additionally, if we fail allocating the shadow request, we simply ignore the drain. Instead of using a shadow request, defer the next request/link instead. This also has the following advantages: - removes semi-duplicated code - doesn't allocate memory for shadows - works better if only the head marked for drain - doesn't need complex synchronisation On the flip side, it removes the shadow->seq == last_drain_in_in_link->seq optimization. That shouldn't be a common case, and can always be added back, if needed. Fixes: 4fe2c963154c ("io_uring: add support for link with drain") Cc: Jackie Liu Reported-by: Jens Axboe Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit b76da70fc3759df13e0991706451f1a2e06ba19e Author: Jens Axboe Date: Wed Nov 20 13:05:32 2019 -0700 io_uring: close lookup gap for dependent next work When we find new work to process within the work handler, we queue the linked timeout before we have issued the new work. This can be problematic for very short timeouts, as we have a window where the new work isn't visible. Allow the work handler to store a callback function for this in the work item, and flag it with IO_WQ_WORK_CB if the caller has done so. If that is set, then io-wq will call the callback when it has setup the new work item. Reported-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 4d7dd462971405c65bfb3821dbb6b9ce13b5e8d6 Author: Jens Axboe Date: Wed Nov 20 13:03:52 2019 -0700 io_uring: allow finding next link independent of req reference count We currently try and start the next link when we put the request, and only if we were going to free it. This means that the optimization to continue executing requests from the same context often fails, as we're not putting the final reference. Add REQ_F_LINK_NEXT to keep track of this, and allow io_uring to find the next request more efficiently. Signed-off-by: Jens Axboe commit eb065d301e8c83643367bdb0898becc364046bda Author: Jens Axboe Date: Wed Nov 20 09:26:29 2019 -0700 io_uring: io_allocate_scq_urings() should return a sane state We currently rely on the ring destroy on cleaning things up in case of failure, but io_allocate_scq_urings() can leave things half initialized if only parts of it fails. Be nice and return with either everything setup in success, or return an error with things nicely cleaned up. Reported-by: syzbot+0d818c0d39399188f393@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit bbad27b2f622fa26d107f8a72c0cd5cc102dc56e Author: Pavel Begunkov Date: Tue Nov 19 23:32:47 2019 +0300 io_uring: Always REQ_F_FREE_SQE for allocated sqe Always mark requests with allocated sqe and deallocate it in __io_free_req(). It's easier to follow and doesn't add edge cases. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 5d960724b0cb0d12469d1c62912e4a8c09c9fd92 Author: Jens Axboe Date: Tue Nov 19 15:31:28 2019 -0700 io_uring: io_fail_links() should only consider first linked timeout We currently clear the linked timeout field if we cancel such a timeout, but we should only attempt to cancel if it's the first one we see. Others should simply be freed like other requests, as they haven't been started yet. Signed-off-by: Jens Axboe commit 09fbb0a83ec6ab5a4037766261c031151985fff6 Author: Pavel Begunkov Date: Tue Nov 19 23:32:50 2019 +0300 io_uring: Fix leaking linked timeouts let have a dependant link: REQ -> LINK_TIMEOUT -> LINK_TIMEOUT 1. submission stage: submission references for REQ and LINK_TIMEOUT are dropped. So, references respectively (1,1,2) 2. io_put(REQ) + FAIL_LINKS stage: calls io_fail_links(), which for all linked timeouts will call cancel_timeout() and drop 1 reference. So, references after: (0,0,1). That's a leak. Make it treat only the first linked timeout as such, and pass others through __io_double_put_req(). Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit f70193d6d8cad4cc614223fef349e6ea9d48c61f Author: Pavel Begunkov Date: Tue Nov 19 23:32:49 2019 +0300 io_uring: remove redundant check Pass any IORING_OP_LINK_TIMEOUT request further, where it will eventually fail in io_issue_sqe(). Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d3b35796b1e3f118017491d621f624e0de7ff9fb Author: Pavel Begunkov Date: Tue Nov 19 23:32:48 2019 +0300 io_uring: break links for failed defer If io_req_defer() failed, it needs to cancel a dependant link. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit b2e9c7d64b7ecacc1d0f15a6af88a73cab7d8db9 Author: Dan Carpenter Date: Tue Nov 19 09:22:16 2019 +0300 io-wq: remove extra space characters These lines are indented an extra space character. Signed-off-by: Dan Carpenter Signed-off-by: Jens Axboe commit b60fda6000a99a7ccac36005ab78b14b47c06de3 Author: Jens Axboe Date: Tue Nov 19 08:37:07 2019 -0700 io-wq: wait for io_wq_create() to setup necessary workers We currently have a race where if setup is really slow, we can be calling io_wq_destroy() before we're done setting up. This will cause the caller to get stuck waiting for the manager to set things up, but the manager already exited. Fix this by doing a sync setup of the manager. This also fixes the case where if we failed creating workers, we'd also get stuck. In practice this race window was really small, as we already wait for the manager to start. Hence someone would have to call io_wq_destroy() after the task has started, but before it started the first loop. The reported test case forked tons of these, which is why it became an issue. Reported-by: syzbot+0f1cc17f85154f400465@syzkaller.appspotmail.com Fixes: 771b53d033e8 ("io-wq: small threadpool implementation for io_uring") Signed-off-by: Jens Axboe commit fba38c272a0385148935d6443cb9dc68cf1f37a7 Author: Jens Axboe Date: Mon Nov 18 12:27:57 2019 -0700 io_uring: request cancellations should break links We currently don't explicitly break links if a request is cancelled, but we should. Add explicitly link breakage for all types of request cancellations that we support. Signed-off-by: Jens Axboe commit b0dd8a412699afe3420a08f841333f3474ad45c5 Author: Jens Axboe Date: Mon Nov 18 12:14:54 2019 -0700 io_uring: correct poll cancel and linked timeout expiration completion Currently a poll request fills a completion entry of 0, even if it got cancelled. This is odd, and it makes it harder to support with chains. Ensure that it returns -ECANCELED in the completions events if it got cancelled, and furthermore ensure that the linked timeout that triggered it completes with -ETIME if we did indeed trigger the completions through a timeout. Signed-off-by: Jens Axboe commit e0e328c4b330712e45ba799dc589bda751323110 Author: Jens Axboe Date: Fri Nov 15 17:59:46 2019 -0700 io_uring: remove dead REQ_F_SEQ_PREV flag With the conversion to io-wq, we no longer use that flag. Kill it. Fixes: 561fb04a6a22 ("io_uring: replace workqueue usage with io-wq") Signed-off-by: Jens Axboe commit 94ae5e77a9150a8c6c57432e2db290c6868ddfad Author: Jens Axboe Date: Thu Nov 14 19:39:52 2019 -0700 io_uring: fix sequencing issues with linked timeouts We have an issue with timeout links that are deeper in the submit chain, because we only handle it upfront, not from later submissions. Move the prep + issue of the timeout link to the async work prep handler, and do it normally for non-async queue. If we validate and prepare the timeout links upfront when we first see them, there's nothing stopping us from supporting any sort of nesting. Fixes: 2665abfd757f ("io_uring: add support for linked SQE timeouts") Reported-by: Pavel Begunkov Signed-off-by: Jens Axboe commit ad8a48acc23cb13cbf4332ebabb867b1baa81842 Author: Jens Axboe Date: Fri Nov 15 08:49:11 2019 -0700 io_uring: make req->timeout be dynamically allocated There are a few reasons for this: - As a prep to improving the linked timeout logic - io_timeout is the biggest member in the io_kiocb opcode union This also enables a few cleanups, like unifying the timer setup between IORING_OP_TIMEOUT and IORING_OP_LINK_TIMEOUT, and not needing multiple arguments to the link/prep helpers. Signed-off-by: Jens Axboe commit 978db57e2c329fc612ff669cab9bf0007efd3ca3 Author: Jens Axboe Date: Thu Nov 14 22:39:04 2019 -0700 io_uring: make io_double_put_req() use normal completion path If we don't use the normal completion path, we may skip killing links that should be errored and freed. Add __io_double_put_req() for use within the completion path itself, other calls should just use io_double_put_req(). Signed-off-by: Jens Axboe commit 0e0702dac26b282603261f04a62711a2d9aac17b Author: Jens Axboe Date: Thu Nov 14 21:42:10 2019 -0700 io_uring: cleanup return values from the queueing functions __io_queue_sqe(), io_queue_sqe(), io_queue_link_head() all return 0/err, but the caller doesn't care since the errors are handled inline. Clean these up and just make them void. Signed-off-by: Jens Axboe commit 95a5bbae05ef1ec1cceb8c1b04a482aa0b7c177c Author: Jens Axboe Date: Thu Nov 14 22:40:44 2019 -0700 io_uring: io_async_cancel() should pass in 'nxt' request pointer If we have a linked request, this enables us to pass it back directly without having to go through async context. Signed-off-by: Jens Axboe commit 0acefef58451a995981e6d641220fecc53bd85a4 Merge: 9c91e6a5befb 11fde161ab37 Author: Linus Torvalds Date: Mon Nov 25 18:36:49 2019 -0800 Merge tag 'threads-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull thread management updates from Christian Brauner: - A pidfd's fdinfo file currently contains the field "Pid:\t" where is the pid of the process in the pid namespace of the procfs instance the fdinfo file for the pidfd was opened in. The fdinfo file has now gained a new "NSpid:\t[\t[...]]" field which lists the pids of the process in all child pid namespaces provided the pid namespace of the procfs instance it is looked up under has an ancestoral relationship with the pid namespace of the process. If it does not 0 will be shown and no further pid namespaces will be listed. Tests included. (Christian Kellner) - If the process the pidfd references has already exited, print -1 for the Pid and NSpid fields in the pidfd's fdinfo file. Tests included. (me) - Add CLONE_CLEAR_SIGHAND. This lets callers clear all signal handler that are not SIG_DFL or SIG_IGN at process creation time. This originated as a feature request from glibc to improve performance and elimate races in their posix_spawn() implementation. Tests included. (me) - Add support for choosing a specific pid for a process with clone3(). This is the feature which was part of the thread update for v5.4 but after a discussion at LPC in Lisbon we decided to delay it for one more cycle in order to make the interface more generic. This has now done. It is now possible to choose a specific pid in a whole pid namespaces (sub)hierarchy instead of just one pid namespace. In order to choose a specific pid the caller must have CAP_SYS_ADMIN in all owning user namespaces of the target pid namespaces. Tests included. (Adrian Reber) - Test improvements and extensions. (Andrei Vagin, me) * tag 'threads-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: selftests/clone3: skip if clone3() is ENOSYS selftests/clone3: check that all pids are released on error paths selftests/clone3: report a correct number of fails selftests/clone3: flush stdout and stderr before clone3() and _exit() selftests: add tests for clone3() with *set_tid fork: extend clone3() to support setting a PID selftests: add tests for clone3() tests: test CLONE_CLEAR_SIGHAND clone3: add CLONE_CLEAR_SIGHAND pid: use pid_has_task() in pidfd_open() exit: use pid_has_task() in do_wait() pid: use pid_has_task() in __change_pid() test: verify fdinfo for pidfd of reaped process pidfd: check pid has attached task in fdinfo pidfd: add tests for NSpid info in fdinfo pidfd: add NSpid entries to fdinfo commit 9c91e6a5befb89d1494dd156dd4563f9e948a74f Merge: 752272f16dd1 5781823fd0d3 Author: Linus Torvalds Date: Mon Nov 25 18:07:36 2019 -0800 Merge tag 'edac_for_5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: "A lot of changes this time around, details below. From the next cycle onwards, we'll switch the EDAC tree to topic branches (instead of a single edac-for-next branch) which should make the changes handling more flexible, hopefully. We'll see. Summary: - Rework error logging functions to accept a count of errors parameter (Hanna Hawa) - Part one of substantial EDAC core + ghes_edac driver cleanup (Robert Richter) - Print additional useful logging information in skx_* (Tony Luck) - Improve amd64_edac hw detection + cleanups (Yazen Ghannam) - Misc cleanups, fixes and code improvements" * tag 'edac_for_5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: (35 commits) EDAC/altera: Use the Altera System Manager driver EDAC/altera: Cleanup the ECC Manager EDAC/altera: Use fast register IO for S10 IRQs EDAC/ghes: Do not warn when incrementing refcount on 0 EDAC/Documentation: Describe CPER module definition and DIMM ranks EDAC: Unify the mc_event tracepoint call EDAC/ghes: Remove intermediate buffer pvt->detail_location EDAC/ghes: Fix grain calculation EDAC/ghes: Use standard kernel macros for page calculations EDAC: Remove misleading comment in struct edac_raw_error_desc EDAC/mc: Reduce indentation level in edac_mc_handle_error() EDAC/mc: Remove needless zero string termination EDAC/mc: Do not BUG_ON() in edac_mc_alloc() EDAC: Introduce an mci_for_each_dimm() iterator EDAC: Remove EDAC_DIMM_OFF() macro EDAC: Replace EDAC_DIMM_PTR() macro with edac_get_dimm() function EDAC/amd64: Get rid of the ECC disabled long message EDAC/ghes: Fix locking and memory barrier issues EDAC/amd64: Check for memory before fully initializing an instance EDAC/amd64: Use cached data when checking for ECC ... commit 752272f16dd18f2cac58a583a8673c8e2fb93abb Merge: 3f3c8be973af 96710247298d Author: Linus Torvalds Date: Mon Nov 25 18:02:36 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM updates from Paolo Bonzini: "ARM: - data abort report and injection - steal time support - GICv4 performance improvements - vgic ITS emulation fixes - simplify FWB handling - enable halt polling counters - make the emulated timer PREEMPT_RT compliant s390: - small fixes and cleanups - selftest improvements - yield improvements PPC: - add capability to tell userspace whether we can single-step the guest - improve the allocation of XIVE virtual processor IDs - rewrite interrupt synthesis code to deliver interrupts in virtual mode when appropriate. - minor cleanups and improvements. x86: - XSAVES support for AMD - more accurate report of nested guest TSC to the nested hypervisor - retpoline optimizations - support for nested 5-level page tables - PMU virtualization optimizations, and improved support for nested PMU virtualization - correct latching of INITs for nested virtualization - IOAPIC optimization - TSX_CTRL virtualization for more TAA happiness - improved allocation and flushing of SEV ASIDs - many bugfixes and cleanups" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (127 commits) kvm: nVMX: Relax guest IA32_FEATURE_CONTROL constraints KVM: x86: Grab KVM's srcu lock when setting nested state KVM: x86: Open code shared_msr_update() in its only caller KVM: Fix jump label out_free_* in kvm_init() KVM: x86: Remove a spurious export of a static function KVM: x86: create mmu/ subdirectory KVM: nVMX: Remove unnecessary TLB flushes on L1<->L2 switches when L1 use apic-access-page KVM: x86: remove set but not used variable 'called' KVM: nVMX: Do not mark vmcs02->apic_access_page as dirty when unpinning KVM: vmx: use MSR_IA32_TSX_CTRL to hard-disable TSX on guest that lack it KVM: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality KVM: x86: implement MSR_IA32_TSX_CTRL effect on CPUID KVM: x86: do not modify masked bits of shared MSRs KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES KVM: PPC: Book3S HV: XIVE: Fix potential page leak on error path KVM: PPC: Book3S HV: XIVE: Free previous EQ page when setting up a new one KVM: nVMX: Assume TLB entries of L1 and L2 are tagged differently if L0 use EPT KVM: x86: Unexport kvm_vcpu_reload_apic_access_page() KVM: nVMX: add CR4_LA57 bit to nested CR4_FIXED1 KVM: nVMX: Use semi-colon instead of comma for exit-handlers initialization ... commit 3f3c8be973af10875cfa1e7b85a535b6ba76b44f Merge: 2981dcf333b3 23c1cce9f317 Author: Linus Torvalds Date: Mon Nov 25 17:45:31 2019 -0800 Merge tag 'for-linus-5.5a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - a small series to remove the build constraint of Xen x86 MCE handling to 64-bit only - a bunch of minor cleanups * tag 'for-linus-5.5a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: Fix Kconfig indentation xen/mcelog: also allow building for 32-bit kernels xen/mcelog: add PPIN to record when available xen/mcelog: drop __MC_MSR_MCGCAP xen/gntdev: Use select for DMA_SHARED_BUFFER xen: mm: make xen_mm_init static xen: mm: include for missing declarations commit 2981dcf333b37e3753b5c1b5814418c4de1a8e34 Merge: 5ef30d74232e a8d0f11ee50d Author: Linus Torvalds Date: Mon Nov 25 17:42:56 2019 -0800 Merge tag 'mips_5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Paul Burton: "The main MIPS changes for 5.5: - Atomics-related code sees some rework & cleanup, most notably allowing Loongson LL/SC errata workarounds to be more bulletproof & their correctness to be checked at build time. - Command line setup code is simplified somewhat, resolving various corner cases. - MIPS kernels can now be built with kcov code coverage support. - We can now build with CONFIG_FORTIFY_SOURCE=y. - Miscellaneous cleanups. And some platform specific changes: - We now disable some broken TLB functionality on certain Ingenic systems, and JZ4780 systems gain some devicetree nodes to support more devices. - Loongson support sees a number of cleanups, and we gain initial support for Loongson 3A R4 systems. - We gain support for MediaTek MT7688-based GARDENA Smart Gateway systems. - SGI IP27 (Origin 2*) see a number of fixes, cleanups & simplifications. - SGI IP30 (Octane) systems are now supported" * tag 'mips_5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (107 commits) MIPS: SGI-IP27: Enable ethernet phy on second Origin 200 module MIPS: PCI: Fix fake subdevice ID for IOC3 MIPS: Ingenic: Disable abandoned HPTLB function. MIPS: PCI: remember nasid changed by set interrupt affinity MIPS: SGI-IP27: Fix crash, when CPUs are disabled via nr_cpus parameter mips: add support for folded p4d page tables mips: drop __pXd_offset() macros that duplicate pXd_index() ones mips: fix build when "48 bits virtual memory" is enabled MIPS: math-emu: Reuse name array in debugfs_fpuemu() MIPS: allow building with kcov coverage MIPS: Loongson64: Drop setup_pcimap MIPS: Loongson2ef: Convert to early_printk_8250 MIPS: Drop CPU_SUPPORTS_UNCACHED_ACCELERATED MIPS: Loongson{2ef, 32, 64} convert to generic fw cmdline MIPS: Drop pmon.h MIPS: Loongson: Unify LOONGSON3/LOONGSON64 Kconfig usage MIPS: Loongson: Rename LOONGSON1 to LOONGSON32 MIPS: Loongson: Fix return value of loongson_hwmon_init MIPS: add support for SGI Octane (IP30) MIPS: PCI: make phys_to_dma/dma_to_phys for pci-xtalk-bridge common ... commit 5ef30d74232ed204a461a5dbd0309718d63abd01 Merge: 28fcb77b3878 5ed0794cde59 Author: Linus Torvalds Date: Mon Nov 25 17:37:30 2019 -0800 Merge tag 'm68k-for-v5.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Atari Falcon IDE platform driver conversion for module autoload - defconfig updates (including enablement of Amiga ICY I2C) - small fixes and cleanups * tag 'm68k-for-v5.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k/atari: Convert Falcon IDE drivers to platform drivers m68k: defconfig: Enable ICY I2C and LTC2990 on Amiga m68k: defconfig: Update defconfigs for v5.4-rc1 m68k: q40: Fix info-leak in rtc_ioctl nubus: Remove cast to void pointer commit 28fcb77b387832f03a31624b9de515ea1b57b419 Merge: 63c2291f836e f6656208f04e Author: Linus Torvalds Date: Mon Nov 25 17:31:39 2019 -0800 Merge branch 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Borislav Petkov: - Fully reworked thermal throttling notifications, there should be no more spamming of dmesg (Srinivas Pandruvada and Benjamin Berg) - More enablement for the Intel-compatible CPUs Zhaoxin (Tony W Wang-oc) - PPIN support for Icelake (Tony Luck) * 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce/therm_throt: Optimize notifications of thermal throttle x86/mce: Add Xeon Icelake to list of CPUs that support PPIN x86/mce: Lower throttling MCE messages' priority to warning x86/mce: Add Zhaoxin LMCE support x86/mce: Add Zhaoxin CMCI support x86/mce: Add Zhaoxin MCE support x86/mce/amd: Make disable_err_thresholding() static commit 63c2291f836e1279637f95c982407cb2d5f0c335 Merge: ea1f56fa16ae 811ae8ba6dca Author: Linus Torvalds Date: Mon Nov 25 17:28:35 2019 -0800 Merge branch 'x86-microcode-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode updates from Borislav Petkov: "This converts the late loading method to load the microcode in parallel (vs sequentially currently). The patch remained in linux-next for the maximum amount of time so that any potential and hard to debug fallout be minimized. Now cloud folks have their milliseconds back but all the normal people should use early loading anyway :-)" * 'x86-microcode-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/intel: Issue the revision updated message only on the BSP x86/microcode: Update late microcode in parallel x86/microcode/amd: Fix two -Wunused-but-set-variable warnings commit ea1f56fa16ae5f6e67f6ea03836b36c6053d33d1 Merge: 4ba380f61624 6a82e23f45fe Author: Linus Torvalds Date: Mon Nov 25 17:23:53 2019 -0800 Merge tag 's390-5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Adjust PMU device drivers registration to avoid WARN_ON and few other perf improvements. - Enhance tracing in vfio-ccw. - Few stack unwinder fixes and improvements, convert get_wchan custom stack unwinding to generic api usage. - Fixes for mm helpers issues uncovered with tests validating architecture page table helpers. - Fix noexec bit handling when hardware doesn't support it. - Fix memleak and unsigned value compared with zero bugs in crypto code. Minor code simplification. - Fix crash during kdump with kasan enabled kernel. - Switch bug and alternatives from asm to asm_inline to improve inlining decisions. - Use 'depends on cc-option' for MARCH and TUNE options in Kconfig, add z13s and z14 ZR1 to TUNE descriptions. - Minor head64.S simplification. - Fix physical to logical CPU map for SMT. - Several cleanups in qdio code. - Other minor cleanups and fixes all over the code. * tag 's390-5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (41 commits) s390/cpumf: Adjust registration of s390 PMU device drivers s390/smp: fix physical to logical CPU map for SMT s390/early: move access registers setup in C code s390/head64: remove unnecessary vdso_per_cpu_data setup s390/early: move control registers setup in C code s390/kasan: support memcpy_real with TRACE_IRQFLAGS s390/crypto: Fix unsigned variable compared with zero s390/pkey: use memdup_user() to simplify code s390/pkey: fix memory leak within _copy_apqns_from_user() s390/disassembler: don't hide instruction addresses s390/cpum_sf: Assign error value to err variable s390/cpum_sf: Replace function name in debug statements s390/cpum_sf: Use consistant debug print format for sampling s390/unwind: drop unnecessary code around calling ftrace_graph_ret_addr() s390: add error handling to perf_callchain_kernel s390: always inline current_stack_pointer() s390/mm: add mm_pxd_folded() checks to pxd_free() s390/mm: properly clear _PAGE_NOEXEC bit when it is not supported s390/mm: simplify page table helpers for large entries s390/mm: make pmd/pud_bad() report large entries as bad ... commit 622dc5ad8052f4f0c6b7a12787696a5caa3c6a58 Merge: adf6f8cb3f4c b615e5a1e067 Author: David S. Miller Date: Mon Nov 25 15:46:58 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2019-11-26 The following pull-request contains BPF updates for your *net-next* tree. We've added 2 non-merge commits during the last 1 day(s) which contain a total of 2 files changed, 14 insertions(+), 3 deletions(-). The main changes, 2 small fixes are: 1) Fix libbpf out of tree compilation which complained about unknown u32 type used in libbpf_find_vmlinux_btf_id() which needs to be __u32 instead, from Andrii Nakryiko. 2) Follow-up fix for the prior BPF mmap series where kbuild bot complained about missing vmalloc_user_node_flags() for no-MMU, also from Andrii Nakryiko. ==================== Signed-off-by: David S. Miller commit 0dfbb932bb67dc76646e579ec5cd21a12125a458 Author: Keith Busch Date: Sat Nov 23 01:26:44 2019 +0900 MAINTAINERS: Remove Keith from NVDIMM maintainers I no longer work in this capacity for the NVDIMM or DAX subsystems. Signed-off-by: Keith Busch Link: https://lore.kernel.org/r/20191122162644.27078-1-kbusch@kernel.org Signed-off-by: Dan Williams commit 4ba380f61624113395bebdc2f9f6da990a0738f9 Merge: e25645b181ae d8e85e144bbe Author: Linus Torvalds Date: Mon Nov 25 15:39:19 2019 -0800 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "Apart from the arm64-specific bits (core arch and perf, new arm64 selftests), it touches the generic cow_user_page() (reviewed by Kirill) together with a macro for x86 to preserve the existing behaviour on this architecture. Summary: - On ARMv8 CPUs without hardware updates of the access flag, avoid failing cow_user_page() on PFN mappings if the pte is old. The patches introduce an arch_faults_on_old_pte() macro, defined as false on x86. When true, cow_user_page() makes the pte young before attempting __copy_from_user_inatomic(). - Covert the synchronous exception handling paths in arch/arm64/kernel/entry.S to C. - FTRACE_WITH_REGS support for arm64. - ZONE_DMA re-introduced on arm64 to support Raspberry Pi 4 - Several kselftest cases specific to arm64, together with a MAINTAINERS update for these files (moved to the ARM64 PORT entry). - Workaround for a Neoverse-N1 erratum where the CPU may fetch stale instructions under certain conditions. - Workaround for Cortex-A57 and A72 errata where the CPU may speculatively execute an AT instruction and associate a VMID with the wrong guest page tables (corrupting the TLB). - Perf updates for arm64: additional PMU topologies on HiSilicon platforms, support for CCN-512 interconnect, AXI ID filtering in the IMX8 DDR PMU, support for the CCPI2 uncore PMU in ThunderX2. - GICv3 optimisation to avoid a heavy barrier when accessing the ICC_PMR_EL1 register. - ELF HWCAP documentation updates and clean-up. - SMC calling convention conduit code clean-up. - KASLR diagnostics printed during boot - NVIDIA Carmel CPU added to the KPTI whitelist - Some arm64 mm clean-ups: use generic free_initrd_mem(), remove stale macro, simplify calculation in __create_pgd_mapping(), typos. - Kconfig clean-ups: CMDLINE_FORCE to depend on CMDLINE, choice for endinanness to help with allmodconfig" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (93 commits) arm64: Kconfig: add a choice for endianness kselftest: arm64: fix spelling mistake "contiguos" -> "contiguous" arm64: Kconfig: make CMDLINE_FORCE depend on CMDLINE MAINTAINERS: Add arm64 selftests to the ARM64 PORT entry arm64: kaslr: Check command line before looking for a seed arm64: kaslr: Announce KASLR status on boot kselftest: arm64: fake_sigreturn_misaligned_sp kselftest: arm64: fake_sigreturn_bad_size kselftest: arm64: fake_sigreturn_duplicated_fpsimd kselftest: arm64: fake_sigreturn_missing_fpsimd kselftest: arm64: fake_sigreturn_bad_size_for_magic0 kselftest: arm64: fake_sigreturn_bad_magic kselftest: arm64: add helper get_current_context kselftest: arm64: extend test_init functionalities kselftest: arm64: mangle_pstate_invalid_mode_el[123][ht] kselftest: arm64: mangle_pstate_invalid_daif_bits kselftest: arm64: mangle_pstate_invalid_compat_toggle and common utils kselftest: arm64: extend toplevel skeleton Makefile drivers/perf: hisi: update the sccl_id/ccl_id for certain HiSilicon platform arm64: mm: reserve CMA and crashkernel in ZONE_DMA32 ... commit e25645b181ae67753f9a48e11bb5b34dcf41187d Merge: db7d275415d7 ea2dd7c0875e Author: Linus Torvalds Date: Mon Nov 25 15:01:30 2019 -0800 Merge tag 'linux-kselftest-5.5-rc1-kunit' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest KUnit support gtom Shuah Khan: "This adds KUnit, a lightweight unit testing and mocking framework for the Linux kernel from Brendan Higgins. KUnit is not an end-to-end testing framework. It is currently supported on UML and sub-systems can write unit tests and run them in UML env. KUnit documentation is included in this update. In addition, this Kunit update adds 3 new kunit tests: - proc sysctl test from Iurii Zaikin - the 'list' doubly linked list test from David Gow - ext4 tests for decoding extended timestamps from Iurii Zaikin In the future KUnit will be linked to Kselftest framework to provide a way to trigger KUnit tests from user-space" * tag 'linux-kselftest-5.5-rc1-kunit' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (23 commits) lib/list-test: add a test for the 'list' doubly linked list ext4: add kunit test for decoding extended timestamps Documentation: kunit: Fix verification command kunit: Fix '--build_dir' option kunit: fix failure to build without printk MAINTAINERS: add proc sysctl KUnit test to PROC SYSCTL section kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec() MAINTAINERS: add entry for KUnit the unit testing framework Documentation: kunit: add documentation for KUnit kunit: defconfig: add defconfigs for building KUnit tests kunit: tool: add Python wrappers for running KUnit tests kunit: test: add tests for KUnit managed resources kunit: test: add the concept of assertions kunit: test: add tests for kunit test abort kunit: test: add support for test abort objtool: add kunit_try_catch_throw to the noreturn list kunit: test: add initial tests lib: enable building KUnit in lib/ kunit: test: add the concept of expectations kunit: test: add assertion printing library ... commit db7d275415d774de3d2151d6885bf61c33243419 Merge: 1c1ff4836fda ed2d8fa734e7 Author: Linus Torvalds Date: Mon Nov 25 14:58:09 2019 -0800 Merge tag 'linux-kselftest-5.5-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "This consists of several fixes to tests and framework. Masami Hiramatsu fixed several tests to build and run correctly on arm and other 32bit architectures" * tag 'linux-kselftest-5.5-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: sync: Fix cast warnings on arm selftests: net: Fix printf format warnings on arm selftests: net: Use size_t and ssize_t for counting file size selftests: vm: Build/Run 64bit tests only on 64bit arch selftests: proc: Make va_max 1MB kselftest: Fix NULL INSTALL_PATH for TARGETS runlist selftests: Move kselftest_module.sh into kselftest/ selftests: gen_kselftest_tar.sh: Do not clobber kselftest/ selftests: breakpoints: Fix a typo of function name selftests: Fix O= and KBUILD_OUTPUT handling for relative paths commit adf6f8cb3f4c2a15d5f35e6cf9ffeb6856d35312 Merge: c431047c4efe e58c19124189 Author: David S. Miller Date: Mon Nov 25 14:57:26 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Merge in networking bug fixes for merge window. Signed-off-by: David S. Miller commit acc61b8929365e63a3e8c8c8913177795aa45594 Merge: e639ea0f9155 f920d1bb9c4e Author: Dave Airlie Date: Tue Nov 26 08:40:23 2019 +1000 Merge tag 'drm-next-5.5-2019-11-22' of git://people.freedesktop.org/~agd5f/linux into drm-next drm-next-5.5-2019-11-22: amdgpu: - Fix bad DMA on some PPC platforms - MMHUB fix for powergating - BACO fix for Navi - Misc raven fixes - Enable vbios fetch directly from rom on navi - debugfs fix for DC - SR-IOV fixes for arcturus - Misc power fixes radeon: - Fix bad DMA on some PPC platforms Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20191122203025.3787-1-alexander.deucher@amd.com commit ba30e27405afa0b13b79532a345977b3e58ad501 Author: Dennis Zhou Date: Mon Nov 25 14:28:04 2019 -0800 Revert "percpu: add __percpu to SHIFT_PERCPU_PTR" This reverts commit 825dbc6ff7a3a063ea91be7d94af940080b0c991. I mistakenly applied this and only now have thought about it a little more and had time to evaluate a kbuild error for dmaengine. Once we're calling RELOC_HIDE, we're moving back into the __kernel address space and letting users interact with the actual memory address rather than in __percpu which is before adding the offsets. Signed-off-by: Dennis Zhou commit e639ea0f9155d65d5be2b800955961c7fe49f1a8 Merge: 17eee668b3ca 15b9cbb2c5e1 Author: Dave Airlie Date: Tue Nov 26 08:26:52 2019 +1000 Merge tag 'drm-intel-next-fixes-2019-11-22' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Reverts a patch to avoid spinning forever when context's timeline is active but has no requests Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20191122155523.GA20167@jlahtine-desk.ger.corp.intel.com commit b615e5a1e067dcb327482d1af7463268b89b1629 Author: Andrii Nakryiko Date: Mon Nov 25 13:29:48 2019 -0800 libbpf: Fix usage of u32 in userspace code u32 is not defined for libbpf when compiled outside of kernel sources (e.g., in Github projection). Use __u32 instead. Fixes: b8c54ea455dc ("libbpf: Add support to attach to fentry/fexit tracing progs") Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191125212948.1163343-1-andriin@fb.com commit ed81745a4c96841937f1da35c0eb66ac312e1480 Author: Andrii Nakryiko Date: Sat Nov 23 14:08:35 2019 -0800 mm: Implement no-MMU variant of vmalloc_user_node_flags To fix build with !CONFIG_MMU, implement it for no-MMU configurations as well. Fixes: fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY") Reported-by: kbuild test robot Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Acked-by: Johannes Weiner Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20191123220835.1237773-1-andriin@fb.com commit 9807019a62dc670c73ce8e59e09b41ae458c34b3 Author: Anton Ivanov Date: Wed Oct 2 11:26:45 2019 +0100 um: Loadable BPF "Firmware" for vector drivers All vector drivers now allow a BPF program to be loaded and associated with the RX socket in the host kernel. 1. The program can be loaded as an extra kernel command line option to any of the vector drivers. 2. The program can also be loaded as "firmware", using the ethtool flash option. It is possible to turn this facility on or off using a command line option. A simplistic wrapper for generating the BPF firmware for the raw socket driver out of a tcpdump/libpcap filter expression can be found at: https://github.com/kot-begemot-uk/uml_vector_utilities/ Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger commit 7d8093a56063e5d7c4459d9d025a57e0c5186ce9 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:36:54 2019 +0800 um: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Acked-by: Anton Ivanov Signed-off-by: Richard Weinberger commit bf9f80cf0ccab5f346f7d3cdc445da8fcfe6ce34 Author: Johannes Berg Date: Tue Oct 8 17:43:21 2019 +0200 um: virtio_uml: Disallow modular build This driver *can* be a module, but then its parameters (socket path) are untrusted data from inside the VM, and that isn't allowed. Allow the code to only be built-in to avoid that. Fixes: 5d38f324993f ("um: drivers: Add virtio vhost-user driver") Signed-off-by: Johannes Berg Acked-by: Anton Ivanov Signed-off-by: Richard Weinberger commit 7e60746005573a06149cdee7acedf428906f3a59 Author: Johannes Berg Date: Tue Sep 24 09:21:17 2019 +0200 um: virtio: Keep reading on -EAGAIN When we get an interrupt from the socket getting readable, and start reading, there's a possibility for a race. This depends on the implementation of the device, but e.g. with qemu's libvhost-user, we can see: device virtio_uml --------------------------------------- write header get interrupt read header read body -> returns -EAGAIN write body The -EAGAIN return is because the socket is non-blocking, and then this leads us to abandon this message. In fact, we've already read the header, so when the get another signal/interrupt for the body, we again read it as though it's a new message header, and also abandon it for the same reason (wrong size etc.) This essentially breaks things, and if that message was one that required a response, it leads to a deadlock as the device is waiting for the response but we'll never reply. Fix this by spinning on -EAGAIN as well when we read the message body. We need to handle -EAGAIN as "no message" while reading the header, since we share an interrupt. Note that this situation is highly unlikely to occur in normal usage, since there will be very few messages and only in the startup phase. With the inband call feature this does tend to happen (eventually) though. Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 04e5b1fb01834a602acaae2276b67a783a8c6159 Author: Johannes Berg Date: Wed Sep 18 21:24:13 2019 +0200 um: virtio: Remove device on disconnect If the connection drops, just remove the device, we don't try to recover from this right now. Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 5c1f33e2a03c0b8710b5d910a46f1e1fb0607679 Author: Johannes Berg Date: Tue Sep 17 13:20:14 2019 +0200 um: Don't trace irqflags during shutdown In the main() code, we eventually enable signals just before exec() or exit(), in order to to not have signals pending and delivered *after* the exec(). I've observed SIGSEGV loops at this point, and the reason seems to be the irqflags tracing; this makes sense as the kernel is no longer really functional at this point. Since there's really no reason to use unblock_signals_trace() here (I had just done a global search & replace), use the plain unblock_signals() in this case to avoid going into the no longer functional kernel. Fixes: 0dafcbe128d2 ("um: Implement TRACE_IRQFLAGS_SUPPORT") Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 1a26c920717a24272e15b79b1455f3e99969a3ce Author: Robin van der Gracht Date: Mon Nov 25 12:40:47 2019 -0800 Input: snvs_pwrkey - send key events for i.MX6 S, DL and Q The first generation i.MX6 processors does not send an interrupt when the power key is pressed. It sends a power down request interrupt if the key is released before a hard shutdown (5 second press). This should allow software to bring down the SoC safely. For this driver to work as a regular power key with the older SoCs, we need to send a keypress AND release when we get the power down request irq. Signed-off-by: Robin van der Gracht Link: https://lore.kernel.org/r/20191125161210.8275-1-robin@protonic.nl Signed-off-by: Dmitry Torokhov commit 976e3645923bdd2fe7893aae33fd7a21098bfb28 Merge: 8791663435e7 71c296f6d5b3 Author: Dmitry Torokhov Date: Mon Nov 25 13:26:56 2019 -0800 Merge branch 'next' into for-linus Prepare input updates for 5.5 merge window. commit b111df8447acdeb4b9220f99d5d4b28f83eb56ad Author: Arnd Bergmann Date: Mon Nov 25 21:25:46 2019 +0100 y2038: alarm: fix half-second cut-off Changing alarm_itimer accidentally broke the logic for arithmetic rounding of half seconds in the return code. Change it to a constant based on NSEC_PER_SEC, as suggested by Ben Hutchings. Fixes: bd40a175769d ("y2038: itimer: change implementation to timespec64") Reported-by: Ben Hutchings Signed-off-by: Arnd Bergmann commit af3784689e2b2741918e69f1ce5f0ecb7933b300 Author: Arnd Bergmann Date: Thu Nov 21 15:25:04 2019 +0100 y2038: ipc: fix x32 ABI breakage The correct type on x32 is 64-bit wide, same as for the other struct members around it, so use __kernel_long_t in place of the original __kernel_time_t here, corresponding to the rest of the structure. Fixes: caf5e32d4ea7 ("y2038: ipc: remove __kernel_time_t reference from headers") Reported-by: Ben Hutchings Signed-off-by: Arnd Bergmann commit 1c1ff4836fdab94c7c15b23be57bf64c1e56a36f Merge: ea4b71bc0bb6 73f0ec02d670 Author: Linus Torvalds Date: Mon Nov 25 12:21:23 2019 -0800 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fsverity updates from Eric Biggers: "Expose the fs-verity bit through statx()" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: docs: fs-verity: mention statx() support f2fs: support STATX_ATTR_VERITY ext4: support STATX_ATTR_VERITY statx: define STATX_ATTR_VERITY docs: fs-verity: document first supported kernel version commit ea4b71bc0bb646f811e4728389485f1d0522f7ea Merge: ae36607b669e 0eee17e33226 Author: Linus Torvalds Date: Mon Nov 25 12:19:28 2019 -0800 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fscrypt updates from Eric Biggers: - Add the IV_INO_LBLK_64 encryption policy flag which modifies the encryption to be optimized for UFS inline encryption hardware. - For AES-128-CBC, use the crypto API's implementation of ESSIV (which was added in 5.4) rather than doing ESSIV manually. - A few other cleanups. * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: f2fs: add support for IV_INO_LBLK_64 encryption policies ext4: add support for IV_INO_LBLK_64 encryption policies fscrypt: add support for IV_INO_LBLK_64 policies fscrypt: avoid data race on fscrypt_mode::logged_impl_name docs: ioctl-number: document fscrypt ioctl numbers fscrypt: zeroize fscrypt_info before freeing fscrypt: remove struct fscrypt_ctx fscrypt: invoke crypto API for ESSIV handling commit ae36607b669eb28791b02097a87d3d2e1589e88f Merge: 97d0bf96a0d0 450c3d416683 Author: Linus Torvalds Date: Mon Nov 25 12:17:58 2019 -0800 Merge tag 'affs-for-5.5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull AFFS updates from David Sterba: "A minor bugfix and cleanup for AFFS" * tag 'affs-for-5.5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: affs: fix a memory leak in affs_remount affs: Replace binary semaphores with mutexes commit 97d0bf96a0d0986f466c3ff59f2ace801e33dc69 Merge: 1b88176b9c72 fa17ed069c61 Author: Linus Torvalds Date: Mon Nov 25 12:01:49 2019 -0800 Merge tag 'for-5.5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "User visible changes: - new block group profiles: RAID1 with 3- and 4- copies - RAID1 in btrfs has always 2 copies, now add support for 3 and 4 - this is an incompat feature (named RAID1C34) - recommended use of RAID1C3 is replacement of RAID6 profile on metadata, this brings a more reliable resiliency against 2 device loss/damage - support for new checksums - per-filesystem, set at mkfs time - fast hash (crc32c successor): xxhash, 64bit digest - strong hashes (both 256bit): sha256 (slower, FIPS), blake2b (faster) - the blake2b module goes via the crypto tree, btrfs.ko has a soft dependency - speed up lseek, don't take inode locks unnecessarily, this can speed up parallel SEEK_CUR/SEEK_SET/SEEK_END by 80% - send: - allow clone operations within the same file - limit maximum number of sent clone references to avoid slow backref walking - error message improvements: device scan prints process name and PID Core changes: - cleanups - remove unique workqueue helpers, used to provide a way to avoid deadlocks in the workqueue code, now done in a simpler way - remove lots of indirect function calls in compression code - extent IO tree code moved out of extent_io.c - cleanup backup superblock handling at mount time - transaction life cycle documentation and cleanups - locking code cleanups, annotations and documentation - add more cold, const, pure function attributes - removal of unused or redundant struct members or variables - new tree-checker sanity tests - try to detect missing INODE_ITEM, cross-reference checks of DIR_ITEM, DIR_INDEX, INODE_REF, and XATTR_* items - remove own bio scheduling code (used to avoid checksum submissions being stuck behind other IO), replaced by cgroup controller-based code to allow better control and avoid priority inversions in cases where the custom and cgroup scheduling disagreed Fixes: - avoid getting stuck during cyclic writebacks - fix trimming of ranges crossing block group boundaries - fix rename exchange on subvolumes, all involved subvolumes need to be recorded in the transaction" * tag 'for-5.5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (137 commits) btrfs: drop bdev argument from submit_extent_page btrfs: remove extent_map::bdev btrfs: drop bio_set_dev where not needed btrfs: get bdev directly from fs_devices in submit_extent_page btrfs: record all roots for rename exchange on a subvol Btrfs: fix block group remaining RO forever after error during device replace btrfs: scrub: Don't check free space before marking a block group RO btrfs: change btrfs_fs_devices::rotating to bool btrfs: change btrfs_fs_devices::seeding to bool btrfs: rename btrfs_block_group_cache btrfs: block-group: Reuse the item key from caller of read_one_block_group() btrfs: block-group: Refactor btrfs_read_block_groups() btrfs: document extent buffer locking btrfs: access eb::blocking_writers according to ACCESS_ONCE policies btrfs: set blocking_writers directly, no increment or decrement btrfs: merge blocking_writers branches in btrfs_tree_read_lock btrfs: drop incompat bit for raid1c34 after last block group is gone btrfs: add incompat for raid1 with 3, 4 copies btrfs: add support for 4-copy replication (raid1c4) btrfs: add support for 3-copy replication (raid1c3) ... commit 1b88176b9c72fb4edd5920969aef94c5cd358337 Merge: eeee2827ae75 589e1b6c47ce Author: Linus Torvalds Date: Mon Nov 25 11:55:30 2019 -0800 Merge tag 'mtd/for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "MTD core: - drop inactive maintainers, update the repositories and add IRC channel - debugfs functions improvements - initialize more structure parameters - misc fixes reported by robots MTD devices: - spear_smi: Fixed Write Burst mode - new Intel IXP4xx flash probing hook Raw NAND core: - useless extra checks dropped - update the detection of the bad block markers position Raw NAND controller drivers: - Cadence: new driver - Brcmnand: support for flash-dma v0 + fixes - Denali: drop support for the legacy controller/chip DT representation - superfluous dev_err() calls removed SPI NOR core changes: - introduce 'struct spi_nor_controller_ops' - clean the Register Operations methods - use dev_dbg insted of dev_err for low level info - fix retlen handling in sst_write() - fix silent truncations in spi_nor_read and spi_nor_read_raw() - fix the clearing of QE bit on lock()/unlock() - rework the disabling of the block write protection - rework the Quad Enable methods - make sure nor->spimem and nor->controller_ops are mutually exclusive - set default Quad Enable method for ISSI flashes - add support for few flashes SPI NOR controller drivers changes: - intel-spi: - support chips without software sequencer - add support for Intel Cannon Lake and Intel Comet Lake-H flashes CFI core changes: - code cleanups related useless initializers and coding style issues - fix for a possible double free problem in cfi_cmdset_0002 - improved HyperFlash error reporting and handling in cfi_cmdset_0002 core" * tag 'mtd/for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (73 commits) mtd: devices: fix mchp23k256 read and write mtd: no need to check return value of debugfs_create functions mtd: spi-nor: Set default Quad Enable method for ISSI flashes mtd: spi-nor: Add support for is25wp256 mtd: spi-nor: Add support for w25q256jw mtd: spi-nor: Move condition to avoid a NULL check mtd: spi-nor: Make sure nor->spimem and nor->controller_ops are mutually exclusive mtd: spi-nor: Rename Quad Enable methods mtd: spi-nor: Merge spansion Quad Enable methods mtd: spi-nor: Rename CR_QUAD_EN_SPAN to SR2_QUAD_EN_BIT1 mtd: spi-nor: Extend the SR Read Back test mtd: spi-nor: Rework the disabling of block write protection mtd: spi-nor: Fix clearing of QE bit on lock()/unlock() mtd: cfi_cmdset_0002: fix delayed error detection on HyperFlash mtd: cfi_cmdset_0002: only check errors when ready in cfi_check_err_status() mtd: cfi_cmdset_0002: don't free cfi->cfiq in error path of cfi_amdstd_setup() mtd: cfi_cmdset_*: kill useless 'ret' variable initializers mtd: cfi_util: use DIV_ROUND_UP() in cfi_udelay() mtd: spi-nor: Print debug message when the read back test fails mtd: spi-nor: Check all the bits written, not just the BP ones ... commit eeee2827ae75ca58a6965e1b6d208576a5a01920 Merge: 7e5192b93c3b f612b2132db5 Author: Linus Torvalds Date: Mon Nov 25 11:53:26 2019 -0800 Merge tag 'for-5.5/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Fix DM core to disallow stacking request-based DM on partitions. - Fix DM raid target to properly resync raidset even if bitmap needed additional pages. - Fix DM crypt performance regression due to use of WQ_HIGHPRI for the IO and crypt workqueues. - Fix DM integrity metadata layout that was aligned on 128K boundary rather than the intended 4K boundary (removes 124K of wasted space for each metadata block). - Improve the DM thin, cache and clone targets to use spin_lock_irq rather than spin_lock_irqsave where possible. - Fix DM thin single thread performance that was lost due to needless workqueue wakeups. - Fix DM zoned target performance that was lost due to excessive backing device checks. - Add ability to trigger write failure with the DM dust test target. - Fix whitespace indentation in drivers/md/Kconfig. - Various smalls fixes and cleanups (e.g. use struct_size, fix uninitialized variable, variable renames, etc). * tag 'for-5.5/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (22 commits) Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues" dm: Fix Kconfig indentation dm thin: wakeup worker only when deferred bios exist dm integrity: fix excessive alignment of metadata runs dm raid: Remove unnecessary negation of a shift in raid10_format_to_md_layout dm zoned: reduce overhead of backing device checks dm dust: add limited write failure mode dm dust: change ret to r in dust_map_read and dust_map dm dust: change result vars to r dm cache: replace spin_lock_irqsave with spin_lock_irq dm bio prison: replace spin_lock_irqsave with spin_lock_irq dm thin: replace spin_lock_irqsave with spin_lock_irq dm clone: add bucket_lock_irq/bucket_unlock_irq helpers dm clone: replace spin_lock_irqsave with spin_lock_irq dm writecache: handle REQ_FUA dm writecache: fix uninitialized variable warning dm stripe: use struct_size() in kmalloc() dm raid: streamline rs_get_progress() and its raid_status() caller side dm raid: simplify rs_setup_recovery call chain dm raid: to ensure resynchronization, perform raid set grow in preresume ... commit 7e5192b93c3b8661791f65f0d477d0da234ca202 Merge: 464a47f45d2a 979c690d9a01 Author: Linus Torvalds Date: Mon Nov 25 11:37:01 2019 -0800 Merge tag 'for-5.5/disk-revalidate-20191122' of git://git.kernel.dk/linux-block Pull disk revalidation updates from Jens Axboe: "This continues the work that Jan Kara started to thoroughly cleanup and consolidate how we handle rescans and revalidations" * tag 'for-5.5/disk-revalidate-20191122' of git://git.kernel.dk/linux-block: block: move clearing bd_invalidated into check_disk_size_change block: remove (__)blkdev_reread_part as an exported API block: fix bdev_disk_changed for non-partitioned devices block: move rescan_partitions to fs/block_dev.c block: merge invalidate_partitions into rescan_partitions block: refactor rescan_partitions commit 464a47f45d2ae2db859f0e7c128b5f01aff19a53 Merge: 323264eefba1 a468168130ec Author: Linus Torvalds Date: Mon Nov 25 11:22:37 2019 -0800 Merge tag 'for-5.5/zoned-20191122' of git://git.kernel.dk/linux-block Pull zoned block device update from Jens Axboe: "Enhancements and improvements to the zoned device support" * tag 'for-5.5/zoned-20191122' of git://git.kernel.dk/linux-block: scsi: sd_zbc: Remove set but not used variable 'buflen' block: rework zone reporting scsi: sd_zbc: Cleanup sd_zbc_alloc_report_buffer() null_blk: Add zone_nr_conv to features null_blk: clean up report zones null_blk: clean up the block device operations block: Remove partition support for zoned block devices block: Simplify report zones execution block: cleanup the !zoned case in blk_revalidate_disk_zones block: Enhance blk_revalidate_disk_zones() commit 323264eefba1ea288d5962c0a9e23ebd62107ca8 Merge: 2d53943090c3 03bf73c315ed Author: Linus Torvalds Date: Mon Nov 25 11:18:03 2019 -0800 Merge tag 'for-5.5/drivers-post-20191122' of git://git.kernel.dk/linux-block Pull additional block driver updates from Jens Axboe: "Here's another block driver update, done to avoid conflicts with the zoned changes coming next. This contains: - Prepare SCSI sd for zone open/close/finish support - Small NVMe pull request - hwmon support (Akinobu) - add new co-maintainer (Christoph) - work-around for a discard issue on non-conformant drives (Eduard) - Small nbd leak fix" * tag 'for-5.5/drivers-post-20191122' of git://git.kernel.dk/linux-block: nbd: prevent memory leak nvme: hwmon: add quirk to avoid changing temperature threshold nvme: hwmon: provide temperature min and max values for each sensor nvmet: add another maintainer nvme: Discard workaround for non-conformant devices nvme: Add hardware monitoring support scsi: sd_zbc: add zone open, close, and finish support commit 2d53943090c336c9d298638bad292be349e1b9c4 Merge: ff6814b078e3 00b89892c869 Author: Linus Torvalds Date: Mon Nov 25 11:15:41 2019 -0800 Merge tag 'for-5.5/drivers-20191121' of git://git.kernel.dk/linux-block Pull block driver updates from Jens Axboe: "Here are the main block driver updates for 5.5. Nothing major in here, mostly just fixes. This contains: - a set of bcache changes via Coly - MD changes from Song - loop unmap write-zeroes fix (Darrick) - spelling fixes (Geert) - zoned additions cleanups to null_blk/dm (Ajay) - allow null_blk online submit queue changes (Bart) - NVMe changes via Keith, nothing major here either" * tag 'for-5.5/drivers-20191121' of git://git.kernel.dk/linux-block: (56 commits) Revert "bcache: fix fifo index swapping condition in journal_pin_cmp()" drivers/md/raid5-ppl.c: use the new spelling of RWH_WRITE_LIFE_NOT_SET drivers/md/raid5.c: use the new spelling of RWH_WRITE_LIFE_NOT_SET bcache: don't export symbols bcache: remove the extra cflags for request.o bcache: at least try to shrink 1 node in bch_mca_scan() bcache: add idle_max_writeback_rate sysfs interface bcache: add code comments in bch_btree_leaf_dirty() bcache: fix deadlock in bcache_allocator bcache: add code comment bch_keylist_pop() and bch_keylist_pop_front() bcache: deleted code comments for dead code in bch_data_insert_keys() bcache: add more accurate error messages in read_super() bcache: fix static checker warning in bcache_device_free() bcache: fix a lost wake-up problem caused by mca_cannibalize_lock bcache: fix fifo index swapping condition in journal_pin_cmp() md/raid10: prevent access of uninitialized resync_pages offset md: avoid invalid memory access for array sb->dev_roles md/raid1: avoid soft lockup under high load null_blk: add zone open, close, and finish support dm: add zone open, close and finish support ... commit e58c1912418980f57ba2060017583067f5f71e52 Author: Jouni Hogander Date: Mon Nov 25 14:23:43 2019 +0200 slip: Fix use-after-free Read in slip_open Slip_open doesn't clean-up device which registration failed from the slip_devs device list. On next open after failure this list is iterated and freed device is accessed. Fix this by calling sl_free_netdev in error path. Here is the trace from the Syzbot: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:634 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 sl_sync drivers/net/slip/slip.c:725 [inline] slip_open+0xecd/0x11b7 drivers/net/slip/slip.c:801 tty_ldisc_open.isra.0+0xa3/0x110 drivers/tty/tty_ldisc.c:469 tty_set_ldisc+0x30e/0x6b0 drivers/tty/tty_ldisc.c:596 tiocsetd drivers/tty/tty_io.c:2334 [inline] tty_ioctl+0xe8d/0x14f0 drivers/tty/tty_io.c:2594 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xdb6/0x13e0 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 3b5a39979daf ("slip: Fix memory leak in slip_open error path") Reported-by: syzbot+4d5170758f3762109542@syzkaller.appspotmail.com Cc: David Miller Cc: Oliver Hartkopp Cc: Lukas Bulwahn Signed-off-by: Jouni Hogander Signed-off-by: David S. Miller commit ff6814b078e33a4d26fee9ea80779c81a6744cd8 Merge: 6e7b06a4c888 1e279153dfd5 Author: Linus Torvalds Date: Mon Nov 25 10:59:41 2019 -0800 Merge tag 'for-5.5/block-20191121' of git://git.kernel.dk/linux-block Pull core block updates from Jens Axboe: "Due to more granular branches, this one is small and will be followed with other core branches that add specific features. I meant to just have a core and drivers branch, but external dependencies we ended up adding a few more that are also core. The changes are: - Fixes and improvements for the zoned device support (Ajay, Damien) - sed-opal table writing and datastore UID (Revanth) - blk-cgroup (and bfq) blk-cgroup stat fixes (Tejun) - Improvements to the block stats tracking (Pavel) - Fix for overruning sysfs buffer for large number of CPUs (Ming) - Optimization for small IO (Ming, Christoph) - Fix typo in RWH lifetime hint (Eugene) - Dead code removal and documentation (Bart) - Reduction in memory usage for queue and tag set (Bart) - Kerneldoc header documentation (André) - Device/partition revalidation fixes (Jan) - Stats tracking for flush requests (Konstantin) - Various other little fixes here and there (et al)" * tag 'for-5.5/block-20191121' of git://git.kernel.dk/linux-block: (48 commits) Revert "block: split bio if the only bvec's length is > SZ_4K" block: add iostat counters for flush requests block,bfq: Skip tracing hooks if possible block: sed-opal: Introduce SUM_SET_LIST parameter and append it using 'add_token_u64' blk-cgroup: cgroup_rstat_updated() shouldn't be called on cgroup1 block: Don't disable interrupts in trigger_softirq() sbitmap: Delete sbitmap_any_bit_clear() blk-mq: Delete blk_mq_has_free_tags() and blk_mq_can_queue() block: split bio if the only bvec's length is > SZ_4K block: still try to split bio if the bvec crosses pages blk-cgroup: separate out blkg_rwstat under CONFIG_BLK_CGROUP_RWSTAT blk-cgroup: reimplement basic IO stats using cgroup rstat blk-cgroup: remove now unused blkg_print_stat_{bytes|ios}_recursive() blk-throtl: stop using blkg->stat_bytes and ->stat_ios bfq-iosched: stop using blkg->stat_bytes and ->stat_ios bfq-iosched: relocate bfqg_*rwstat*() helpers block: add zone open, close and finish ioctl support block: add zone open, close and finish operations block: Simplify REQ_OP_ZONE_RESET_ALL handling block: Remove REQ_OP_ZONE_RESET plugging ... commit 6e7b06a4c88846c20c2cc01b370564a2423ff0d0 Merge: fb4b3d3fd0c7 44bdc2fb63aa Author: Linus Torvalds Date: Mon Nov 25 10:57:53 2019 -0800 Merge tag 'for-5.5/libata-20191121' of git://git.kernel.dk/linux-block Pull libata updates from Jens Axboe: "Just a few fixes all over the place, support for the Annapurna SATA controller, and a patchset that cleans up the error defines and ultimately fixes anissue with sata_mv" * tag 'for-5.5/libata-20191121' of git://git.kernel.dk/linux-block: ata: pata_artop: make arrays static const, makes object smaller ata_piix: remove open-coded dmi_match(DMI_OEM_STRING) ata: sata_mv, avoid trigerrable BUG_ON ata: make qc_prep return ata_completion_errors ata: define AC_ERR_OK ata: Documentation, fix function names libata: Ensure ata_port probe has completed before detach ahci: tegra: use regulator_bulk_set_supply_names() ahci: Add support for Amazon's Annapurna Labs SATA controller commit 9bca3a0a923fc3f0fb9e41391be1d0f291e86858 Author: Oleksij Rempel Date: Mon Nov 25 12:43:51 2019 +0100 net: dsa: sja1105: fix sja1105_parse_rgmii_delays() This function was using configuration of port 0 in devicetree for all ports. In case CPU port was not 0, the delay settings was ignored. This resulted not working communication between CPU and the switch. Fixes: f5b8631c293b ("net: dsa: sja1105: Error out if RGMII delays are requested in DT") Signed-off-by: Oleksij Rempel Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit 1d7ea55668878bb350979c377fc72509dd6f5b21 Author: Menglong Dong Date: Mon Nov 25 16:58:09 2019 +0800 macvlan: schedule bc_work even if error While enqueueing a broadcast skb to port->bc_queue, schedule_work() is called to add port->bc_work, which processes the skbs in bc_queue, to "events" work queue. If port->bc_queue is full, the skb will be discarded and schedule_work(&port->bc_work) won't be called. However, if port->bc_queue is full and port->bc_work is not running or pending, port->bc_queue will keep full and schedule_work() won't be called any more, and all broadcast skbs to macvlan will be discarded. This case can happen: macvlan_process_broadcast() is the pending function of port->bc_work, it moves all the skbs in port->bc_queue to the queue "list", and processes the skbs in "list". During this, new skbs will keep being added to port->bc_queue in macvlan_broadcast_enqueue(), and port->bc_queue may already full when macvlan_process_broadcast() return. This may happen, especially when there are a lot of real-time threads and the process is preempted. Fix this by calling schedule_work(&port->bc_work) even if port->bc_work is full in macvlan_broadcast_enqueue(). Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue") Signed-off-by: Menglong Dong Signed-off-by: David S. Miller commit c431047c4efe7903fb1c5a23e0f3f8eb1efc89f9 Author: Po Liu Date: Mon Nov 25 05:56:56 2019 +0000 enetc: add support Credit Based Shaper(CBS) for hardware offload The ENETC hardware support the Credit Based Shaper(CBS) which part of the IEEE-802.1Qav. The CBS driver was loaded by the sch_cbs interface when set in the QOS in the kernel. Here is an example command to set 20Mbits bandwidth in 1Gbits port for taffic class 7: tc qdisc add dev eth0 root handle 1: mqprio \ num_tc 8 map 0 1 2 3 4 5 6 7 hw 1 tc qdisc replace dev eth0 parent 1:8 cbs \ locredit -1470 hicredit 30 \ sendslope -980000 idleslope 20000 offload 1 Signed-off-by: Po Liu Reviewed-by: Claudiu Manoil Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit bec170e55982c2d3b8e1beccadf16e288fe6fb5a Author: Heiner Kallweit Date: Sat Nov 23 17:28:37 2019 +0100 net: phy: add helpers phy_(un)lock_mdio_bus Add helpers to make locking/unlocking the MDIO bus easier. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 32085f25d7b68404055f3525c780142fc72e543f Author: David Bauer Date: Fri Nov 22 22:44:51 2019 +0100 mdio_bus: don't use managed reset-controller Geert Uytterhoeven reported that using devm_reset_controller_get leads to a WARNING when probing a reset-controlled PHY. This is because the device devm_reset_controller_get gets supplied is not actually the one being probed. Acquire an unmanaged reset-control as well as free the reset_control on unregister to fix this. Reported-by: Geert Uytterhoeven CC: Andrew Lunn Signed-off-by: David Bauer Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit fb4b3d3fd0c7f53168b6f6d07d1d97f55c676eeb Merge: 54f0e54011c9 eac406c61cd0 Author: Linus Torvalds Date: Mon Nov 25 10:40:27 2019 -0800 Merge tag 'for-5.5/io_uring-20191121' of git://git.kernel.dk/linux-block Pull io_uring updates from Jens Axboe: "A lot of stuff has been going on this cycle, with improving the support for networked IO (and hence unbounded request completion times) being one of the major themes. There's been a set of fixes done this week, I'll send those out as well once we're certain we're fully happy with them. This contains: - Unification of the "normal" submit path and the SQPOLL path (Pavel) - Support for sparse (and bigger) file sets, and updating of those file sets without needing to unregister/register again. - Independently sized CQ ring, instead of just making it always 2x the SQ ring size. This makes it more flexible for networked applications. - Support for overflowed CQ ring, never dropping events but providing backpressure on submits. - Add support for absolute timeouts, not just relative ones. - Support for generic cancellations. This divorces io_uring from workqueues as well, which additionally gets us one step closer to generic async system call support. - With cancellations, we can support grabbing the process file table as well, just like we do mm context. This allows support for system calls that create file descriptors, like accept4() support that's built on top of that. - Support for io_uring tracing (Dmitrii) - Support for linked timeouts. These abort an operation if it isn't completed by the time noted in the linke timeout. - Speedup tracking of poll requests - Various cleanups making the coder easier to follow (Jackie, Pavel, Bob, YueHaibing, me) - Update MAINTAINERS with new io_uring list" * tag 'for-5.5/io_uring-20191121' of git://git.kernel.dk/linux-block: (64 commits) io_uring: make POLL_ADD/POLL_REMOVE scale better io-wq: remove now redundant struct io_wq_nulls_list io_uring: Fix getting file for non-fd opcodes io_uring: introduce req_need_defer() io_uring: clean up io_uring_cancel_files() io-wq: ensure free/busy list browsing see all items io-wq: ensure we have a stable view of ->cur_work for cancellations io_wq: add get/put_work handlers to io_wq_create() io_uring: check for validity of ->rings in teardown io_uring: fix potential deadlock in io_poll_wake() io_uring: use correct "is IO worker" helper io_uring: fix -ENOENT issue with linked timer with short timeout io_uring: don't do flush cancel under inflight_lock io_uring: flag SQPOLL busy condition to userspace io_uring: make ASYNC_CANCEL work with poll and timeout io_uring: provide fallback request for OOM situations io_uring: convert accept4() -ERESTARTSYS into -EINTR io_uring: fix error clear of ->file_table in io_sqe_files_register() io_uring: separate the io_free_req and io_free_req_find_next interface io_uring: keep io_put_req only responsible for release and put req ... commit 54f0e54011c9e83277e84ec2f60696285066dfa9 Merge: 0be0ee71816b 0b40dbcbba92 Author: Linus Torvalds Date: Mon Nov 25 10:29:42 2019 -0800 Merge tag 'tpmdd-next-20191112' of git://git.infradead.org/users/jjs/linux-tpmdd Pull tpmd updates from Jarkko Sakkinen: - support for Cr50 fTPM - support for fTPM on AMD Zen+ CPUs - TPM 2.0 trusted keys code relocated from drivers/char/tpm to security/keys * tag 'tpmdd-next-20191112' of git://git.infradead.org/users/jjs/linux-tpmdd: KEYS: trusted: Remove set but not used variable 'keyhndl' tpm: Switch to platform_get_irq_optional() tpm_crb: fix fTPM on AMD Zen+ CPUs KEYS: trusted: Move TPM2 trusted keys code KEYS: trusted: Create trusted keys subsystem KEYS: Use common tpm_buf for trusted and asymmetric keys tpm: Move tpm_buf code to include/linux/ tpm: use GFP_KERNEL instead of GFP_HIGHMEM for tpm_buf tpm: add check after commands attribs tab allocation tpm: tpm_tis_spi: Drop THIS_MODULE usage from driver struct tpm: tpm_tis_spi: Cleanup includes tpm: tpm_tis_spi: Support cr50 devices tpm: tpm_tis_spi: Introduce a flow control callback tpm: Add a flag to indicate TPM power is managed by firmware dt-bindings: tpm: document properties for cr50 tpm_tis: override durations for STM tpm with firmware 1.2.8.28 tpm: provide a way to override the chip returned durations tpm: Remove duplicate code from caps_show() in tpm-sysfs.c commit 0be0ee71816b2b6725e2b4f32ad6726c9d729777 Author: Linus Torvalds Date: Mon Nov 11 15:51:03 2019 -0800 vfs: properly and reliably lock f_pos in fdget_pos() fdget_pos() is used by file operations that will read and update f_pos: things like "read()", "write()" and "lseek()" (but not, for example, "pread()/pwrite" that get their file positions elsewhere). However, it had two separate escape clauses for this, because not everybody wants or needs serialization of the file position. The first and most obvious case is the "file descriptor doesn't have a position at all", ie a stream-like file. Except we didn't actually use FMODE_STREAM, but instead used FMODE_ATOMIC_POS. The reason for that was that FMODE_STREAM didn't exist back in the days, but also that we didn't want to mark all the special cases, so we only marked the ones that _required_ position atomicity according to POSIX - regular files and directories. The case one was intentionally lazy, but now that we _do_ have FMODE_STREAM we could and should just use it. With the change to use FMODE_STREAM, there are no remaining uses for FMODE_ATOMIC_POS, and all the code to set it is deleted. Any cases where we don't want the serialization because the driver (or subsystem) doesn't use the file position should just be updated to do "stream_open()". We've done that for all the obvious and common situations, we may need a few more. Quoting Kirill Smelkov in the original FMODE_STREAM thread (see link below for full email): "And I appreciate if people could help at least somehow with "getting rid of mixed case entirely" (i.e. always lock f_pos_lock on !FMODE_STREAM), because this transition starts to diverge from my particular use-case too far. To me it makes sense to do that transition as follows: - convert nonseekable_open -> stream_open via stream_open.cocci; - audit other nonseekable_open calls and convert left users that truly don't depend on position to stream_open; - extend stream_open.cocci to analyze alloc_file_pseudo as well (this will cover pipes and sockets), or maybe convert pipes and sockets to FMODE_STREAM manually; - extend stream_open.cocci to analyze file_operations that use no_llseek or noop_llseek, but do not use nonseekable_open or alloc_file_pseudo. This might find files that have stream semantic but are opened differently; - extend stream_open.cocci to analyze file_operations whose .read/.write do not use ppos at all (independently of how file was opened); - ... - after that remove FMODE_ATOMIC_POS and always take f_pos_lock if !FMODE_STREAM; - gather bug reports for deadlocked read/write and convert missed cases to FMODE_STREAM, probably extending stream_open.cocci along the road to catch similar cases i.e. always take f_pos_lock unless a file is explicitly marked as being stream, and try to find and cover all files that are streams" We have not done the "extend stream_open.cocci to analyze alloc_file_pseudo" as well, but the previous commit did manually handle the case of pipes and sockets. The other case where we can avoid locking f_pos is the "this file descriptor only has a single user and it is us, and thus there is no need to lock it". The second test was correct, although a bit subtle and worth just re-iterating here. There are two kinds of other sources of references to the same file descriptor: file descriptors that have been explicitly shared across fork() or with dup(), and file tables having elevated reference counts due to threading (or explicit file sharing with clone()). The first case would have incremented the file count explicitly, and in the second case the previous __fdget() would have incremented it for us and set the FDPUT_FPUT flag. But in both cases the file count would be greater than one, so the "file_count(file) > 1" test catches both situations. Also note that if file_count is 1, that also means that no other thread can have access to the file table, so there also cannot be races with concurrent calls to dup()/fork()/clone() that would increment the file count any other way. Link: https://lore.kernel.org/linux-fsdevel/20190413184404.GA13490@deco.navytux.spb.ru Cc: Kirill Smelkov Cc: Eic Dumazet Cc: Al Viro Cc: Alan Stern Cc: Marco Elver Cc: Andrea Parri Cc: Paul McKenney Signed-off-by: Linus Torvalds commit 803e74be04b32f7785742dcabfc62116718fbb06 Author: Jaegeuk Kim Date: Fri Nov 22 12:02:06 2019 -0800 f2fs: stop GC when the victim becomes fully valid We must stop GC, once the segment becomes fully valid. Otherwise, it can produce another dirty segments by moving valid blocks in the segment partially. Ramon hit no free segment panic sometimes and saw this case happens when validating reliable file pinning feature. Signed-off-by: Ramon Pantin Signed-off-by: Jaegeuk Kim commit a4db59ac9058207cea77df7d7893aab5c3009f87 Author: Jaegeuk Kim Date: Fri Nov 22 11:53:10 2019 -0800 f2fs: expose main_blkaddr in sysfs Expose in /sys/fs/f2fs//main_blkaddr the block address where the main area starts. This allows user mode programs to determine: - That pinned files that are made exclusively of fully allocated 2MB segments will never be unpinned by the file system. - Where the main area starts. This is required by programs that want to verify if a file is made exclusively of 2MB f2fs segments, the alignment boundary for segments starts at this address. Testing for 2MB alignment relative to the start of the device is incorrect, because for some filesystems main_blkaddr is not at a 2MB boundary relative to the start of the device. The entry will be used when validating reliable pinning file feature proposed by "f2fs: support aligned pinned file". Signed-off-by: Ramon Pantin Signed-off-by: Jaegeuk Kim commit 909110c060f22e65756659ec6fa957ae75777e00 Author: Chengguang Xu Date: Mon Nov 25 11:20:36 2019 +0800 f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project() Setting softlimit larger than hardlimit seems meaningless for disk quota but currently it is allowed. In this case, there may be a bit of comfusion for users when they run df comamnd to directory which has project quota. For example, we set 20M softlimit and 10M hardlimit of block usage limit for project quota of test_dir(project id 123). [root@hades f2fs]# repquota -P -a *** Report for project quotas on device /dev/nvme0n1p8 Block grace time: 7days; Inode grace time: 7days Block limits File limits Project used soft hard grace used soft hard grace ---------------------------------------------------------------------- 0 -- 4 0 0 1 0 0 123 +- 10248 20480 10240 2 0 0 The result of df command as below: [root@hades f2fs]# df -h /mnt/f2fs/test Filesystem Size Used Avail Use% Mounted on /dev/nvme0n1p8 20M 11M 10M 51% /mnt/f2fs Even though it looks like there is another 10M free space to use, if we write new data to diretory test(inherit project id), the write will fail with errno(-EDQUOT). After this patch, the df result looks like below. [root@hades f2fs]# df -h /mnt/f2fs/test Filesystem Size Used Avail Use% Mounted on /dev/nvme0n1p8 10M 10M 0 100% /mnt/f2fs Signed-off-by: Chengguang Xu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 39a1a8941b27c37f79508426e27a2ec29829d66c Author: Andre Przywara Date: Tue Nov 19 12:03:31 2019 +0000 arm64: dts: juno: Fix UART frequency Older versions of the Juno *SoC* TRM [1] recommended that the UART clock source should be 7.2738 MHz, whereas the *system* TRM [2] stated a more correct value of 7.3728 MHz. Somehow the wrong value managed to end up in our DT. Doing a prime factorisation, a modulo divide by 115200 and trying to buy a 7.2738 MHz crystal at your favourite electronics dealer suggest that the old value was actually a typo. The actual UART clock is driven by a PLL, configured via a parameter in some board.txt file in the firmware, which reads 7.37 MHz (sic!). Fix this to correct the baud rate divisor calculation on the Juno board. [1] http://infocenter.arm.com/help/topic/com.arm.doc.ddi0515b.b/DDI0515B_b_juno_arm_development_platform_soc_trm.pdf [2] http://infocenter.arm.com/help/topic/com.arm.doc.100113_0000_07_en/arm_versatile_express_juno_development_platform_(v2m_juno)_technical_reference_manual_100113_0000_07_en.pdf Fixes: 71f867ec130e ("arm64: Add Juno board device tree.") Signed-off-by: Andre Przywara Acked-by: Liviu Dudau Signed-off-by: Sudeep Holla commit d8e464ecc17b4444e9a3e148a9748c4828c6328c Author: Linus Torvalds Date: Sun Nov 17 11:20:48 2019 -0800 vfs: mark pipes and sockets as stream-like file descriptors In commit 3975b097e577 ("convert stream-like files -> stream_open, even if they use noop_llseek") Kirill used a coccinelle script to change "nonseekable_open()" to "stream_open()", which changed the trivial cases of stream-like file descriptors to the new model with FMODE_STREAM. However, the two big cases - sockets and pipes - don't actually have that trivial pattern at all, and were thus never converted to FMODE_STREAM even though it makes lots of sense to do so. That's particularly true when looking forward to the next change: getting rid of FMODE_ATOMIC_POS entirely, and just using FMODE_STREAM to decide whether f_pos updates are needed or not. And if they are, we'll always do them atomically. This came up because KCSAN (correctly) noted that the non-locked f_pos updates are data races: they are clearly benign for the case where we don't care, but it would be good to just not have that issue exist at all. Note that the reason we used FMODE_ATOMIC_POS originally is that only doing it for the minimal required case is "safer" in that it's possible that the f_pos locking can cause unnecessary serialization across the whole write() call. And in the worst case, that kind of serialization can cause deadlock issues: think writers that need readers to empty the state using the same file descriptor. [ Note that the locking is per-file descriptor - because it protects "f_pos", which is obviously per-file descriptor - so it only affects cases where you literally use the same file descriptor to both read and write. So a regular pipe that has separate reading and writing file descriptors doesn't really have this situation even though it's the obvious case of "reader empties what a bit writer concurrently fills" But we want to make pipes as being stream-line anyway, because we don't want the unnecessary overhead of locking, and because a named pipe can be (ab-)used by reading and writing to the same file descriptor. ] There are likely a lot of other cases that might want FMODE_STREAM, and looking for ".llseek = no_llseek" users and other cases that don't have an lseek file operation at all and making them use "stream_open()" might be a good idea. But pipes and sockets are likely to be the two main cases. Cc: Kirill Smelkov Cc: Eic Dumazet Cc: Al Viro Cc: Alan Stern Cc: Marco Elver Cc: Andrea Parri Cc: Paul McKenney Signed-off-by: Linus Torvalds commit e3d023b8952b78b82b1f9c6d7b708680a99ea831 Author: Keith Busch Date: Sat Nov 23 01:25:01 2019 +0900 MAINTAINERS: Remove Keith from VMD maintainer I no longer work in this capacity on the VMD driver. Signed-off-by: Keith Busch Signed-off-by: Lorenzo Pieralisi Acked-by: Jon Derrick commit 1b00ff61597e7b5758372ded5134f673dddc1831 Author: Krzysztof Kozlowski Date: Thu Nov 21 04:19:23 2019 +0100 i2c: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Acked-by: Peter Rosin Signed-off-by: Wolfram Sang commit dca0dd28fa5e0a1ec41a623dbaf667601fc62331 Author: Corey Minyard Date: Thu Nov 21 10:10:51 2019 +0100 i2c: smbus: Don't filter out duplicate alerts Getting the same alert twice in a row is legal and normal, especially on a fast device (like running in qemu). Kind of like interrupts. So don't report duplicate alerts, and deliver them normally. [JD: Fixed subject] Signed-off-by: Corey Minyard Signed-off-by: Jean Delvare Reviewed-by: Benjamin Tissoires Signed-off-by: Wolfram Sang commit 1656a07a89a82a80d8e9fdf0e37821c2584d88d3 Author: Steve French Date: Sun Oct 13 21:19:54 2019 -0500 cifs: update internal module version number To 2.24 Signed-off-by: Steve French commit ff6b6f3f916097cea49805d71eb94644a234b8a6 Author: Paulo Alcantara (SUSE) Date: Fri Nov 22 12:30:57 2019 -0300 cifs: Always update signing key of first channel Update signing key of first channel whenever generating the master sigining/encryption/decryption keys rather than only in cifs_mount(). This also fixes reconnect when re-establishing smb sessions to other servers. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 40363cf13999ee4fb3b5c1e67fa5e6f0e9da34bd Author: Qian Cai Date: Thu Nov 14 12:17:41 2019 -0500 writeback: fix -Wformat compilation warnings The commit f05499a06fb4 ("writeback: use ino_t for inodes in tracepoints") introduced a lot of GCC compilation warnings on s390, In file included from ./include/trace/define_trace.h:102, from ./include/trace/events/writeback.h:904, from fs/fs-writeback.c:82: ./include/trace/events/writeback.h: In function 'trace_raw_output_writeback_page_template': ./include/trace/events/writeback.h:76:12: warning: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'ino_t' {aka 'unsigned int'} [-Wformat=] TP_printk("bdi %s: ino=%lu index=%lu", ^~~~~~~~~~~~~~~~~~~~~~~~~~~ ./include/trace/trace_events.h:360:22: note: in definition of macro 'DECLARE_EVENT_CLASS' trace_seq_printf(s, print); \ ^~~~~ ./include/trace/events/writeback.h:76:2: note: in expansion of macro 'TP_printk' TP_printk("bdi %s: ino=%lu index=%lu", ^~~~~~~~~ Fix them by adding necessary casts where ino_t could be either "unsigned int" or "unsigned long". Fixes: f05499a06fb4 ("writeback: use ino_t for inodes in tracepoints") Signed-off-by: Qian Cai Signed-off-by: Tejun Heo commit bf2aa5cadd1c7bb91af4b5b1218e643cfffb5c9a Author: Jens Verwiebe Date: Sun Nov 24 13:35:44 2019 +0100 ALSA: usb-audio: Fix Focusrite Scarlett 6i6 gen1 - input handling The Scarlett 6i6 has no padding on rear inputs 3/4 but a gainstage. This patch introduces this functionality as to be seen in the mac or windows scarlett control. The correct address could already be found in the dump info, but was never used. Without this patch inputs 3/4 are quite unusable else. Signed-off-by: Jens Verwiebe Link: https://lore.kernel.org/r/384d65cd-5e87-91eb-9fc3-e57226f534c6@jensverwiebe.de Signed-off-by: Takashi Iwai commit 22abcd7569618271cc3609da24bbc0e7541248a4 Merge: 51e46c7a4007 0bfa52a43ec0 Author: Jonathan Corbet Date: Mon Nov 25 08:43:28 2019 -0700 Merge branch 'maintainer-profile' into docs-next Patch series from Dan Williams: At last years Plumbers Conference I proposed the Maintainer Entry Profile as a document that a maintainer can provide to set contributor expectations and provide fodder for a discussion between maintainers about the merits of different maintainer policies. For those that did not attend, the goal of the Maintainer Entry Profile is to provide contributors documentation of patch submission considerations that may vary by subsystem. The session introduction was: The first rule of kernel maintenance is that there are no hard and fast rules. That state of affairs is both a blessing and a curse. It has served the community well to be adaptable to the different people and different problem spaces that inhabit the kernel community. However, that variability also leads to inconsistent experiences for contributors, little to no guidance for new contributors, and unnecessary stress on current maintainers. To be clear, the proposed document does not impose or suggest new rules. Instead it provides an outlet to document the existing unwritten policies in effect for a given subsystem. Over time the hope is that some of this variability can be up-levelled to new global process policy, but in the meantime it provides relief for communicating the guidelines that are being imposed on contributors. [jc: resolved merge conflicts with the MAINTAINERS file, added a patch to fix up various RST issues, and added a TOC section for the profiles.] commit 0bfa52a43ec085c2f5eb2c35fcc6cf73bb802eae Author: Jonathan Corbet Date: Mon Nov 25 08:42:12 2019 -0700 docs: fix up the maintainer profile document Add blank lines where needed to get the document to render properly. Also add a TOC of existing profiles just so that the nvdimm profile is linked into the toctree, is discoverable, and doesn't generate a warning. Signed-off-by: Jonathan Corbet commit 3e5c3c41ae925458150273e2f74ffbf999530c5f Author: Tony Lindgren Date: Sun Nov 24 09:43:16 2019 -0800 ARM: dts: Fix sgx sysconfig register for omap4 Looks like we've had the sgx sysconfig register and revision register always wrong for omap4, including the old platform data. Let's fix the offsets to what the TRM says. Otherwise the sgx module may never idle depending on the state of the real sysconfig register. Fixes: d23a163ebe5a ("ARM: dts: Add nodes for missing omap4 interconnect target modules") Cc: H. Nikolaus Schaller Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Cc: Tomi Valkeinen Signed-off-by: Tony Lindgren commit 5bb30a4dd60e2a10a4de9932daff23e503f1dd2b Author: Paulo Alcantara (SUSE) Date: Fri Nov 22 12:30:56 2019 -0300 cifs: Fix retrieval of DFS referrals in cifs_mount() Make sure that DFS referrals are sent to newly resolved root targets as in a multi tier DFS setup. Signed-off-by: Paulo Alcantara (SUSE) Link: https://lkml.kernel.org/r/05aa2995-e85e-0ff4-d003-5bb08bd17a22@canonical.com Cc: stable@vger.kernel.org Tested-by: Matthew Ruffell Signed-off-by: Steve French commit 47843401e3a0f4f668927b77e713c876bb423d4f Author: Dan Williams Date: Sun Nov 24 12:59:58 2019 -0800 libnvdimm, MAINTAINERS: Maintainer Entry Profile Document the basic policies of the libnvdimm subsystem and provide a first example of a Maintainer Entry Profile for others to duplicate and edit. Cc: Vishal Verma Cc: Dave Jiang Signed-off-by: Dan Williams Link: https://lore.kernel.org/r/157462919825.1729495.5877405723948988416.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Jonathan Corbet commit 4699c504e603e2b4e6217a81839d06c26cb2dad7 Author: Dan Williams Date: Sun Nov 24 12:59:53 2019 -0800 Maintainer Handbook: Maintainer Entry Profile As presented at the 2018 Linux Plumbers conference [1], the Maintainer Entry Profile (formerly Subsystem Profile) is proposed as a way to reduce friction between committers and maintainers and encourage conversations amongst maintainers about common best practices. While coding-style, submit-checklist, and submitting-drivers lay out some common expectations there remain local customs and maintainer preferences that vary by subsystem. The profile contains documentation of some of the common policy questions a contributor might have that are local to the subsystem / device-driver, special considerations for the subsystem, or other guidelines that are otherwise not covered by the top-level process documents. The initial and hopefully non-controversial headings in the profile are: Overview: General introduction to how the subsystem operates Submit Checklist Addendum: Mechanical items that gate submission staging, or other requirements that gate patch acceptance. Key Cycle Dates: - Last -rc for new feature submissions: Expected lead time for submissions - Last -rc to merge features: Deadline for merge decisions Resubmit Cadence: When and preferred method to follow up with the maintainer Note that coding style guidelines are explicitly left out of this list. See Documentation/maintainer/maintainer-entry-profile.rst for more details, and a follow-on example profile for the libnvdimm subsystem. [1]: https://linuxplumbersconf.org/event/2/contributions/59/ Cc: Jonathan Corbet Cc: Thomas Gleixner Cc: Mauro Carvalho Chehab Cc: Steve French Cc: Greg Kroah-Hartman Cc: Linus Torvalds Cc: Tobin C. Harding Cc: Olof Johansson Cc: Martin K. Petersen Cc: Daniel Vetter Cc: Joe Perches Cc: Dmitry Vyukov Cc: Alexandre Belloni Cc: Paul Walmsley Signed-off-by: Dan Williams Link: https://lore.kernel.org/r/157462919309.1729495.10585699280061787229.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Jonathan Corbet commit 1ca84ed6425f55aac68e3600122d04cd23c86d38 Author: Dan Williams Date: Sun Nov 24 12:59:48 2019 -0800 MAINTAINERS: Reclaim the P: tag for Maintainer Entry Profile Fixup some P: entries to be M: and delete the others that do not include an email address. The P: tag will be used to indicate the location of a Profile for a given MAINTAINERS entry. Cc: Joe Perches Signed-off-by: Dan Williams Link: https://lore.kernel.org/r/157462918794.1729495.10838545318307341653.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Jonathan Corbet commit 84a1f5b1cc6fd7f6cd99fc5630c36f631b19fa60 Author: Paulo Alcantara (SUSE) Date: Fri Nov 22 12:30:53 2019 -0300 cifs: Fix potential softlockups while refreshing DFS cache We used to skip reconnects on all SMB2_IOCTL commands due to SMB3+ FSCTL_VALIDATE_NEGOTIATE_INFO - which made sense since we're still establishing a SMB session. However, when refresh_cache_worker() calls smb2_get_dfs_refer() and we're under reconnect, SMB2_ioctl() will not be able to get a proper status error (e.g. -EHOSTDOWN in case we failed to reconnect) but an -EAGAIN from cifs_send_recv() thus looping forever in refresh_cache_worker(). Fixes: e99c63e4d86d ("SMB3: Fix deadlock in validate negotiate hits reconnect") Signed-off-by: Paulo Alcantara (SUSE) Suggested-by: Aurelien Aptel Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit df3df923b31d298c3d3653a0380202b9f2df9864 Author: Paulo Alcantara (SUSE) Date: Fri Nov 22 12:30:52 2019 -0300 cifs: Fix lookup of root ses in DFS referral cache We don't care about module aliasing validation in cifs_compose_mount_options(..., is_smb3) when finding the root SMB session of an DFS namespace in order to refresh DFS referral cache. The following issue has been observed when mounting with '-t smb3' and then specifying 'vers=2.0': ... Nov 08 15:27:08 tw kernel: address conversion returned 0 for FS0.WIN.LOCAL Nov 08 15:27:08 tw kernel: [kworke] ==> dns_query((null),FS0.WIN.LOCAL,13,(null)) Nov 08 15:27:08 tw kernel: [kworke] call request_key(,FS0.WIN.LOCAL,) Nov 08 15:27:08 tw kernel: [kworke] ==> dns_resolver_cmp(FS0.WIN.LOCAL,FS0.WIN.LOCAL) Nov 08 15:27:08 tw kernel: [kworke] <== dns_resolver_cmp() = 1 Nov 08 15:27:08 tw kernel: [kworke] <== dns_query() = 13 Nov 08 15:27:08 tw kernel: fs/cifs/dns_resolve.c: dns_resolve_server_name_to_ip: resolved: FS0.WIN.LOCAL to 192.168.30.26 ===> Nov 08 15:27:08 tw kernel: CIFS VFS: vers=2.0 not permitted when mounting with smb3 Nov 08 15:27:08 tw kernel: fs/cifs/dfs_cache.c: CIFS VFS: leaving refresh_tcon (xid = 26) rc = -22 ... Fixes: 5072010ccf05 ("cifs: Fix DFS cache refresher for DFS links") Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 8354d88efdab72b4da32fc4f032448fcef22dab4 Author: Paulo Alcantara (SUSE) Date: Fri Nov 22 12:30:51 2019 -0300 cifs: Fix use-after-free bug in cifs_reconnect() Ensure we grab an active reference in cifs superblock while doing failover to prevent automounts (DFS links) of expiring and then destroying the superblock pointer. This patch fixes the following KASAN report: [ 464.301462] BUG: KASAN: use-after-free in cifs_reconnect+0x6ab/0x1350 [ 464.303052] Read of size 8 at addr ffff888155e580d0 by task cifsd/1107 [ 464.304682] CPU: 3 PID: 1107 Comm: cifsd Not tainted 5.4.0-rc4+ #13 [ 464.305552] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58-rebuilt.opensuse.org 04/01/2014 [ 464.307146] Call Trace: [ 464.307875] dump_stack+0x5b/0x90 [ 464.308631] print_address_description.constprop.0+0x16/0x200 [ 464.309478] ? cifs_reconnect+0x6ab/0x1350 [ 464.310253] ? cifs_reconnect+0x6ab/0x1350 [ 464.311040] __kasan_report.cold+0x1a/0x41 [ 464.311811] ? cifs_reconnect+0x6ab/0x1350 [ 464.312563] kasan_report+0xe/0x20 [ 464.313300] cifs_reconnect+0x6ab/0x1350 [ 464.314062] ? extract_hostname.part.0+0x90/0x90 [ 464.314829] ? printk+0xad/0xde [ 464.315525] ? _raw_spin_lock+0x7c/0xd0 [ 464.316252] ? _raw_read_lock_irq+0x40/0x40 [ 464.316961] ? ___ratelimit+0xed/0x182 [ 464.317655] cifs_readv_from_socket+0x289/0x3b0 [ 464.318386] cifs_read_from_socket+0x98/0xd0 [ 464.319078] ? cifs_readv_from_socket+0x3b0/0x3b0 [ 464.319782] ? try_to_wake_up+0x43c/0xa90 [ 464.320463] ? cifs_small_buf_get+0x4b/0x60 [ 464.321173] ? allocate_buffers+0x98/0x1a0 [ 464.321856] cifs_demultiplex_thread+0x218/0x14a0 [ 464.322558] ? cifs_handle_standard+0x270/0x270 [ 464.323237] ? __switch_to_asm+0x40/0x70 [ 464.323893] ? __switch_to_asm+0x34/0x70 [ 464.324554] ? __switch_to_asm+0x40/0x70 [ 464.325226] ? __switch_to_asm+0x40/0x70 [ 464.325863] ? __switch_to_asm+0x34/0x70 [ 464.326505] ? __switch_to_asm+0x40/0x70 [ 464.327161] ? __switch_to_asm+0x34/0x70 [ 464.327784] ? finish_task_switch+0xa1/0x330 [ 464.328414] ? __switch_to+0x363/0x640 [ 464.329044] ? __schedule+0x575/0xaf0 [ 464.329655] ? _raw_spin_lock_irqsave+0x82/0xe0 [ 464.330301] kthread+0x1a3/0x1f0 [ 464.330884] ? cifs_handle_standard+0x270/0x270 [ 464.331624] ? kthread_create_on_node+0xd0/0xd0 [ 464.332347] ret_from_fork+0x35/0x40 [ 464.333577] Allocated by task 1110: [ 464.334381] save_stack+0x1b/0x80 [ 464.335123] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 464.335848] cifs_smb3_do_mount+0xd4/0xb00 [ 464.336619] legacy_get_tree+0x6b/0xa0 [ 464.337235] vfs_get_tree+0x41/0x110 [ 464.337975] fc_mount+0xa/0x40 [ 464.338557] vfs_kern_mount.part.0+0x6c/0x80 [ 464.339227] cifs_dfs_d_automount+0x336/0xd29 [ 464.339846] follow_managed+0x1b1/0x450 [ 464.340449] lookup_fast+0x231/0x4a0 [ 464.341039] path_openat+0x240/0x1fd0 [ 464.341634] do_filp_open+0x126/0x1c0 [ 464.342277] do_sys_open+0x1eb/0x2c0 [ 464.342957] do_syscall_64+0x5e/0x190 [ 464.343555] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 464.344772] Freed by task 0: [ 464.345347] save_stack+0x1b/0x80 [ 464.345966] __kasan_slab_free+0x12c/0x170 [ 464.346576] kfree+0xa6/0x270 [ 464.347211] rcu_core+0x39c/0xc80 [ 464.347800] __do_softirq+0x10d/0x3da [ 464.348919] The buggy address belongs to the object at ffff888155e58000 which belongs to the cache kmalloc-256 of size 256 [ 464.350222] The buggy address is located 208 bytes inside of 256-byte region [ffff888155e58000, ffff888155e58100) [ 464.351575] The buggy address belongs to the page: [ 464.352333] page:ffffea0005579600 refcount:1 mapcount:0 mapping:ffff88815a803400 index:0x0 compound_mapcount: 0 [ 464.353583] flags: 0x200000000010200(slab|head) [ 464.354209] raw: 0200000000010200 ffffea0005576200 0000000400000004 ffff88815a803400 [ 464.355353] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 464.356458] page dumped because: kasan: bad access detected [ 464.367005] Memory state around the buggy address: [ 464.367787] ffff888155e57f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 464.368877] ffff888155e58000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 464.369967] >ffff888155e58080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 464.371111] ^ [ 464.371775] ffff888155e58100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 464.372893] ffff888155e58180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 464.373983] ================================================================== Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Aurelien Aptel Signed-off-by: Steve French commit 790591f41ede7b6fcfea8753dfb4030752dbfbec Author: Andy Shevchenko Date: Wed Nov 20 17:19:32 2019 +0200 i2c: i801: Correct Intel Jasper Lake SOC naming There is no suffix applied to Intel Jasper Lake SOC. Remove it from the comments and definitions. Besides that, it's a SOC, thus replace PCH with SOC where it appropriate. Fixes: e0c61c04791a ("i2c: i801: Add support for Intel Jasper Lake") Cc: Jarkko Nikula Signed-off-by: Andy Shevchenko Reviewed-by: Jarkko Nikula Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 7787657d7ee55a9ecf4aea4907b46b87a44eda67 Author: Alain Volmat Date: Tue Nov 12 09:19:44 2019 +0100 i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop Fix a typo in the free slave id search loop. Instead of I2C_CLIENT_PEC, it should have been I2C_CLIENT_TEN. The slave id 1 can only handle 7-bit addresses and thus is not eligible in case of 10-bit addresses. As a matter of fact none of the slave id support I2C_CLIENT_PEC, overall check is performed at the beginning of the stm32f7_i2c_reg_slave function. Fixes: 60d609f30de2 ("i2c: i2c-stm32f7: Add slave support") Signed-off-by: Alain Volmat Reviewed-by: Pierre-Yves MORDRET Signed-off-by: Wolfram Sang commit 436e25505f3458cc92c7f3c985e9cbc198a98209 Author: Jian-Hong Pan Date: Mon Nov 25 17:34:06 2019 +0800 ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC Laptops like ASUS UX431FLC and UX431FL can share the same audio quirks. But UX431FLC needs one more step to enable the internal speaker: Pull the GPIO from CODEC to initialize the AMP. Fixes: 60083f9e94b2 ("ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL") Signed-off-by: Jian-Hong Pan Cc: Link: https://lore.kernel.org/r/20191125093405.5702-1-jian-hong@endlessm.com Signed-off-by: Takashi Iwai commit 83bae01182ea755280adc1c3a24032d63a614ede Merge: cf25e24db61c 7b8474466ed9 Author: Ingo Molnar Date: Mon Nov 25 15:43:15 2019 +0100 Merge branch 'timers/urgent' into timers/core, to pick up fix Signed-off-by: Ingo Molnar commit 311770173fac27845a3a83e2c16100a54d308f72 Author: Chris Wilson Date: Mon Nov 25 10:58:58 2019 +0000 drm/i915/gt: Schedule request retirement when timeline idles The major drawback of commit 7e34f4e4aad3 ("drm/i915/gen8+: Add RC6 CTX corruption WA") is that it disables RC6 while Skylake (and friends) is active, and we do not consider the GPU idle until all outstanding requests have been retired and the engine switched over to the kernel context. If userspace is idle, this task falls onto our background idle worker, which only runs roughly once a second, meaning that userspace has to have been idle for a couple of seconds before we enable RC6 again. Naturally, this causes us to consume considerably more energy than before as powersaving is effectively disabled while a display server (here's looking at you Xorg) is running. As execlists will get a completion event as each context is completed, we can use this interrupt to queue a retire worker bound to this engine to cleanup idle timelines. We will then immediately notice the idle engine (without userspace intervention or the aid of the background retire worker) and start parking the GPU. Thus during light workloads, we will do much more work to idle the GPU faster... Hopefully with commensurate power saving! v2: Watch context completions and only look at those local to the engine when retiring to reduce the amount of excess work we perform. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112315 References: 7e34f4e4aad3 ("drm/i915/gen8+: Add RC6 CTX corruption WA") References: 2248a28384fe ("drm/i915/gen8+: Add RC6 CTX corruption WA") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191125105858.1718307-3-chris@chris-wilson.co.uk (cherry picked from commit 4f88f8747fa43c97c3b3712d8d87295ea757cc51) Signed-off-by: Joonas Lahtinen commit a09c2860ae4fcf4d7e25202661f3eb868547cddb Author: Chris Wilson Date: Mon Nov 25 10:58:57 2019 +0000 drm/i915/gt: Adapt engine_park synchronisation rules for engine_retire In the next patch, we will introduce a new asynchronous retirement worker, fed by execlists CS events. Here we may queue a retirement as soon as a request is submitted to HW (and completes instantly), and we also want to process that retirement as early as possible and cannot afford to postpone (as there may not be another opportunity to retire it for a few seconds). To allow the new async retirer to run in parallel with our submission, pull the __i915_request_queue (that passes the request to HW) inside the timelines spinlock so that the retirement cannot release the timeline before we have completed the submission. v2: Actually to play nicely with engine_retire, we have to raise the timeline.active_lock before releasing the HW. intel_gt_retire_requsts() is still serialised by the outer lock so they cannot see this intermediate state, and engine_retire is serialised by HW submission. Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191125105858.1718307-2-chris@chris-wilson.co.uk (cherry picked from commit 88a4655e75ac8f55eea5e3f38b176cba9cf653b5) Signed-off-by: Joonas Lahtinen commit 4ec5cc78c1b06f8d30b5c682acccf17fb5191cf2 Author: Chris Wilson Date: Mon Nov 25 11:25:20 2019 +0000 drm/i915/execlists: Fixup cancel_port_requests() I rushed a last minute correction to cancel_port_requests() to prevent the snooping of *execlists->active as the inflight array was being updated, without noticing we iterated the inflight array starting from active! Oops. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112387 Fixes: 97f9af78f38d ("drm/i915/gt: Mark the execlists->active as the primary volatile access") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Reviewed-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20191125112520.1760492-1-chris@chris-wilson.co.uk (cherry picked from commit da0ef77e1e0ccff703efee82406c629d5c4f4bbb) [Joonas: Fixed Fixes: tag to match drm-intel-next-fixes] Signed-off-by: Joonas Lahtinen commit 97f9af78f38d43cd058cfd40220647be67aca9f7 Author: Chris Wilson Date: Mon Nov 25 09:43:18 2019 +0000 drm/i915/gt: Mark the execlists->active as the primary volatile access Since we want to do a lockless read of the current active request, and that request is written to by process_csb also without serialisation, we need to instruct gcc to take care in reading the pointer itself. Otherwise, we have observed execlists_active() to report 0x40. [ 2400.760381] igt/para-4098 1..s. 2376479300us : process_csb: rcs0 cs-irq head=3, tail=4 [ 2400.760826] igt/para-4098 1..s. 2376479303us : process_csb: rcs0 csb[4]: status=0x00000001:0x00000000 [ 2400.761271] igt/para-4098 1..s. 2376479306us : trace_ports: rcs0: promote { b9c59:2622, b9c55:2624 } [ 2400.761726] igt/para-4097 0d... 2376479311us : __i915_schedule: rcs0: -2147483648->3, inflight:0000000000000040, rq:ffff888208c1e940 which is impossible! The answer is that as we keep the existing execlists->active pointing into the array as we copy over that array, the unserialised read may see a partial pointer value. Fixes: df403069029d ("drm/i915/execlists: Lift process_csb() out of the irq-off spinlock") Signed-off-by: Chris Wilson Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20191125094318.1630806-1-chris@chris-wilson.co.uk (cherry picked from commit 331bf90591573dfe6c8e892239713ef9702f1396) Signed-off-by: Joonas Lahtinen commit f295e4cece5cb4c60715fed539abcd62468f9ef1 Author: Yixian Liu Date: Mon Nov 18 10:34:53 2019 +0800 RDMA/hns: Delete unnecessary callback functions for cq Currently, when cq event occurred, we first call our own callback functions in the event process function, then call ib callback functions. Actually, we can directly call ib callback functions. Link: https://lore.kernel.org/r/1574044493-46984-5-git-send-email-liweihang@hisilicon.com Signed-off-by: Yixian Liu Signed-off-by: Weihang Li Signed-off-by: Jason Gunthorpe commit 707783ab5f48f054f8da3114ddcdf1685a313a63 Author: Yixian Liu Date: Mon Nov 18 10:34:52 2019 +0800 RDMA/hns: Rename the functions used inside creating cq Current names of functions are not proper, such as hns_roce_free_cq, actually it means free cqc, thus we rename them. Furthermore, functions used inside one file can be named without the prefix hns_roce_ which will make the functions for verbs symbols more eye-catching. Link: https://lore.kernel.org/r/1574044493-46984-4-git-send-email-liweihang@hisilicon.com Signed-off-by: Yixian Liu Signed-off-by: Weihang Li Signed-off-by: Jason Gunthorpe commit 18a96d25ce84a365fbe9ddcb887ade80eb3a6017 Author: Yixian Liu Date: Mon Nov 18 10:34:51 2019 +0800 RDMA/hns: Redefine the member of hns_roce_cq struct There is no need to package buf and mtt into hns_roce_cq_buf, which will make code more complex, just delete this struct and move buf and mtt into hns_roce_cq. Furthermore, we add size member for hns_roce_buf to avoid repeatly calculating where needed it. Link: https://lore.kernel.org/r/1574044493-46984-3-git-send-email-liweihang@hisilicon.com Signed-off-by: Yixian Liu Signed-off-by: Weihang Li Signed-off-by: Jason Gunthorpe commit e2b2744a06d35ba44f32c86e0579d986931187b3 Author: Yixian Liu Date: Mon Nov 18 10:34:50 2019 +0800 RDMA/hns: Redefine interfaces used in creating cq Some interfaces defined with unnecessary input parameters, such as "nent" and "vector". This patch redefined these interfaces to make the code more readable and simple. Link: https://lore.kernel.org/r/1574044493-46984-2-git-send-email-liweihang@hisilicon.com Signed-off-by: Yixian Liu Signed-off-by: Weihang Li Signed-off-by: Jason Gunthorpe commit 666e8ff535d401eb286fa20446e55ae984d91049 Author: Daniel Kranzdorf Date: Thu Nov 21 16:15:09 2019 +0200 RDMA/efa: Expose RDMA read related attributes Query the device attributes for RDMA operations, including maximum transfer size and maximum number of SGEs per RDMA WR, and report them back to the userspace library. Link: https://lore.kernel.org/r/20191121141509.59297-4-galpress@amazon.com Signed-off-by: Daniel Kranzdorf Reviewed-by: Yossi Leybovich Signed-off-by: Gal Pressman Signed-off-by: Jason Gunthorpe commit e6c4f3ff434c8b336662a2053d48ce677c9fd608 Author: Daniel Kranzdorf Date: Thu Nov 21 16:15:08 2019 +0200 RDMA/efa: Support remote read access in MR registration Enable remote read access for memory regions in order to support RDMA operations. Link: https://lore.kernel.org/r/20191121141509.59297-3-galpress@amazon.com Signed-off-by: Daniel Kranzdorf Reviewed-by: Yossi Leybovich Signed-off-by: Gal Pressman Signed-off-by: Jason Gunthorpe commit bcf7cc534cd40f8098850274e8459fb0d088fcda Author: Gal Pressman Date: Thu Nov 21 16:15:07 2019 +0200 RDMA/efa: Store network attributes in device attributes There's no reason to separate the network attributes from all other device attributes. Embed the fields inside the device attributes and query them all in one function. Link: https://lore.kernel.org/r/20191121141509.59297-2-galpress@amazon.com Reviewed-by: Daniel Kranzdorf Reviewed-by: Yossi Leybovich Signed-off-by: Gal Pressman Signed-off-by: Jason Gunthorpe commit 25d24f4241f7bccdc1978daa026d8847e04a73a6 Author: Colin Ian King Date: Fri Nov 22 15:48:14 2019 +0000 IB/hfi1: remove redundant assignment to variable ret The variable ret is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Link: https://lore.kernel.org/r/20191122154814.87257-1-colin.king@canonical.com Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Acked-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit fca5b9dc0986aa49b3f0a7cfe24b6c82422ac1d7 Author: Devesh Sharma Date: Thu Nov 21 01:22:23 2019 -0500 RDMA/bnxt_re: Fix missing le16_to_cpu From sparse: drivers/infiniband/hw/bnxt_re/main.c:1274:18: warning: cast from restricted __le16 drivers/infiniband/hw/bnxt_re/main.c:1275:18: warning: cast from restricted __le16 drivers/infiniband/hw/bnxt_re/main.c:1276:18: warning: cast from restricted __le16 drivers/infiniband/hw/bnxt_re/main.c:1277:21: warning: restricted __le16 degrades to integer Fixes: 2b827ea1926b ("RDMA/bnxt_re: Query HWRM Interface version from FW") Link: https://lore.kernel.org/r/1574317343-23300-4-git-send-email-devesh.sharma@broadcom.com Signed-off-by: Devesh Sharma Signed-off-by: Jason Gunthorpe commit 98998ffe5216c7fa2c0225bb5b049ca5cdf8d195 Author: Devesh Sharma Date: Thu Nov 21 01:22:22 2019 -0500 RDMA/bnxt_re: Fix stat push into dma buffer on gen p5 devices Due to recent advances in the firmware for Broadcom's gen p5 series of adaptors the driver code to report hardware counters has been broken w.r.t. roce devices. The new firmware command expects dma length to be specified during stat dma buffer allocation. Fixes: 2792b5b95ed5 ("bnxt_en: Update firmware interface spec. to 1.10.0.89.") Link: https://lore.kernel.org/r/1574317343-23300-3-git-send-email-devesh.sharma@broadcom.com Signed-off-by: Devesh Sharma Signed-off-by: Jason Gunthorpe commit e284b159c6881c8bec9713daba2653268f4c4948 Author: Luke Starrett Date: Thu Nov 21 01:22:21 2019 -0500 RDMA/bnxt_re: Fix chip number validation Broadcom's Gen P5 series In the first version of Gen P5 ASIC, chip-id was always set to 0x1750 for all adaptor port configurations. This has been fixed in the new chip rev. Due to this missing fix users are not able to use adaptors based on latest chip rev of Broadcom's Gen P5 adaptors. Fixes: ae8637e13185 ("RDMA/bnxt_re: Add chip context to identify 57500 series") Link: https://lore.kernel.org/r/1574317343-23300-2-git-send-email-devesh.sharma@broadcom.com Signed-off-by: Naresh Kumar PBS Signed-off-by: Selvin Xavier Signed-off-by: Luke Starrett Signed-off-by: Devesh Sharma Signed-off-by: Jason Gunthorpe commit 6e419e35e68ad7327a383cd52053071b8eb9843b Author: Krzysztof Kozlowski Date: Wed Nov 20 21:41:38 2019 +0800 RDMA/bnxt_re: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Link: https://lore.kernel.org/r/20191120134138.15245-1-krzk@kernel.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jason Gunthorpe commit 3694e41e41517994664518ece6265f0bc04a840d Merge: a25984f3baaa 9c0015ef0928 Author: Jason Gunthorpe Date: Fri Nov 22 16:08:34 2019 -0400 Merge branch 'ib-guids' into rdma.git for-next Danit Goldberg says: ==================== This series extends RTNETLINK to provide IB port and node GUIDs, which were configured for Infiniband VFs. The functionality to set VF GUIDs already existed for a long time, and here we are adding the missing "get" so that netlink will be symmetric and various cloud orchestration tools will be able to manage such VFs more naturally. The iproute2 was extended too to present those GUIDs. - ip link show For example: - ip link set ib4 vf 0 node_guid 22:44:33:00:33:11:00:33 - ip link set ib4 vf 0 port_guid 10:21:33:12:00:11:22:10 - ip link show ib4 ib4: mtu 4092 qdisc noop state DOWN mode DEFAULT group default qlen 256 link/infiniband 00:00:0a:2d:fe:80:00:00:00:00:00:00:ec:0d:9a:03:00:44:36:8d brd 00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff vf 0 link/infiniband 00:00:0a:2d:fe:80:00:00:00:00:00:00:ec:0d:9a:03:00:44:36:8d brd 00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff, spoof checking off, NODE_GUID 22:44:33:00:33:11:00:33, PORT_GUID 10:21:33:12:00:11:22:10, link-state disable, trust off, query_rss off ==================== Based on the mlx5-next branch from git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux for dependencies * branch 'ib-guids': (35 commits) IB/mlx5: Implement callbacks for getting VFs GUID attributes IB/ipoib: Add ndo operation for getting VFs GUID attributes IB/core: Add interfaces to get VF node and port GUIDs net/core: Add support for getting VF GUIDs net/mlx5: Add new chain for netfilter flow table offload net/mlx5: Refactor creating fast path prio chains net/mlx5: Accumulate levels for chains prio namespaces net/mlx5: Define fdb tc levels per prio net/mlx5: Rename FDB_* tc related defines to FDB_TC_* defines net/mlx5: Simplify fdb chain and prio eswitch defines IB/mlx5: Load profile according to RoCE enablement state IB/mlx5: Rename profile and init methods net/mlx5: Handle "enable_roce" devlink param net/mlx5: Document flow_steering_mode devlink param devlink: Add new "enable_roce" generic device param net/mlx5: fix spelling mistake "metdata" -> "metadata" net/mlx5: fix kvfree of uninitialized pointer spec IB/mlx5: Introduce and use mlx5_core_is_vf() net/mlx5: E-switch, Enable metadata on own vport net/mlx5: Refactor ingress acl configuration ... Signed-off-by: Jason Gunthorpe commit 9c7315c9fca5de203538163cf42699bb10328902 Author: Jarkko Nikula Date: Mon Nov 25 14:51:59 2019 +0200 spi: pxa2xx: Add support for Intel Jasper Lake LPSS SPI on Intel Jasper Lake is compatible with Intel Ice Lake which follows Intel Cannon Lake. Add PCI IDs of Jasper Lake. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20191125125159.15404-1-jarkko.nikula@linux.intel.com Signed-off-by: Mark Brown commit bc094709de0192a756c6946a7c89c543243ae609 Author: Shuming Fan Date: Mon Nov 25 17:19:40 2019 +0800 ASoC: rt5682: fix i2c arbitration lost issue This patch modified the HW initial setting to fix i2c arbitration lost issue. Signed-off-by: Shuming Fan Link: https://lore.kernel.org/r/20191125091940.11953-1-shumingf@realtek.com Signed-off-by: Mark Brown commit bf201f5eda23eb57f7217d20ea3e18da8cbcf52b Author: Chris Wilson Date: Wed Nov 20 16:55:14 2019 +0000 drm/i915/gt: Unlock engine-pm after queuing the kernel context switch In commit a79ca656b648 ("drm/i915: Push the wakeref->count deferral to the backend"), I erroneously concluded that we last modify the engine inside __i915_request_commit() meaning that we could enable concurrent submission for userspace as we enqueued this request. However, this falls into a trap with other users of the engine->kernel_context waking up and submitting their request before the idle-switch is queued, with the result that the kernel_context is executed out-of-sequence most likely upsetting the GPU and certainly ourselves when we try to retire the out-of-sequence requests. As such we need to hold onto the effective engine->kernel_context mutex lock (via the engine pm mutex proxy) until we have finish queuing the request to the engine. v2: Serialise against concurrent intel_gt_retire_requests() v3: Describe the hairy locking scheme with intel_gt_retire_requests() for future reference. v4: Combine timeline->lock and engine pm release; it's hairy. Fixes: a79ca656b648 ("drm/i915: Push the wakeref->count deferral to the backend") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191120165514.3955081-2-chris@chris-wilson.co.uk (cherry picked from commit 5cba288466e9b229feb68295675246e7522fb5eb) Signed-off-by: Joonas Lahtinen commit ca1711d1991f968d1e88725a2e607e57ecd5c5f1 Author: Chris Wilson Date: Wed Nov 20 16:55:13 2019 +0000 drm/i915/gt: Close race between engine_park and intel_gt_retire_requests The general concept was that intel_timeline.active_count was locked by the intel_timeline.mutex. The exception was for power management, where the engine->kernel_context->timeline could be manipulated under the global wakeref.mutex. This was quite solid, as we always manipulated the timeline only while we held an engine wakeref. And then we started retiring requests outside of struct_mutex, only using the timelines.active_list and the timeline->mutex. There we started manipulating intel_timeline.active_count outside of an engine wakeref, and so introduced a race between __engine_park() and intel_gt_retire_requests(), a race that could result in the engine->kernel_context not being added to the active timelines and so losing requests, which caused us to keep the system permanently powered up [and unloadable]. The race would be easy to close if we could take the engine wakeref for the timeline before we retire -- except timelines are not bound to any engine and so we would need to keep all active engines awake. The alternative is to guard intel_timeline_enter/intel_timeline_exit for use outside of the timeline->mutex. Fixes: e5dadff4b093 ("drm/i915: Protect request retirement with timeline->mutex") Signed-off-by: Chris Wilson Cc: Matthew Auld Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191120165514.3955081-1-chris@chris-wilson.co.uk (cherry picked from commit a6edbca74b305adc165e67065d7ee766006e6a48) Signed-off-by: Joonas Lahtinen commit ee33baa83109612d9a31fc2c2a7b74967767b358 Author: Chris Wilson Date: Wed Nov 20 12:54:33 2019 +0000 drm/i915: Mark up the calling context for intel_wakeref_put() Previously, we assumed we could use mutex_trylock() within an atomic context, falling back to a worker if contended. However, such trickery is illegal inside interrupt context, and so we need to always use a worker under such circumstances. As we normally are in process context, we can typically use a plain mutex, and only defer to a work when we know we are being called from an interrupt path. Fixes: 51fbd8de87dc ("drm/i915/pmu: Atomically acquire the gt_pm wakeref") References: a0855d24fc22d ("locking/mutex: Complain upon mutex API misuse in IRQ contexts") References: https://bugs.freedesktop.org/show_bug.cgi?id=111626 Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191120125433.3767149-1-chris@chris-wilson.co.uk (cherry picked from commit 07779a76ee1f93f930cf697b22be73d16e14f50c) Signed-off-by: Joonas Lahtinen commit f83d7e3f5189eb78e481cd02da93e4e32a253493 Author: Chris Wilson Date: Mon Nov 18 23:02:46 2019 +0000 drm/i915: Wait until the intel_wakeref idle callback is complete When waiting for idle, serialise with any ongoing callback so that it will have completed before completing the wait. Signed-off-by: Chris Wilson Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191118230254.2615942-12-chris@chris-wilson.co.uk (cherry picked from commit f4ba0707c825d60f1d0f5ce7bd3d875e68f3e204) Signed-off-by: Joonas Lahtinen commit 732f9ca4a737aea3983ad86007e88e7fffe8cd6a Author: Chris Wilson Date: Wed Nov 20 18:22:09 2019 +0000 drm/i915/gt: Fixup config ifdeffery for pm_suspend_target_state pm_suspend_target_state is declared under CONFIG_PM_SLEEP but only defined under CONFIG_SUSPEND. Play safe and only use the symbol if it is both declared and defined. Reported-by: kbuild-all@lists.01.org Signed-off-by: Chris Wilson Fixes: a70a9e998e8e ("drm/i915: Defer rc6 shutdown to suspend_late") Cc: Andi Shyti Cc: Joonas Lahtinen Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20191120182209.3967833-1-chris@chris-wilson.co.uk Signed-off-by: Joonas Lahtinen commit 09578eacaaa44149738267083ccc050990409f86 Merge: c6b6fc206586 8c4d2a0bfbd2 Author: Takashi Iwai Date: Mon Nov 25 14:27:33 2019 +0100 Merge tag 'asoc-v5.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: More updates for v5.5 Some more development work for v5.5. Highlights include: - More cleanups from Morimoto-san. - Trigger word detection for RT5677. Signed-off-by: Takashi Iwai commit 03a2a606066cf8af7a090669848e4e84351ded06 Author: Tvrtko Ursulin Date: Fri Nov 22 10:41:15 2019 +0000 drm/i915/query: Align flavour of engine data lookup Commit 750e76b4f9f6 ("drm/i915/gt: Move the [class][inst] lookup for engines onto the GT") changed the engine query to iterate over uabi engines but left the buffer size calculation look at the physical engine count. Difference has no practical consequence but it is nicer to align both queries. Signed-off-by: Tvrtko Ursulin Fixes: 750e76b4f9f6 ("drm/i915/gt: Move the [class][inst] lookup for engines onto the GT") Cc: Chris Wilson Cc: Daniele Ceraolo Spurio Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20191122104115.29610-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 9acc99d8f278e3da398e927774431bd3e947ab2e) Signed-off-by: Joonas Lahtinen commit 198dfe671fdfdb79755aa131c191a4cb10a2a8b7 Author: Matt Roper Date: Mon Nov 18 10:02:19 2019 -0800 drm/i915/tgl: Add DKL PHY vswing table for HDMI The bspec initially provided a single DKL PHY vswing table for both HDMI and DP, but was recently updated to include an independent table for HDMI. Bspec: 49292 Fixes: 978c3e539be2 ("drm/i915/tgl: Add dkl phy programming sequences") Cc: Clinton A Taylor Cc: Lucas De Marchi Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20191118180219.9309-1-matthew.d.roper@intel.com Reviewed-by: José Roberto de Souza (cherry picked from commit 362bfb995b78394aefe61f7cc0511ef7c50bb11e) Signed-off-by: Joonas Lahtinen commit d74a7566bef76b44416071fbb7e34f301eac8d98 Author: Matt Roper Date: Mon Nov 18 08:44:12 2019 -0800 drm/i915/ehl: Update voltage level checks The bspec was recently updated with new cdclk -> voltage level tables to accommodate the new 324/326.4 cdclk values. Bspec: 21809 Fixes: 63c9dae71dc5 ("drm/i915/ehl: Add voltage level requirement table") Cc: José Roberto de Souza Cc: Vivek Kasireddy Cc: Bob Paauwe Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20191118164412.26216-1-matthew.d.roper@intel.com Reviewed-by: José Roberto de Souza (cherry picked from commit d147483884ed08ee6bb618ef610ee0329a27fda7) Signed-off-by: Joonas Lahtinen commit 0e672adc87e5ae1758b6e0571b42d743a8324327 Merge: d891433b8d55 ecd25094c5f5 Author: Petr Mladek Date: Mon Nov 25 13:53:49 2019 +0100 Merge branch 'for-5.5/system-state' into for-linus commit d891433b8d554731e1d54c4ed04045479e1cff37 Merge: e9f37e090058 29d968e13007 Author: Petr Mladek Date: Mon Nov 25 13:53:15 2019 +0100 Merge branch 'for-5.5/selftests' into for-linus commit de881a341c4143650fa50ce95cf450a5c94faa9f Merge: 8392853e964c d61ca3c25e03 Author: Ingo Molnar Date: Mon Nov 25 13:48:11 2019 +0100 Merge branch 'sched/rt' into sched/core, to pick up commit Signed-off-by: Ingo Molnar commit 831362fc317ae60413879deacdcc9617d9ce9e20 Author: Masahiro Yamada Date: Sun Nov 24 01:04:44 2019 +0900 scripts/kallsyms: remove redundant initializers These are set to zero without the explicit initializers. Signed-off-by: Masahiro Yamada commit d44270fc976b6c3b9e742e398580e4af8c69f7bd Author: Masahiro Yamada Date: Sun Nov 24 01:04:43 2019 +0900 scripts/kallsyms: put check_symbol_range() calls close together Put the relevant code close together. Signed-off-by: Masahiro Yamada commit b6233d0ded3391a33bb0047edafe15169131eadb Author: Masahiro Yamada Date: Sun Nov 24 01:04:42 2019 +0900 scripts/kallsyms: make check_symbol_range() void function There is no more reason to check the return value of check_symbol_range(). Signed-off-by: Masahiro Yamada commit 887df76de67f5a6dd423e5763c22ff07f0e50048 Author: Masahiro Yamada Date: Sun Nov 24 01:04:41 2019 +0900 scripts/kallsyms: move ignored symbol types to is_ignored_symbol() Collect the ignored patterns to is_ignored_symbol(). Signed-off-by: Masahiro Yamada commit 97261e1e2240f627e27e93f7e410be1a7c97c80a Author: Masahiro Yamada Date: Sun Nov 24 01:04:40 2019 +0900 scripts/kallsyms: move more patterns to the ignored_prefixes array Refactoring for shortening the code. Signed-off-by: Masahiro Yamada commit a41333e06acd1b37f3a3248fb90cd417218f9439 Author: Masahiro Yamada Date: Sun Nov 24 01:04:39 2019 +0900 scripts/kallsyms: skip ignored symbols very early Unless the address range matters, symbols can be ignored earlier, which avoids unneeded memory allocation. Signed-off-by: Masahiro Yamada commit 4bfe2b7816a6e97fba7b4125166b33db4b31d29d Author: Masahiro Yamada Date: Sun Nov 24 01:04:38 2019 +0900 scripts/kallsyms: add const qualifiers where possible Add 'const' where a function does not write to the pointer dereferenes. Signed-off-by: Masahiro Yamada commit 2558c138aca75e5fc435e20fd37f0b0eea61bb65 Author: Masahiro Yamada Date: Sun Nov 24 01:04:37 2019 +0900 scripts/kallsyms: make find_token() return (unsigned char *) The callers of this function expect (unsigned char *). I do not see a good reason to make this function return (void *). Signed-off-by: Masahiro Yamada commit aa915245005bdb45ccbc96964853b4a27646390f Author: Masahiro Yamada Date: Sun Nov 24 01:04:36 2019 +0900 scripts/kallsyms: replace prefix_underscores_count() with strspn() You can do equivalent things with strspn(). I do not see noticeable performance difference. Signed-off-by: Masahiro Yamada commit 29e55ad3d5f50eca6f8762749da85d6fa1250061 Author: Masahiro Yamada Date: Sun Nov 24 01:04:35 2019 +0900 scripts/kallsyms: add sym_name() to mitigate cast ugliness sym_entry::sym is (unsigned char *) instead of (char *) because kallsyms exploits the MSB for compression, and the characters are used as the index of token_profit array. However, it requires casting (unsigned char *) to (char *) in some places since standard library functions such as strcmp(), strlen() expect (char *). Introduce a new helper, sym_name(), which advances the given pointer by 1 and casts it to (char *). Signed-off-by: Masahiro Yamada commit c5e5002f3603e01f50d8d61878a4ca8ffca7bd15 Author: Masahiro Yamada Date: Sun Nov 24 01:04:34 2019 +0900 scripts/kallsyms: remove unneeded length check for prefix matching l <= strlen(sym_name) is unnecessary for prefix matching. strncmp() will do. Signed-off-by: Masahiro Yamada commit e0109042cc4ee12b3689e29c872c1436e0424c69 Author: Masahiro Yamada Date: Sun Nov 24 01:04:33 2019 +0900 scripts/kallsyms: remove redundant is_arm_mapping_symbol() Since commit 6f00df24ee39 ("[PATCH] Strip local symbols from kallsyms"), all symbols starting '$' are ignored. is_arm_mapping_symbol() particularly ignores $a, $t, etc. but it is redundant. Signed-off-by: Masahiro Yamada commit f34ea0291029781810ca4c213713dc6b4a686322 Author: Masahiro Yamada Date: Sun Nov 24 01:04:32 2019 +0900 scripts/kallsyms: set relative_base more effectively Currently, record_relative_base() iterates over the entire table to find the minimum address, but it is not efficient because we sort the table anyway. After sort_symbol(), the table is sorted by address. (kallsyms parses the 'nm -n' output, so the data is already sorted by address, but this commit does not rely on it.) Move record_relative_base() after sort_symbols(), and take the first non-absolute symbol value. Signed-off-by: Masahiro Yamada commit 5e5c4fa787453292d3deefd59129384d391b7f45 Author: Masahiro Yamada Date: Sun Nov 24 01:04:31 2019 +0900 scripts/kallsyms: shrink table before sorting it Currently, build_initial_tok_table() trims unused symbols, but it is called after sort_symbols(). It is not efficient to sort the huge table that contains unused entries. Shrink the table before sorting it. Signed-off-by: Masahiro Yamada commit 21915eca088dc271c970e8351290e83d938114ac Author: Masahiro Yamada Date: Sun Nov 24 01:04:30 2019 +0900 scripts/kallsyms: fix definitely-lost memory leak build_initial_tok_table() overwrites unused sym_entry to shrink the table size. Before the entry is overwritten, table[i].sym must be freed since it is malloc'ed data. This fixes the 'definitely lost' report from valgrind. I ran valgrind against x86_64_defconfig of v5.4-rc8 kernel, and here is the summary: [Before the fix] LEAK SUMMARY: definitely lost: 53,184 bytes in 2,874 blocks [After the fix] LEAK SUMMARY: definitely lost: 0 bytes in 0 blocks Signed-off-by: Masahiro Yamada commit 1ef26b7c948128dc9240939da06690bfd90f4607 Author: Masahiro Yamada Date: Sun Nov 24 01:04:29 2019 +0900 scripts/kallsyms: remove unneeded #ifndef ARRAY_SIZE This is not defined in the standard headers. #ifndef is unneeded. Signed-off-by: Masahiro Yamada commit f3e4f3fc8ee9729c4b1b27a478c68b713df53c0c Author: Hans de Goede Date: Fri Nov 22 19:56:41 2019 +0100 platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size The AML code implementing the WMI methods creates a variable length field to hold the input data we pass like this: CreateDWordField (Arg1, 0x0C, DSZI) Local5 = DSZI /* \HWMC.DSZI */ CreateField (Arg1, 0x80, (Local5 * 0x08), DAIN) If we pass 0 as bios_args.datasize argument then (Local5 * 0x08) is 0 which results in these errors: [ 71.973305] ACPI BIOS Error (bug): Attempt to CreateField of length zero (20190816/dsopcode-133) [ 71.973332] ACPI Error: Aborting method \HWMC due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529) [ 71.973413] ACPI Error: Aborting method \_SB.WMID.WMAA due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529) And in our HPWMI_WIRELESS2_QUERY calls always failing. for read commands like HPWMI_WIRELESS2_QUERY the DSZI value is not used / checked, except for read commands where extra input is needed to specify exactly what to read. So for HPWMI_WIRELESS2_QUERY we can safely pass the size of the expected output as insize to hp_wmi_perform_query(), as we are already doing for all other HPWMI_READ commands we send. Doing so fixes these errors. Cc: stable@vger.kernel.org BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007 BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981 BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703 Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit 16245db1489cd9aa579506f64afeeeb13d825a93 Author: Hans de Goede Date: Fri Nov 22 19:56:40 2019 +0100 platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer The HP WMI calls may take up to 128 bytes of data as input, and the AML methods implementing the WMI calls, declare a couple of fields for accessing input in different sizes, specifycally the HWMC method contains: CreateField (Arg1, 0x80, 0x0400, D128) Even though we do not use any of the WMI command-types which need a buffer of this size, the APCI interpreter still tries to create it as it is declared in generoc code at the top of the HWMC method which runs before the code looks at which command-type is requested. This results in many of these errors on many different HP laptop models: [ 14.459261] ACPI Error: Field [D128] at 1152 exceeds Buffer [NULL] size 160 (bits) (20170303/dsopcode-236) [ 14.459268] ACPI Error: Method parse/execution failed [\HWMC] (Node ffff8edcc61507f8), AE_AML_BUFFER_LIMIT (20170303/psparse-543) [ 14.459279] ACPI Error: Method parse/execution failed [\_SB.WMID.WMAA] (Node ffff8edcc61523c0), AE_AML_BUFFER_LIMIT (20170303/psparse-543) This commit increases the size of the data element of the bios_args struct to 128 bytes fixing these errors. Cc: stable@vger.kernel.org BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007 BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981 BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703 Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit 8dcd71b45df34d9b903450fab147ee8c1e6c16b5 Author: Nathan Chancellor Date: Mon Nov 18 21:57:12 2019 -0700 powerpc/prom_init: Use -ffreestanding to avoid a reference to bcmp LLVM revision r374662 gives LLVM the ability to convert certain loops into a reference to bcmp as an optimization; this breaks prom_init_check.sh: CALL arch/powerpc/kernel/prom_init_check.sh Error: External symbol 'bcmp' referenced from prom_init.c make[2]: *** [arch/powerpc/kernel/Makefile:196: prom_init_check] Error 1 bcmp is defined in lib/string.c as a wrapper for memcmp so this could be added to the whitelist. However, commit 450e7dd4001f ("powerpc/prom_init: don't use string functions from lib/") copied memcmp as prom_memcmp to avoid KASAN instrumentation so having bcmp be resolved to regular memcmp would break that assumption. Furthermore, because the compiler is the one that inserted bcmp, we cannot provide something like prom_bcmp. To prevent LLVM from being clever with optimizations like this, use -ffreestanding to tell LLVM we are not hosted so it is not free to make transformations like this. Reviewed-by: Nick Desaulneris Signed-off-by: Nathan Chancellor Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191119045712.39633-4-natechancellor@gmail.com commit c9029ef9c95765e7b63c4d9aa780674447db1ec0 Author: Nathan Chancellor Date: Mon Nov 18 21:57:11 2019 -0700 powerpc: Avoid clang warnings around setjmp and longjmp Commit aea447141c7e ("powerpc: Disable -Wbuiltin-requires-header when setjmp is used") disabled -Wbuiltin-requires-header because of a warning about the setjmp and longjmp declarations. r367387 in clang added another diagnostic around this, complaining that there is no jmp_buf declaration. In file included from ../arch/powerpc/xmon/xmon.c:47: ../arch/powerpc/include/asm/setjmp.h:10:13: error: declaration of built-in function 'setjmp' requires the declaration of the 'jmp_buf' type, commonly provided in the header . [-Werror,-Wincomplete-setjmp-declaration] extern long setjmp(long *); ^ ../arch/powerpc/include/asm/setjmp.h:11:13: error: declaration of built-in function 'longjmp' requires the declaration of the 'jmp_buf' type, commonly provided in the header . [-Werror,-Wincomplete-setjmp-declaration] extern void longjmp(long *, long); ^ 2 errors generated. We are not using the standard library's longjmp/setjmp implementations for obvious reasons; make this clear to clang by using -ffreestanding on these files. Cc: stable@vger.kernel.org # 4.14+ Suggested-by: Segher Boessenkool Reviewed-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191119045712.39633-3-natechancellor@gmail.com commit 465bfd9c44dea6b55962b5788a23ac87a467c923 Author: Nathan Chancellor Date: Mon Nov 18 21:57:10 2019 -0700 powerpc: Don't add -mabi= flags when building with Clang When building pseries_defconfig, building vdso32 errors out: error: unknown target ABI 'elfv1' This happens because -m32 in clang changes the target to 32-bit, which does not allow the ABI to be changed. Commit 4dc831aa8813 ("powerpc: Fix compiling a BE kernel with a powerpc64le toolchain") added these flags to fix building big endian kernels with a little endian GCC. Clang doesn't need -mabi because the target triple controls the default value. -mlittle-endian and -mbig-endian manipulate the triple into either powerpc64-* or powerpc64le-*, which properly sets the default ABI. Adding a debug print out in the PPC64TargetInfo constructor after line 383 above shows this: $ echo | ./clang -E --target=powerpc64-linux -mbig-endian -o /dev/null - Default ABI: elfv1 $ echo | ./clang -E --target=powerpc64-linux -mlittle-endian -o /dev/null - Default ABI: elfv2 $ echo | ./clang -E --target=powerpc64le-linux -mbig-endian -o /dev/null - Default ABI: elfv1 $ echo | ./clang -E --target=powerpc64le-linux -mlittle-endian -o /dev/null - Default ABI: elfv2 Don't specify -mabi when building with clang to avoid the build error with -m32 and not change any code generation. -mcall-aixdesc is not an implemented flag in clang so it can be safely excluded as well, see commit 238abecde8ad ("powerpc: Don't use gcc specific options on clang"). pseries_defconfig successfully builds after this patch and powernv_defconfig and ppc44x_defconfig don't regress. Reviewed-by: Daniel Axtens Signed-off-by: Nathan Chancellor [mpe: Trim clang links in change log] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191119045712.39633-2-natechancellor@gmail.com commit 5f017a56aa5da7f646a858475d57730cd155c9f1 Author: Krzysztof Kozlowski Date: Thu Nov 21 04:21:01 2019 +0100 powerpc: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1574306461-7646-1-git-send-email-krzk@kernel.org commit f2bb86937d86ebcb0e52f95b6d19aba1d850e601 Author: Christophe Leroy Date: Thu Sep 12 13:49:41 2019 +0000 powerpc/fixmap: don't clear fixmap area in paging_init() fixmap is intended to map things permanently like the IMMR region on FSL SOC (8xx, 83xx, ...), so don't clear it when initialising paging() Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/41c99bc06394a6bc2888631cb98a3ed2ae281ddb.1568295907.git.christophe.leroy@c-s.fr commit 196e2d6d0252d37be385c73f64fc8f5787a52066 Author: Ilya Dryomov Date: Tue Nov 5 15:38:46 2019 +0100 rbd: ask for a weaker incompat mask for read-only mappings For a read-only mapping, ask for a set of features that make the image only unwritable rather than both unreadable and unwritable by a client that doesn't understand them. As of today, the difference between them for krbd is journaling (JOURNALING) and live migration (MIGRATING). get_features method supports read_only parameter since hammer, ceph.git commit 6176ec5fde2a ("librbd: differentiate between R/O vs R/W RBD features"). Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Dongsheng Yang commit fa58bcad90446a8b30bf0d7f3827844bff30ff59 Author: Ilya Dryomov Date: Tue Nov 5 13:16:52 2019 +0100 rbd: don't query snapshot features Since infernalis, ceph.git commit 281f87f9ee52 ("cls_rbd: get_features on snapshots returns HEAD image features"), querying and checking that is pointless. Userspace support for manipulating image features after image creation came also in infernalis, so a snapshot with a different set of features wasn't ever possible. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Dongsheng Yang commit 686238b7431dcca870ff0bc8ae280cdc89ee41c7 Author: Ilya Dryomov Date: Mon Nov 18 12:51:02 2019 +0100 rbd: remove snapshot existence validation code RBD_DEV_FLAG_EXISTS check in rbd_queue_workfn() is racy and leads to inconsistent behaviour. If the object (or its snapshot) isn't there, the OSD returns ENOENT. A read submitted before the snapshot removal notification is processed would be zero-filled and ended with status OK, while future reads would be failed with IOERR. It also doesn't handle a case when an image that is mapped read-only is removed. On top of this, because watch is no longer established for read-only mappings, we no longer get notifications, so rbd_exists_validate() is effectively dead code. While failing requests rather than returning zeros is a good thing, RBD_DEV_FLAG_EXISTS is not it. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Dongsheng Yang commit b9ef2b8858a0cf07d5f1b201abaf2480f4aa8201 Author: Ilya Dryomov Date: Tue Nov 12 20:20:04 2019 +0100 rbd: don't establish watch for read-only mappings With exclusive lock out of the way, watch is the only thing left that prevents a read-only mapping from being used with read-only OSD caps. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Dongsheng Yang commit 3fe69921dbb29e7335e5c244d1ef66efd154f84b Author: Ilya Dryomov Date: Tue Nov 12 19:41:48 2019 +0100 rbd: don't acquire exclusive lock for read-only mappings A read-only mapping should be usable with read-only OSD caps, so neither the header lock nor the object map lock can be acquired. Unfortunately, this means that images mapped read-only lose the advantage of the object map. Snapshots, however, can take advantage of the object map without any exclusionary locks, so if the object map is desired, snapshot the image and map the snapshot instead of the image. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Dongsheng Yang commit c1b6205730ef009868fbb68cf4755b20055fcc6c Author: Ilya Dryomov Date: Tue Nov 12 19:50:55 2019 +0100 rbd: disallow read-write partitions on images mapped read-only If an image is mapped read-only, don't allow setting its partition(s) to read-write via BLKROSET: with the previous patch all writes to such images are failed anyway. If an image is mapped read-write, its partition(s) can be set to read-only (and back to read-write) as before. Note that at the rbd level the image will remain writeable: anything sent down by the block layer will be executed, including any write from internal kernel users. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Dongsheng Yang commit b948ad78971fb2c6ed6b53b0edbdd720cfe08d9f Author: Ilya Dryomov Date: Fri Nov 8 15:26:51 2019 +0100 rbd: treat images mapped read-only seriously Even though -o ro/-o read_only/--read-only options are very old, we have never really treated them seriously (on par with snapshots). As a first step, fail writes to images mapped read-only just like we do for snapshots. We need this check in rbd because the block layer basically ignores read-only setting, see commit a32e236eb93e ("Partially revert "block: fail op_is_write() requests to read-only partitions""). Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Dongsheng Yang commit 39258aa2db8175271d8079b7685a6e328a8c1a63 Author: Ilya Dryomov Date: Thu Nov 7 17:16:23 2019 +0100 rbd: introduce RBD_DEV_FLAG_READONLY rbd_dev->opts is not available for parent images, making checking rbd_dev->opts->read_only in various places (rbd_dev_image_probe(), need_exclusive_lock(), use_object_map() in the following patches) harder than it needs to be. Keeping rbd_dev_image_probe() in mind, move the initialization in do_rbd_add() up. snap_id isn't filled in at that point, so replace rbd_is_snap() with a snap_name comparison. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Dongsheng Yang commit f3c0e45900a60e1de1a03f74327ea341e713ea45 Author: Ilya Dryomov Date: Thu Nov 7 16:22:10 2019 +0100 rbd: introduce rbd_is_snap() Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Dongsheng Yang commit 2def865a81c23f088140f00beb8e76cbde5b6f95 Author: Jeff Layton Date: Mon Oct 14 15:41:54 2019 -0400 ceph: don't leave ino field in ceph_mds_request_head uninitialized We currently just pass junk in this field unless we're retransmitting a create, but in later patches, we'll need a mechanism to pass a delegated inode number on an initial create request. Prepare for this by ensuring this field is zeroed out. Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit f5946bcc5e79038f9f7cb66ec25bd3b2d39b2775 Author: Jeff Layton Date: Wed Oct 16 08:20:17 2019 -0400 ceph: tone down loglevel on ceph_mdsc_build_path warning When this occurs, it usually means that we raced with a rename, and there is no need to warn in that case. Only printk if we pass the rename sequence check but still ended up with pos < 0. Either way, this doesn't warrant a KERN_ERR message. Change it to KERN_WARNING. Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit a9b4b6be1291dbbbad0207aaaee654b3db253714 Author: Ilya Dryomov Date: Tue Nov 12 22:04:20 2019 +0100 rbd: update MAINTAINERS info Alex has got plenty on his plate aside from rbd and hasn't really been active in recent years. Remove his maintainership entry. Dongsheng is very familiar with the code base and has been reviewing rbd patches for a while now. Add him as a reviewer. Signed-off-by: Ilya Dryomov Acked-by: Alex Elder Acked-by: Dongsheng Yang commit 74d6f03019f8d70e7f634b8a6b1309051933d36e Author: Xiubo Li Date: Mon Nov 11 06:51:05 2019 -0500 ceph: fix geting random mds from mdsmap For example, if we have 5 mds in the mdsmap and the states are: m_info[5] --> [-1, 1, -1, 1, 1] If we get a random number 1, then we should get the mds index 3 as expected, but actually we will get index 2, which the state is -1. The issue is that the for loop increment will advance past any "up" MDS that was found during the while loop search. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 6b0a877422108372ac25b41ab651e6aa9ed273a6 Author: Colin Ian King Date: Thu Nov 7 22:36:46 2019 +0000 rbd: fix spelling mistake "requeueing" -> "requeuing" There is a spelling mistake in a debug message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Ilya Dryomov commit 721d5c13a7964564dbdc1524fefa7d2ef6121eee Author: Jeff Layton Date: Thu Aug 1 14:11:15 2019 -0400 ceph: make several helper accessors take const pointers None of these helper functions change anything in memory, so we can declare their arguments as const. Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit d8f544c30ba0ec7b3e5d0dd2c4258181b2adb8a0 Author: Ilya Dryomov Date: Mon Oct 14 16:25:32 2019 +0200 libceph: drop unnecessary check from dispatch() in mon_client.c con->private is set in ceph_con_init() and is never cleared. Signed-off-by: Ilya Dryomov commit 96710247298df52a4b8150a62a6fe87083093ff3 Merge: 85c9aae9ac8b 30486e72093e Author: Paolo Bonzini Date: Mon Nov 25 11:29:05 2019 +0100 Merge tag 'kvm-ppc-next-5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD Second KVM PPC update for 5.5 - Two fixes from Greg Kurz to fix memory leak bugs in the XIVE code. commit 6645d42d79d33e8a9fe262660a75d5f4556bbea9 Author: Navid Emamdoost Date: Fri Nov 22 16:09:55 2019 -0600 dma-buf: Fix memory leak in sync_file_merge() In the implementation of sync_file_merge() the allocated sync_file is leaked if number of fences overflows. Release sync_file by goto err. Fixes: a02b9dc90d84 ("dma-buf/sync_file: refactor fence storage in struct sync_file") Signed-off-by: Navid Emamdoost Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20191122220957.30427-1-navid.emamdoost@gmail.com commit 4a13b0e3e10996b9aa0b45a764ecfe49f6fcd360 Author: Andy Lutomirski Date: Sun Nov 24 08:50:03 2019 -0800 x86/entry/32: Fix FIXUP_ESPFIX_STACK with user CR3 UNWIND_ESPFIX_STACK needs to read the GDT, and the GDT mapping that can be accessed via %fs is not mapped in the user pagetables. Use SGDT to find the cpu_entry_area mapping and read the espfix offset from that instead. Reported-and-tested-by: Borislav Petkov Signed-off-by: Andy Lutomirski Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds Cc: Signed-off-by: Ingo Molnar commit 500543c53a54134ced386aed85cd93cf1363f981 Author: Will Deacon Date: Thu Nov 21 11:59:02 2019 +0000 lkdtm: Remove references to CONFIG_REFCOUNT_FULL CONFIG_REFCOUNT_FULL no longer exists, so remove all references to it. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Acked-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-11-will@kernel.org Signed-off-by: Ingo Molnar commit 2f30b36943adca070f2e1551f701bd524ed1ae5a Author: Will Deacon Date: Thu Nov 21 11:59:01 2019 +0000 locking/refcount: Remove unused 'refcount_error_report()' function 'refcount_error_report()' has no callers. Remove it. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Acked-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-10-will@kernel.org Signed-off-by: Ingo Molnar commit fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca Author: Will Deacon Date: Thu Nov 21 11:59:00 2019 +0000 locking/refcount: Consolidate implementations of refcount_t The generic implementation of refcount_t should be good enough for everybody, so remove ARCH_HAS_REFCOUNT and REFCOUNT_FULL entirely, leaving the generic implementation enabled unconditionally. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Acked-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-9-will@kernel.org Signed-off-by: Ingo Molnar commit 65b008552469f1c37f5e06e0016924502e40b4f5 Author: Will Deacon Date: Thu Nov 21 11:58:59 2019 +0000 locking/refcount: Consolidate REFCOUNT_{MAX,SATURATED} definitions The definitions of REFCOUNT_MAX and REFCOUNT_SATURATED are the same, regardless of CONFIG_REFCOUNT_FULL, so consolidate them into a single pair of definitions. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Reviewed-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-8-will@kernel.org Signed-off-by: Ingo Molnar commit 1eb085d94256aaa69b00cf5a86e3c5f5bb2bc460 Author: Will Deacon Date: Thu Nov 21 11:58:58 2019 +0000 locking/refcount: Move saturation warnings out of line Having the refcount saturation and warnings inline bloats the text, despite the fact that these paths should never be executed in normal operation. Move the refcount saturation and warnings out of line to reduce the image size when refcount_t checking is enabled. Relative to an x86_64 defconfig, the sizes reported by bloat-o-meter are: # defconfig+REFCOUNT_FULL, inline saturation (i.e. before this patch) Total: Before=14762076, After=14915442, chg +1.04% # defconfig+REFCOUNT_FULL, out-of-line saturation (i.e. after this patch) Total: Before=14762076, After=14835497, chg +0.50% A side-effect of this change is that we now only get one warning per refcount saturation type, rather than one per problematic call-site. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Reviewed-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-7-will@kernel.org Signed-off-by: Ingo Molnar commit dcb786493f3e48da3272b710028d42ec608cfda1 Author: Will Deacon Date: Thu Nov 21 11:58:57 2019 +0000 locking/refcount: Improve performance of generic REFCOUNT_FULL code Rewrite the generic REFCOUNT_FULL implementation so that the saturation point is moved to INT_MIN / 2. This allows us to defer the sanity checks until after the atomic operation, which removes many uses of cmpxchg() in favour of atomic_fetch_{add,sub}(). Some crude perf results obtained from lkdtm show substantially less overhead, despite the checking: $ perf stat -r 3 -B -- echo {ATOMIC,REFCOUNT}_TIMING >/sys/kernel/debug/provoke-crash/DIRECT # arm64 ATOMIC_TIMING: 46.50451 +- 0.00134 seconds time elapsed ( +- 0.00% ) REFCOUNT_TIMING (REFCOUNT_FULL, mainline): 77.57522 +- 0.00982 seconds time elapsed ( +- 0.01% ) REFCOUNT_TIMING (REFCOUNT_FULL, this series): 48.7181 +- 0.0256 seconds time elapsed ( +- 0.05% ) # x86 ATOMIC_TIMING: 31.6225 +- 0.0776 seconds time elapsed ( +- 0.25% ) REFCOUNT_TIMING (!REFCOUNT_FULL, mainline/x86 asm): 31.6689 +- 0.0901 seconds time elapsed ( +- 0.28% ) REFCOUNT_TIMING (REFCOUNT_FULL, mainline): 53.203 +- 0.138 seconds time elapsed ( +- 0.26% ) REFCOUNT_TIMING (REFCOUNT_FULL, this series): 31.7408 +- 0.0486 seconds time elapsed ( +- 0.15% ) Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Reviewed-by: Kees Cook Tested-by: Hanjun Guo Tested-by: Jan Glauber Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-6-will@kernel.org Signed-off-by: Ingo Molnar commit 77e9971c79c29542ab7dd4140f9343bf2ff36158 Author: Will Deacon Date: Thu Nov 21 11:58:56 2019 +0000 locking/refcount: Move the bulk of the REFCOUNT_FULL implementation into the header In an effort to improve performance of the REFCOUNT_FULL implementation, move the bulk of its functions into linux/refcount.h. This allows them to be inlined in the same way as if they had been provided via CONFIG_ARCH_HAS_REFCOUNT. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Reviewed-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-5-will@kernel.org Signed-off-by: Ingo Molnar commit 7221762c48c6bbbcc6cc51d8b803c06930215e34 Author: Will Deacon Date: Thu Nov 21 11:58:55 2019 +0000 locking/refcount: Remove unused refcount_*_checked() variants The full-fat refcount implementation is exposed via a set of functions suffixed with "_checked()", the idea being that code can choose to use the more expensive, yet more secure implementation on a case-by-case basis. In reality, this hasn't happened, so with a grand total of zero users, let's remove the checked variants for now by simply dropping the suffix and predicating the out-of-line functions on CONFIG_REFCOUNT_FULL=y. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Reviewed-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-4-will@kernel.org Signed-off-by: Ingo Molnar commit 97a1420adf0cdf0cf6f41bab0b2acf658c96b94b Author: Will Deacon Date: Thu Nov 21 11:58:54 2019 +0000 locking/refcount: Ensure integer operands are treated as signed In preparation for changing the saturation point of REFCOUNT_FULL to INT_MIN/2, change the type of integer operands passed into the API from 'unsigned int' to 'int' so that we can avoid casting during comparisons when we don't want to fall foul of C integral conversion rules for signed and unsigned types. Since the kernel is compiled with '-fno-strict-overflow', we don't need to worry about the UB introduced by signed overflow here. Furthermore, we're already making heavy use of the atomic_t API, which operates exclusively on signed types. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Reviewed-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-3-will@kernel.org Signed-off-by: Ingo Molnar commit 23e6b169c9917fbd77534f8c5f378cb073f548bd Author: Will Deacon Date: Thu Nov 21 11:58:53 2019 +0000 locking/refcount: Define constants for saturation and max refcount values The REFCOUNT_FULL implementation uses a different saturation point than the x86 implementation, which means that the shared refcount code in lib/refcount.c (e.g. refcount_dec_not_one()) needs to be aware of the difference. Rather than duplicate the definitions from the lkdtm driver, instead move them into and update all references accordingly. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Reviewed-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-2-will@kernel.org Signed-off-by: Ingo Molnar commit ceb9e77324fa661b1001a0ae66f061b5fcb4e4e6 Merge: c494cd6469ab 004e8dce9c55 Author: Ingo Molnar Date: Mon Nov 25 09:09:27 2019 +0100 Merge branch 'x86/core' into perf/core, to resolve conflicts and to pick up completed topic tree Conflicts: tools/perf/check-headers.sh Signed-off-by: Ingo Molnar commit c494cd6469ab0f4bdd663d1a2d396b0ec2f42103 Merge: 8cacac6ecd6d c4b75479741c Author: Ingo Molnar Date: Mon Nov 25 09:08:29 2019 +0100 Merge branch 'perf/urgent' into perf/core, to pick up fixes Signed-off-by: Ingo Molnar commit f01ec4fca8207e31b59a010c3de679c833f3a877 Merge: 45c083831417 66584ea6b70a Author: Ingo Molnar Date: Mon Nov 25 09:05:09 2019 +0100 Merge branch 'x86/build' into x86/asm, to pick up completed topic branch Signed-off-by: Ingo Molnar commit 05b042a1944322844eaae7ea596d5f154166d68a Author: Ingo Molnar Date: Sun Nov 24 11:21:44 2019 +0100 x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise When two recent commits that increased the size of the 'struct cpu_entry_area' were merged in -tip, the 32-bit defconfig build started failing on the following build time assert: ./include/linux/compiler.h:391:38: error: call to ‘__compiletime_assert_189’ declared with attribute error: BUILD_BUG_ON failed: CPU_ENTRY_AREA_PAGES * PAGE_SIZE < CPU_ENTRY_AREA_MAP_SIZE arch/x86/mm/cpu_entry_area.c:189:2: note: in expansion of macro ‘BUILD_BUG_ON’ In function ‘setup_cpu_entry_area_ptes’, Which corresponds to the following build time assert: BUILD_BUG_ON(CPU_ENTRY_AREA_PAGES * PAGE_SIZE < CPU_ENTRY_AREA_MAP_SIZE); The purpose of this assert is to sanity check the fixed-value definition of CPU_ENTRY_AREA_PAGES arch/x86/include/asm/pgtable_32_types.h: #define CPU_ENTRY_AREA_PAGES (NR_CPUS * 41) The '41' is supposed to match sizeof(struct cpu_entry_area)/PAGE_SIZE, which value we didn't want to define in such a low level header, because it would cause dependency hell. Every time the size of cpu_entry_area is changed, we have to adjust CPU_ENTRY_AREA_PAGES accordingly - and this assert is checking that constraint. But the assert is both imprecise and buggy, primarily because it doesn't include the single readonly IDT page that is mapped at CPU_ENTRY_AREA_BASE (which begins at a PMD boundary). This bug was hidden by the fact that by accident CPU_ENTRY_AREA_PAGES is defined too large upstream (v5.4-rc8): #define CPU_ENTRY_AREA_PAGES (NR_CPUS * 40) While 'struct cpu_entry_area' is 155648 bytes, or 38 pages. So we had two extra pages, which hid the bug. The following commit (not yet upstream) increased the size to 40 pages: x86/iopl: ("Restrict iopl() permission scope") ... but increased CPU_ENTRY_AREA_PAGES only 41 - i.e. shortening the gap to just 1 extra page. Then another not-yet-upstream commit changed the size again: 880a98c33996: ("x86/cpu_entry_area: Add guard page for entry stack on 32bit") Which increased the cpu_entry_area size from 38 to 39 pages, but didn't change CPU_ENTRY_AREA_PAGES (kept it at 40). This worked fine, because we still had a page left from the accidental 'reserve'. But when these two commits were merged into the same tree, the combined size of cpu_entry_area grew from 38 to 40 pages, while CPU_ENTRY_AREA_PAGES finally caught up to 40 as well. Which is fine in terms of functionality, but the assert broke: BUILD_BUG_ON(CPU_ENTRY_AREA_PAGES * PAGE_SIZE < CPU_ENTRY_AREA_MAP_SIZE); because CPU_ENTRY_AREA_MAP_SIZE is the total size of the area, which is 1 page larger due to the IDT page. To fix all this, change the assert to two precise asserts: BUILD_BUG_ON((CPU_ENTRY_AREA_PAGES+1)*PAGE_SIZE != CPU_ENTRY_AREA_MAP_SIZE); BUILD_BUG_ON(CPU_ENTRY_AREA_TOTAL_SIZE != CPU_ENTRY_AREA_MAP_SIZE); This takes the IDT page into account, and also connects the size-based define of CPU_ENTRY_AREA_TOTAL_SIZE with the address-subtraction based define of CPU_ENTRY_AREA_MAP_SIZE. Also clean up some of the names which made it rather confusing: - 'CPU_ENTRY_AREA_TOT_SIZE' wasn't actually the 'total' size of the cpu-entry-area, but the per-cpu array size, so rename this to CPU_ENTRY_AREA_ARRAY_SIZE. - Introduce CPU_ENTRY_AREA_TOTAL_SIZE that _is_ the total mapping size, with the IDT included. - Add comments where '+1' denotes the IDT mapping - it wasn't obvious and took me about 3 hours to decode... Finally, because this particular commit is actually applied after this patch: 880a98c33996: ("x86/cpu_entry_area: Add guard page for entry stack on 32bit") Fix the CPU_ENTRY_AREA_PAGES value from 40 pages to the correct 39 pages. All future commits that change cpu_entry_area will have to adjust this value precisely. As a side note, we should probably attempt to remove CPU_ENTRY_AREA_PAGES and derive its value directly from the structure, without causing header hell - but that is an adventure for another day! :-) Fixes: 880a98c33996: ("x86/cpu_entry_area: Add guard page for entry stack on 32bit") Cc: Thomas Gleixner Cc: Borislav Petkov Cc: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Andy Lutomirski Cc: stable@kernel.org Signed-off-by: Ingo Molnar commit 85150929a15b4e0a225434d5970bba14ebdf31f1 Author: Aurelien Aptel Date: Wed Nov 20 17:15:58 2019 +0100 cifs: dump channel info in DebugData * show server&TCP states for extra channels * mention if an interface has a channel connected to it In this version three of the patch, fixed minor printk format issue pointed out by the kbuild robot. Reported-by: kbuild test robot Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit 1ae9a5a5515729f43b2513bba68a462f240b3e04 Author: Steve French Date: Thu Nov 21 17:26:35 2019 -0600 smb3: dump in_send and num_waiters stats counters by default Number of requests in_send and the number of waiters on sendRecv are useful counters in various cases, move them from CONFIG_CIFS_STATS2 to be on by default especially with multichannel Signed-off-by: Steve French Acked-by: Ronnie Sahlberg commit 65a37a34145ca64fd2e0df2f477aadeb389990bc Author: Aurelien Aptel Date: Wed Nov 20 17:15:59 2019 +0100 cifs: try harder to open new channels Previously we would only loop over the iface list once. This patch tries to loop over multiple times until all channels are opened. It will also try to reuse RSS ifaces. Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit 9bd4540836684013aaad6070a65d6fcdd9006625 Author: Pavel Shilovsky Date: Tue Oct 29 16:51:19 2019 -0700 CIFS: Properly process SMB3 lease breaks Currenly we doesn't assume that a server may break a lease from RWH to RW which causes us setting a wrong lease state on a file and thus mistakenly flushing data and byte-range locks and purging cached data on the client. This leads to performance degradation because subsequent IOs go directly to the server. Fix this by propagating new lease state and epoch values to the oplock break handler through cifsFileInfo structure and removing the use of cifsInodeInfo flags for that. It allows to avoid some races of several lease/oplock breaks using those flags in parallel. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French commit 32546a9586aa4565035bb557e191648e022b29e8 Author: Ronnie Sahlberg Date: Sun Nov 3 13:06:37 2019 +1000 cifs: move cifsFileInfo_put logic into a work-queue This patch moves the final part of the cifsFileInfo_put() logic where we need a write lock on lock_sem to be processed in a separate thread that holds no other locks. This is to prevent deadlocks like the one below: > there are 6 processes looping to while trying to down_write > cinode->lock_sem, 5 of them from _cifsFileInfo_put, and one from > cifs_new_fileinfo > > and there are 5 other processes which are blocked, several of them > waiting on either PG_writeback or PG_locked (which are both set), all > for the same page of the file > > 2 inode_lock() (inode->i_rwsem) for the file > 1 wait_on_page_writeback() for the page > 1 down_read(inode->i_rwsem) for the inode of the directory > 1 inode_lock()(inode->i_rwsem) for the inode of the directory > 1 __lock_page > > > so processes are blocked waiting on: > page flags PG_locked and PG_writeback for one specific page > inode->i_rwsem for the directory > inode->i_rwsem for the file > cifsInodeInflock_sem > > > > here are the more gory details (let me know if I need to provide > anything more/better): > > [0 00:48:22.765] [UN] PID: 8863 TASK: ffff8c691547c5c0 CPU: 3 > COMMAND: "reopen_file" > #0 [ffff9965007e3ba8] __schedule at ffffffff9b6e6095 > #1 [ffff9965007e3c38] schedule at ffffffff9b6e64df > #2 [ffff9965007e3c48] rwsem_down_write_slowpath at ffffffff9af283d7 > #3 [ffff9965007e3cb8] legitimize_path at ffffffff9b0f975d > #4 [ffff9965007e3d08] path_openat at ffffffff9b0fe55d > #5 [ffff9965007e3dd8] do_filp_open at ffffffff9b100a33 > #6 [ffff9965007e3ee0] do_sys_open at ffffffff9b0eb2d6 > #7 [ffff9965007e3f38] do_syscall_64 at ffffffff9ae04315 > * (I think legitimize_path is bogus) > > in path_openat > } else { > const char *s = path_init(nd, flags); > while (!(error = link_path_walk(s, nd)) && > (error = do_last(nd, file, op)) > 0) { <<<< > > do_last: > if (open_flag & O_CREAT) > inode_lock(dir->d_inode); <<<< > else > so it's trying to take inode->i_rwsem for the directory > > DENTRY INODE SUPERBLK TYPE PATH > ffff8c68bb8e79c0 ffff8c691158ef20 ffff8c6915bf9000 DIR /mnt/vm1_smb/ > inode.i_rwsem is ffff8c691158efc0 > > : > owner: (UN - 8856 - > reopen_file), counter: 0x0000000000000003 > waitlist: 2 > 0xffff9965007e3c90 8863 reopen_file UN 0 1:29:22.926 > RWSEM_WAITING_FOR_WRITE > 0xffff996500393e00 9802 ls UN 0 1:17:26.700 > RWSEM_WAITING_FOR_READ > > > the owner of the inode.i_rwsem of the directory is: > > [0 00:00:00.109] [UN] PID: 8856 TASK: ffff8c6914275d00 CPU: 3 > COMMAND: "reopen_file" > #0 [ffff99650065b828] __schedule at ffffffff9b6e6095 > #1 [ffff99650065b8b8] schedule at ffffffff9b6e64df > #2 [ffff99650065b8c8] schedule_timeout at ffffffff9b6e9f89 > #3 [ffff99650065b940] msleep at ffffffff9af573a9 > #4 [ffff99650065b948] _cifsFileInfo_put.cold.63 at ffffffffc0a42dd6 [cifs] > #5 [ffff99650065ba38] cifs_writepage_locked at ffffffffc0a0b8f3 [cifs] > #6 [ffff99650065bab0] cifs_launder_page at ffffffffc0a0bb72 [cifs] > #7 [ffff99650065bb30] invalidate_inode_pages2_range at ffffffff9b04d4bd > #8 [ffff99650065bcb8] cifs_invalidate_mapping at ffffffffc0a11339 [cifs] > #9 [ffff99650065bcd0] cifs_revalidate_mapping at ffffffffc0a1139a [cifs] > #10 [ffff99650065bcf0] cifs_d_revalidate at ffffffffc0a014f6 [cifs] > #11 [ffff99650065bd08] path_openat at ffffffff9b0fe7f7 > #12 [ffff99650065bdd8] do_filp_open at ffffffff9b100a33 > #13 [ffff99650065bee0] do_sys_open at ffffffff9b0eb2d6 > #14 [ffff99650065bf38] do_syscall_64 at ffffffff9ae04315 > > cifs_launder_page is for page 0xffffd1e2c07d2480 > > crash> page.index,mapping,flags 0xffffd1e2c07d2480 > index = 0x8 > mapping = 0xffff8c68f3cd0db0 > flags = 0xfffffc0008095 > > PAGE-FLAG BIT VALUE > PG_locked 0 0000001 > PG_uptodate 2 0000004 > PG_lru 4 0000010 > PG_waiters 7 0000080 > PG_writeback 15 0008000 > > > inode is ffff8c68f3cd0c40 > inode.i_rwsem is ffff8c68f3cd0ce0 > DENTRY INODE SUPERBLK TYPE PATH > ffff8c68a1f1b480 ffff8c68f3cd0c40 ffff8c6915bf9000 REG > /mnt/vm1_smb/testfile.8853 > > > this process holds the inode->i_rwsem for the parent directory, is > laundering a page attached to the inode of the file it's opening, and in > _cifsFileInfo_put is trying to down_write the cifsInodeInflock_sem > for the file itself. > > > : > owner: (UN - 8854 - > reopen_file), counter: 0x0000000000000003 > waitlist: 1 > 0xffff9965005dfd80 8855 reopen_file UN 0 1:29:22.912 > RWSEM_WAITING_FOR_WRITE > > this is the inode.i_rwsem for the file > > the owner: > > [0 00:48:22.739] [UN] PID: 8854 TASK: ffff8c6914272e80 CPU: 2 > COMMAND: "reopen_file" > #0 [ffff99650054fb38] __schedule at ffffffff9b6e6095 > #1 [ffff99650054fbc8] schedule at ffffffff9b6e64df > #2 [ffff99650054fbd8] io_schedule at ffffffff9b6e68e2 > #3 [ffff99650054fbe8] __lock_page at ffffffff9b03c56f > #4 [ffff99650054fc80] pagecache_get_page at ffffffff9b03dcdf > #5 [ffff99650054fcc0] grab_cache_page_write_begin at ffffffff9b03ef4c > #6 [ffff99650054fcd0] cifs_write_begin at ffffffffc0a064ec [cifs] > #7 [ffff99650054fd30] generic_perform_write at ffffffff9b03bba4 > #8 [ffff99650054fda8] __generic_file_write_iter at ffffffff9b04060a > #9 [ffff99650054fdf0] cifs_strict_writev.cold.70 at ffffffffc0a4469b [cifs] > #10 [ffff99650054fe48] new_sync_write at ffffffff9b0ec1dd > #11 [ffff99650054fed0] vfs_write at ffffffff9b0eed35 > #12 [ffff99650054ff00] ksys_write at ffffffff9b0eefd9 > #13 [ffff99650054ff38] do_syscall_64 at ffffffff9ae04315 > > the process holds the inode->i_rwsem for the file to which it's writing, > and is trying to __lock_page for the same page as in the other processes > > > the other tasks: > [0 00:00:00.028] [UN] PID: 8859 TASK: ffff8c6915479740 CPU: 2 > COMMAND: "reopen_file" > #0 [ffff9965007b39d8] __schedule at ffffffff9b6e6095 > #1 [ffff9965007b3a68] schedule at ffffffff9b6e64df > #2 [ffff9965007b3a78] schedule_timeout at ffffffff9b6e9f89 > #3 [ffff9965007b3af0] msleep at ffffffff9af573a9 > #4 [ffff9965007b3af8] cifs_new_fileinfo.cold.61 at ffffffffc0a42a07 [cifs] > #5 [ffff9965007b3b78] cifs_open at ffffffffc0a0709d [cifs] > #6 [ffff9965007b3cd8] do_dentry_open at ffffffff9b0e9b7a > #7 [ffff9965007b3d08] path_openat at ffffffff9b0fe34f > #8 [ffff9965007b3dd8] do_filp_open at ffffffff9b100a33 > #9 [ffff9965007b3ee0] do_sys_open at ffffffff9b0eb2d6 > #10 [ffff9965007b3f38] do_syscall_64 at ffffffff9ae04315 > > this is opening the file, and is trying to down_write cinode->lock_sem > > > [0 00:00:00.041] [UN] PID: 8860 TASK: ffff8c691547ae80 CPU: 2 > COMMAND: "reopen_file" > [0 00:00:00.057] [UN] PID: 8861 TASK: ffff8c6915478000 CPU: 3 > COMMAND: "reopen_file" > [0 00:00:00.059] [UN] PID: 8858 TASK: ffff8c6914271740 CPU: 2 > COMMAND: "reopen_file" > [0 00:00:00.109] [UN] PID: 8862 TASK: ffff8c691547dd00 CPU: 6 > COMMAND: "reopen_file" > #0 [ffff9965007c3c78] __schedule at ffffffff9b6e6095 > #1 [ffff9965007c3d08] schedule at ffffffff9b6e64df > #2 [ffff9965007c3d18] schedule_timeout at ffffffff9b6e9f89 > #3 [ffff9965007c3d90] msleep at ffffffff9af573a9 > #4 [ffff9965007c3d98] _cifsFileInfo_put.cold.63 at ffffffffc0a42dd6 [cifs] > #5 [ffff9965007c3e88] cifs_close at ffffffffc0a07aaf [cifs] > #6 [ffff9965007c3ea0] __fput at ffffffff9b0efa6e > #7 [ffff9965007c3ee8] task_work_run at ffffffff9aef1614 > #8 [ffff9965007c3f20] exit_to_usermode_loop at ffffffff9ae03d6f > #9 [ffff9965007c3f38] do_syscall_64 at ffffffff9ae0444c > > closing the file, and trying to down_write cifsi->lock_sem > > > [0 00:48:22.839] [UN] PID: 8857 TASK: ffff8c6914270000 CPU: 7 > COMMAND: "reopen_file" > #0 [ffff9965006a7cc8] __schedule at ffffffff9b6e6095 > #1 [ffff9965006a7d58] schedule at ffffffff9b6e64df > #2 [ffff9965006a7d68] io_schedule at ffffffff9b6e68e2 > #3 [ffff9965006a7d78] wait_on_page_bit at ffffffff9b03cac6 > #4 [ffff9965006a7e10] __filemap_fdatawait_range at ffffffff9b03b028 > #5 [ffff9965006a7ed8] filemap_write_and_wait at ffffffff9b040165 > #6 [ffff9965006a7ef0] cifs_flush at ffffffffc0a0c2fa [cifs] > #7 [ffff9965006a7f10] filp_close at ffffffff9b0e93f1 > #8 [ffff9965006a7f30] __x64_sys_close at ffffffff9b0e9a0e > #9 [ffff9965006a7f38] do_syscall_64 at ffffffff9ae04315 > > in __filemap_fdatawait_range > wait_on_page_writeback(page); > for the same page of the file > > > > [0 00:48:22.718] [UN] PID: 8855 TASK: ffff8c69142745c0 CPU: 7 > COMMAND: "reopen_file" > #0 [ffff9965005dfc98] __schedule at ffffffff9b6e6095 > #1 [ffff9965005dfd28] schedule at ffffffff9b6e64df > #2 [ffff9965005dfd38] rwsem_down_write_slowpath at ffffffff9af283d7 > #3 [ffff9965005dfdf0] cifs_strict_writev at ffffffffc0a0c40a [cifs] > #4 [ffff9965005dfe48] new_sync_write at ffffffff9b0ec1dd > #5 [ffff9965005dfed0] vfs_write at ffffffff9b0eed35 > #6 [ffff9965005dff00] ksys_write at ffffffff9b0eefd9 > #7 [ffff9965005dff38] do_syscall_64 at ffffffff9ae04315 > > inode_lock(inode); > > > and one 'ls' later on, to see whether the rest of the mount is available > (the test file is in the root, so we get blocked up on the directory > ->i_rwsem), so the entire mount is unavailable > > [0 00:36:26.473] [UN] PID: 9802 TASK: ffff8c691436ae80 CPU: 4 > COMMAND: "ls" > #0 [ffff996500393d28] __schedule at ffffffff9b6e6095 > #1 [ffff996500393db8] schedule at ffffffff9b6e64df > #2 [ffff996500393dc8] rwsem_down_read_slowpath at ffffffff9b6e9421 > #3 [ffff996500393e78] down_read_killable at ffffffff9b6e95e2 > #4 [ffff996500393e88] iterate_dir at ffffffff9b103c56 > #5 [ffff996500393ec8] ksys_getdents64 at ffffffff9b104b0c > #6 [ffff996500393f30] __x64_sys_getdents64 at ffffffff9b104bb6 > #7 [ffff996500393f38] do_syscall_64 at ffffffff9ae04315 > > in iterate_dir: > if (shared) > res = down_read_killable(&inode->i_rwsem); <<<< > else > res = down_write_killable(&inode->i_rwsem); > Reported-by: Frank Sorenson Reviewed-by: Pavel Shilovsky Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit d70e9fa55884760b6d6c293dbf20d8c52ce11fb7 Author: Aurelien Aptel Date: Fri Sep 20 06:31:10 2019 +0200 cifs: try opening channels after mounting After doing mount() successfully we call cifs_try_adding_channels() which will open as many channels as it can. Channels are closed when the master session is closed. The master connection becomes the first channel. ,-------------> global cifs_tcp_ses_list <-------------------------. | | '- TCP_Server_Info <--> TCP_Server_Info <--> TCP_Server_Info <-' (master con) (chan#1 con) (chan#2 con) | ^ ^ ^ v '--------------------|--------------------' cifs_ses | - chan_count = 3 | - chans[] ---------------------' - smb3signingkey[] (master signing key) Note how channel connections don't have sessions. That's because cifs_ses can only be part of one linked list (list_head are internal to the elements). For signing keys, each channel has its own signing key which must be used only after the channel has been bound. While it's binding it must use the master session signing key. For encryption keys, since channel connections do not have sessions attached we must now find matching session by looping over all sessions in smb2_get_enc_key(). Each channel is opened like a regular server connection but at the session setup request step it must set the SMB2_SESSION_REQ_FLAG_BINDING flag and use the session id to bind to. Finally, while sending in compound_send_recv() for requests that aren't negprot, ses-setup or binding related, use a channel by cycling through the available ones (round-robin). Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit b8f7442bc46e48fb6fe5d7bc3e1ac1500ce649a9 Author: Aurelien Aptel Date: Mon Nov 18 21:04:08 2019 +0100 CIFS: refactor cifs_get_inode_info() Make logic of cifs_get_inode() much clearer by moving code to sub functions and adding comments. Document the steps this function does. cifs_get_inode_info() gets and updates a file inode metadata from its file path. * If caller already has raw info data from server they can pass it. * If inode already exists (just need to update) caller can pass it. Step 1: get raw data from server if none was passed Step 2: parse raw data into intermediate internal cifs_fattr struct Step 3: set fattr uniqueid which is later used for inode number. This can sometime be done from raw data Step 4: tweak fattr according to mount options (file_mode, acl to mode bits, uid, gid, etc) Step 5: update or create inode from final fattr struct * add is_smb1_server() helper * add is_inode_cache_good() helper * move SMB1-backupcreds-getinfo-retry to separate func cifs_backup_query_path_info(). * move set-uniqueid code to separate func cifs_set_fattr_ino() * don't clobber uniqueid from backup cred retry * fix some probable corner cases memleaks Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit f6a6bf7c4d53837767125e635e7d7d0dc48ee59e Author: Aurelien Aptel Date: Fri Sep 20 06:22:14 2019 +0200 cifs: switch servers depending on binding state Currently a lot of the code to initialize a connection & session uses the cifs_ses as input. But depending on if we are opening a new session or a new channel we need to use different server pointers. Add a "binding" flag in cifs_ses and a helper function that returns the server ptr a session should use (only in the sess establishment code path). Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit f780bd3fef17c4fda12e9c50e28e91c0e18cf448 Author: Aurelien Aptel Date: Fri Sep 20 06:08:34 2019 +0200 cifs: add server param As we get down to the transport layer, plenty of functions are passed the session pointer and assume the transport to use is ses->server. Instead we modify those functions to pass (ses, server) so that we can decouple the session from the server. Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit bcc8880115bcb36bc281c7f4895a12b51569d8d4 Author: Aurelien Aptel Date: Fri Sep 20 04:32:20 2019 +0200 cifs: add multichannel mount options and data structs adds: - [no]multichannel to enable/disable multichannel - max_channels=N to control how many channels to create these options are then stored in the volume struct. - store channels and max_channels in cifs_ses Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit 35adffed079fdcf1818bfe9da7625a5446b626e0 Author: Aurelien Aptel Date: Fri Sep 20 06:29:39 2019 +0200 cifs: sort interface list by speed New channels are going to be opened by walking the list sequentially, so by sorting it we will connect to the fastest interfaces first. Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit fa9c2362497fbd64788063288dc4e74daf977ebb Author: Pavel Shilovsky Date: Thu Oct 31 14:18:57 2019 -0700 CIFS: Fix SMB2 oplock break processing Even when mounting modern protocol version the server may be configured without supporting SMB2.1 leases and the client uses SMB2 oplock to optimize IO performance through local caching. However there is a problem in oplock break handling that leads to missing a break notification on the client who has a file opened. It latter causes big latencies to other clients that are trying to open the same file. The problem reproduces when there are multiple shares from the same server mounted on the client. The processing code tries to match persistent and volatile file ids from the break notification with an open file but it skips all share besides the first one. Fix this by looking up in all shares belonging to the server that issued the oplock break. Cc: Stable Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French commit 3591bb83eee7731d3421621a3b04d2432f80bba0 Author: Ronnie Sahlberg Date: Thu Oct 31 13:55:14 2019 +1000 cifs: don't use 'pre:' for MODULE_SOFTDEP It can cause to fail with modprobe: FATAL: Module is builtin. RHBZ: 1767094 Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 4357d45f50e58672e1d17648d792f27df01dfccd Author: Long Li Date: Wed Oct 16 13:51:56 2019 -0700 cifs: smbd: Return -EAGAIN when transport is reconnecting During reconnecting, the transport may have already been destroyed and is in the process being reconnected. In this case, return -EAGAIN to not fail and to retry this I/O. Signed-off-by: Long Li Cc: stable@vger.kernel.org Signed-off-by: Steve French commit c21ce58eab1eda4c66507897207e20c82e62a5ac Author: Long Li Date: Wed Oct 16 13:51:55 2019 -0700 cifs: smbd: Only queue work for error recovery on memory registration It's not necessary to queue invalidated memory registration to work queue, as all we need to do is to unmap the SG and make it usable again. This can save CPU cycles in normal data paths as memory registration errors are rare and normally only happens during reconnection. Signed-off-by: Long Li Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 87bc2376fffae6821869c988edbb45a14527b258 Author: Ronnie Sahlberg Date: Thu Nov 14 12:32:12 2019 -0600 smb3: add debug messages for closing unmatched open Helps distinguish between an interrupted close and a truly unmatched open. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 7b71843fa7028475b052107664cbe120156a2cfc Author: Pavel Shilovsky Date: Thu Nov 21 11:35:14 2019 -0800 CIFS: Do not miss cancelled OPEN responses When an OPEN command is cancelled we mark a mid as cancelled and let the demultiplex thread process it by closing an open handle. The problem is there is a race between a system call thread and the demultiplex thread and there may be a situation when the mid has been already processed before it is set as cancelled. Fix this by processing cancelled requests when mids are being destroyed which means that there is only one thread referencing a particular mid. Also set mids as cancelled unconditionally on their state. Cc: Stable Tested-by: Frank Sorenson Reviewed-by: Ronnie Sahlberg Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French commit 86a7964be7afaf3df6b64faaa10a7032d2444e51 Author: Pavel Shilovsky Date: Thu Nov 21 11:35:13 2019 -0800 CIFS: Fix NULL pointer dereference in mid callback There is a race between a system call processing thread and the demultiplex thread when mid->resp_buf becomes NULL and later is being accessed to get credits. It happens when the 1st thread wakes up before a mid callback is called in the 2nd one but the mid state has already been set to MID_RESPONSE_RECEIVED. This causes NULL pointer dereference in mid callback. Fix this by saving credits from the response before we update the mid state and then use this value in the mid callback rather then accessing a response buffer. Cc: Stable Fixes: ee258d79159afed5 ("CIFS: Move credit processing to mid callbacks for SMB3") Tested-by: Frank Sorenson Reviewed-by: Ronnie Sahlberg Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French commit 9150c3adbf24d77cfba37f03639d4a908ca4ac25 Author: Pavel Shilovsky Date: Thu Nov 21 11:35:12 2019 -0800 CIFS: Close open handle after interrupted close If Close command is interrupted before sending a request to the server the client ends up leaking an open file handle. This wastes server resources and can potentially block applications that try to remove the file or any directory containing this file. Fix this by putting the close command into a worker queue, so another thread retries it later. Cc: Stable Tested-by: Frank Sorenson Reviewed-by: Ronnie Sahlberg Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French commit 44805b0e62f15e90d233485420e1847133716bdc Author: Pavel Shilovsky Date: Tue Nov 12 17:16:35 2019 -0800 CIFS: Respect O_SYNC and O_DIRECT flags during reconnect Currently the client translates O_SYNC and O_DIRECT flags into corresponding SMB create options when openning a file. The problem is that on reconnect when the file is being re-opened the client doesn't set those flags and it causes a server to reject re-open requests because create options don't match. The latter means that any subsequent system call against that open file fail until a share is re-mounted. Fix this by properly setting SMB create options when re-openning files after reconnects. Fixes: 1013e760d10e6: ("SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags") Cc: Stable Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French commit 037d050724ed30a5ef02e6e886884a48e7654e47 Author: Steve French Date: Fri Nov 8 01:01:35 2019 -0600 smb3: remove confusing dmesg when mounting with encryption ("seal") The smb2/smb3 message checking code was logging to dmesg when mounting with encryption ("seal") for compounded SMB3 requests. When encrypted the whole frame (including potentially multiple compounds) is read so the length field is longer than in the case of non-encrypted case (where length field will match the the calculated length for the particular SMB3 request in the compound being validated). Avoids the warning on mount (with "seal"): "srv rsp padded more than expected. Length 384 not ..." Signed-off-by: Steve French commit 72e73c78c446e3c009a29b017c7fa3d79463e2aa Author: Ronnie Sahlberg Date: Thu Nov 7 17:00:38 2019 +1000 cifs: close the shared root handle on tree disconnect Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 598b6c57f2ff29df948c846f4bf3046c33d6b37f Author: Markus Elfring Date: Sun Aug 20 17:17:30 2017 +0200 CIFS: Return directly after a failed build_path_from_dentry() in cifs_do_create() Return directly after a call of the function "build_path_from_dentry" failed at the beginning. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit 2b1116bbe898aefdf584838448c6869f69851e0f Author: Markus Elfring Date: Tue Nov 5 22:26:53 2019 +0100 CIFS: Use common error handling code in smb2_ioctl_query_info() Move the same error code assignments so that such exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit cfaa1181097f6a1a6f4f6670ebc97848efda0883 Author: Markus Elfring Date: Tue Nov 5 21:30:25 2019 +0100 CIFS: Use memdup_user() rather than duplicating its implementation Reuse existing functionality from memdup_user() instead of keeping duplicate source code. Generated by: scripts/coccinelle/api/memdup_user.cocci Fixes: f5b05d622a3e99e6a97a189fe500414be802a05c ("cifs: add IOCTL for QUERY_INFO passthrough to userspace") Signed-off-by: Markus Elfring Signed-off-by: Steve French commit acd4680e2bef2405a0e1ef2149fbb01cce7e116c Author: Long Li Date: Wed Oct 16 13:51:54 2019 -0700 cifs: smbd: Return -ECONNABORTED when trasnport is not in connected state The transport should return this error so the upper layer will reconnect. Signed-off-by: Long Li Cc: stable@vger.kernel.org Signed-off-by: Steve French commit d63cdbae60ac6fbb2864bd3d8df7404f12b7407d Author: Long Li Date: Wed Oct 16 13:51:53 2019 -0700 cifs: smbd: Add messages on RDMA session destroy and reconnection Log these activities to help production support. Signed-off-by: Long Li Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 37941ea17d3f8eb2f5ac2f59346fab9e8439271a Author: Long Li Date: Wed Oct 16 13:51:52 2019 -0700 cifs: smbd: Return -EINVAL when the number of iovs exceeds SMBDIRECT_MAX_SGE While it's not friendly to fail user processes that issue more iovs than we support, at least we should return the correct error code so the user process gets a chance to retry with smaller number of iovs. Signed-off-by: Long Li Cc: stable@vger.kernel.org Signed-off-by: Steve French commit b7a55bbd6d5402bfbadcfb3904e3c75b38ab5ba4 Author: Long Li Date: Tue Oct 15 22:54:50 2019 +0000 cifs: smbd: Invalidate and deregister memory registration on re-send for direct I/O On re-send, there might be a reconnect and all prevoius memory registrations need to be invalidated and deregistered. Signed-off-by: Long Li Signed-off-by: Steve French commit 14cc639c17ab0b6671526a7459087352507609e4 Author: Long Li Date: Wed Oct 16 13:51:50 2019 -0700 cifs: Don't display RDMA transport on reconnect On reconnect, the transport data structure is NULL and its information is not available. Signed-off-by: Long Li Cc: stable@vger.kernel.org Signed-off-by: Steve French commit f28a2e5ebc54248757f5baf5b7ff1d4eb80ebae7 Author: YueHaibing Date: Thu Oct 17 03:53:51 2019 +0000 CIFS: remove set but not used variables 'cinode' and 'netfid' Fixes gcc '-Wunused-but-set-variable' warning: fs/cifs/file.c: In function 'cifs_flock': fs/cifs/file.c:1704:8: warning: variable 'netfid' set but not used [-Wunused-but-set-variable] fs/cifs/file.c:1702:24: warning: variable 'cinode' set but not used [-Wunused-but-set-variable] Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Steve French commit d0677992d2af3d65f1c1c21de3323d09d4891537 Author: Steve French Date: Tue Jul 16 18:55:38 2019 -0500 cifs: add support for flock The flock system call locks the whole file rather than a byte range and so is currently emulated by various other file systems by simply sending a byte range lock for the whole file. Add flock handling for cifs.ko in similar way. xfstest generic/504 passes with this as well Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg commit be1bf978e5d7cf26a78091ce1dd7c77ac64a658f Author: YueHaibing Date: Wed Oct 23 21:55:59 2019 +0800 cifs: remove unused variable 'sid_user' fs/cifs/cifsacl.c:43:30: warning: sid_user defined but not used [-Wunused-const-variable=] It is never used, so remove it. Signed-off-by: YueHaibing Signed-off-by: Steve French commit 8bd3754cff3aa6e80e73cb56042cdc6f76d6510e Author: Dan Carpenter Date: Fri Oct 25 13:35:08 2019 +0300 cifs: rename a variable in SendReceive() Smatch gets confused because we sometimes refer to "server->srv_mutex" and sometimes to "sess->server->srv_mutex". They refer to the same lock so let's just make this consistent. Signed-off-by: Dan Carpenter Signed-off-by: Steve French commit 4eb47198e955fc01d14113f525b62a4bc95554c7 Merge: 5f04ed74a8a3 b553a6ec5700 Author: David S. Miller Date: Sun Nov 24 22:05:47 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Alexei Starovoitov says: ==================== pull-request: bpf-next 2019-11-24 The following pull-request contains BPF updates for your *net-next* tree. We've added 27 non-merge commits during the last 4 day(s) which contain a total of 50 files changed, 2031 insertions(+), 548 deletions(-). The main changes are: 1) Optimize bpf_tail_call() from retpoline-ed indirect jump to direct jump, from Daniel. 2) Support global variables in libbpf, from Andrii. 3) Cleanup selftests with BPF_TRACE_x() macro, from Martin. 4) Fix devmap hash, from Toke. 5) Fix register bounds after 32-bit conditional jumps, from Yonghong. ==================== Signed-off-by: David S. Miller commit 5f04ed74a8a3bcb2122738b7eda857187e85aa34 Merge: dc83ef22cdb4 a4f95f31a9f3 Author: Jakub Kicinski Date: Sun Nov 24 18:46:13 2019 -0800 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Johan Hedberg says: ==================== pull request: bluetooth-next 2019-11-24 Here's one last bluetooth-next pull request for the 5.5 kernel: - Fix BDADDR_PROPERTY & INVALID_BDADDR quirk handling - Added support for BCM4334B0 and BCM4335A0 controllers - A few other smaller fixes related to locking and memory leaks ==================== Signed-off-by: Jakub Kicinski commit dc83ef22cdb483027f1bf0892e466433ec5299bf Author: Andreas K. Besslein Date: Sat Nov 23 22:04:47 2019 +0100 ax88179_178a: add ethtool_op_get_ts_info() This enables the use of SW timestamping. ax88179_178a uses the usbnet transmit function usbnet_start_xmit() which implements software timestamping. ax88179_178a overrides ethtool_ops but missed to set .get_ts_info. This caused SOF_TIMESTAMPING_TX_SOFTWARE capability to be not available. Signed-off-by: Andreas K. Besslein Signed-off-by: Jakub Kicinski commit bd85880197d2f0150b10baf2fdfea7eed13f4aa8 Merge: c392bccf2c10 ed43cff065d7 Author: Jakub Kicinski Date: Sun Nov 24 18:35:05 2019 -0800 Merge branch 'mlxsw-Two-small-updates' Ido Schimmel says: ==================== mlxsw: Two small updates Patch #1 from Petr handles a corner case in GRE tunnel offload. Patch #2 from Amit fixes a recent issue where the driver was programming the device to use an adjacency index (for a nexthop) that was not properly initialized. ==================== Signed-off-by: Jakub Kicinski commit ed43cff065d7ca2ffa60a7a1ea62be4a574529f9 Author: Amit Cohen Date: Sun Nov 24 09:48:03 2019 +0200 mlxsw: spectrum_router: Fix use of uninitialized adjacency index When mlxsw_sp_adj_discard_write() is called for the first time, the value stored in 'mlxsw_sp->router->adj_discard_index' is invalid, as indicated by 'mlxsw_sp->router->adj_discard_index_valid' being set to 'false'. In this case, we should not use the value initially stored in 'mlxsw_sp->router->adj_discard_index' (0) and instead use the value allocated later in the function. Fixes: 983db6198f0d ("mlxsw: spectrum_router: Allocate discard adjacency entry when needed") Signed-off-by: Amit Cohen Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit c5731cc5ebcbfdb0b34c7ce29d488c52d8af957b Author: Petr Machata Date: Sun Nov 24 09:48:02 2019 +0200 mlxsw: spectrum_router: After underlay moves, demote conflicting tunnels When a GRE tunnel is bound to an underlay netdevice and that netdevice is moved to a different VRF, that could cause two tunnels to have the same underlay local address in the same VRF. Linux in this situation dispatches the traffic according to the tunnel key (or lack thereof), but that cannot be offloaded to Spectrum devices. Detect this situation and unoffload the two impacted tunnels when it happens. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit b553a6ec570044fc1ae300c6fb24f9ce204c5894 Author: Daniel Borkmann Date: Sun Nov 24 01:39:42 2019 +0100 bpf: Simplify __bpf_arch_text_poke poke type handling Given that we have BPF_MOD_NOP_TO_{CALL,JUMP}, BPF_MOD_{CALL,JUMP}_TO_NOP and BPF_MOD_{CALL,JUMP}_TO_{CALL,JUMP} poke types and that we also pass in old_addr as well as new_addr, it's a bit redundant and unnecessarily complicates __bpf_arch_text_poke() itself since we can derive the same from the *_addr that were passed in. Hence simplify and use BPF_MOD_{CALL,JUMP} as types which also allows to clean up call-sites. In addition to that, __bpf_arch_text_poke() currently verifies that text matches expected old_insn before we invoke text_poke_bp(). Also add a check on new_insn and skip rewrite if it already matches. Reason why this is rather useful is that it avoids making any special casing in prog_array_map_poke_run() when old and new prog were NULL and has the benefit that also for this case we perform a check on text whether it really matches our expectations. Suggested-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/fcb00a2b0b288d6c73de4ef58116a821c8fe8f2f.1574555798.git.daniel@iogearbox.net commit f9a7cf6eb17cd0110c8c47d9e7969fc2716e5772 Author: Martin KaFai Lau Date: Sat Nov 23 12:25:04 2019 -0800 bpf: Introduce BPF_TRACE_x helper for the tracing tests For BPF_PROG_TYPE_TRACING, the bpf_prog's ctx is an array of u64. This patch borrows the idea from BPF_CALL_x in filter.h to convert a u64 to the arg type of the traced function. The new BPF_TRACE_x has an arg to specify the return type of a bpf_prog. It will be used in the future TCP-ops bpf_prog that may return "void". The new macros are defined in the new header file "bpf_trace_helpers.h". It is under selftests/bpf/ for now. It could be moved to libbpf later after seeing more upcoming non-tracing use cases. The tests are changed to use these new macros also. Hence, the k[s]u8/16/32/64 are no longer needed and they are removed from the bpf_helpers.h. Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191123202504.1502696-1-kafai@fb.com commit b8cd76ca4ae34731d47cd6a876d912a08efcc240 Author: Daniel Borkmann Date: Sat Nov 23 21:37:31 2019 +0100 bpf: Add bpf_jit_blinding_enabled for !CONFIG_BPF_JIT Add a definition of bpf_jit_blinding_enabled() when CONFIG_BPF_JIT is not set in order to fix a recent build regression: [...] CC kernel/bpf/verifier.o CC kernel/bpf/inode.o kernel/bpf/verifier.c: In function ‘fixup_bpf_calls’: kernel/bpf/verifier.c:9132:25: error: implicit declaration of function ‘bpf_jit_blinding_enabled’; did you mean ‘bpf_jit_kallsyms_enabled’? [-Werror=implicit-function-declaration] 9132 | bool expect_blinding = bpf_jit_blinding_enabled(prog); | ^~~~~~~~~~~~~~~~~~~~~~~~ | bpf_jit_kallsyms_enabled CC kernel/bpf/helpers.o CC kernel/bpf/hashtab.o [...] Fixes: d2e4c1e6c294 ("bpf: Constant map key tracking for prog array pokes") Reported-by: Jakub Sitnicki Reported-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/40baf8f3507cac4851a310578edfb98ce73b5605.1574541375.git.daniel@iogearbox.net commit 6dbae03b2e851fe58e9d9d1ac9ed58017b07960c Merge: c4781e37c6a2 79d49ba048ec Author: Alexei Starovoitov Date: Fri Nov 22 18:02:44 2019 -0800 Merge branch 'optimize-bpf_tail_call' Daniel Borkmann says: ==================== This gets rid of indirect jumps for BPF tail calls whenever possible. The series adds emission for *direct* jumps for tail call maps in order to avoid the retpoline overhead from a493a87f38cf ("bpf, x64: implement retpoline for tail call") for situations that allow for it, meaning, for known constant keys at verification time which are used as index into the tail call map. See patch 7/8 for more general details. Thanks! v1 -> v2: - added more test cases - u8 ip_stable -> bool (Andrii) - removed bpf_map_poke_{un,}lock and simplified the code (Andrii) - added break into prog_array_map_poke_untrack since there's just one prog (Andrii) - fixed typo: for for in commit msg (Andrii) - reworked __bpf_arch_text_poke (Andrii) - added subtests, and comment on tests themselves, NULL-NULL transistion (Andrii) - in constant map key tracking I've moved the map_poke_track callback to once we've finished creating the poke tab as otherwise concurrent access from tail call map would blow up (since we realloc the table) rfc -> v1: - Applied Alexei's and Andrii's feeback from https://lore.kernel.org/bpf/cover.1573779287.git.daniel@iogearbox.net/T/#t ==================== Signed-off-by: Alexei Starovoitov commit 79d49ba048ecace59a9850e8a04b618d7848b8e7 Author: Daniel Borkmann Date: Fri Nov 22 21:08:01 2019 +0100 bpf, testing: Add various tail call test cases Add several BPF kselftest cases for tail calls which test the various patch directions, and that multiple locations are patched in same and different programs. # ./test_progs -n 45 #45/1 tailcall_1:OK #45/2 tailcall_2:OK #45/3 tailcall_3:OK #45/4 tailcall_4:OK #45/5 tailcall_5:OK #45 tailcalls:OK Summary: 1/5 PASSED, 0 SKIPPED, 0 FAILED I've also verified the JITed dump after each of the rewrite cases that it matches expectations. Also regular test_verifier suite passes fine which contains further tail call tests: # ./test_verifier [...] Summary: 1563 PASSED, 0 SKIPPED, 0 FAILED Checked under JIT, interpreter and JIT + hardening. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/3d6cbecbeb171117dccfe153306e479798fb608d.1574452833.git.daniel@iogearbox.net commit 428d5df1fa4f28daf622c48dd19da35585c9053c Author: Daniel Borkmann Date: Fri Nov 22 21:08:00 2019 +0100 bpf, x86: Emit patchable direct jump as tail call Add initial code emission for *direct* jumps for tail call maps in order to avoid the retpoline overhead from a493a87f38cf ("bpf, x64: implement retpoline for tail call") for situations that allow for it, meaning, for known constant keys at verification time which are used as index into the tail call map. In case of Cilium which makes heavy use of tail calls, constant keys are used in the vast majority, only for a single occurrence we use a dynamic key. High level outline is that if the target prog is NULL in the map, we emit a 5-byte nop for the fall-through case and if not, we emit a 5-byte direct relative jmp to the target bpf_func + skipped prologue offset. Later during runtime, we patch these 5-byte nop/jmps upon tail call map update or deletions dynamically. Note that on x86-64 the direct jmp works as we reuse the same stack frame and skip prologue (as opposed to some other JIT implementations). One of the issues is that the tail call map slots can change at any given time even during JITing. Therefore, we have two passes: i) emit nops for all patchable locations during main JITing phase until we declare prog->jited = 1 eventually. At this point the image is stable, not public yet and with all jmps disabled. While JITing, we collect additional info like poke->ip in order to remember the patch location for later modifications. In ii) bpf_tail_call_direct_fixup() walks over the progs poke_tab, locks the tail call maps poke_mutex to prevent from parallel updates and patches in the right locations via __bpf_arch_text_poke(). Note, the main bpf_arch_text_poke() cannot be used at this point since we're not yet exposed to kallsyms. For the update we use plain memcpy() since the image is not public and still in read-write mode. After patching, we activate that poke entry through poke->ip_stable. Meaning, at this point any tail call map updates/deletions are not going to ignore that poke entry anymore. Then, bpf_arch_text_poke() might still occur on the read-write image until we finally locked it as read-only. Both modifications on the given image are under text_mutex to avoid interference with each other when update requests come in in parallel for different tail call maps (current one we have locked in JIT and different one where poke->ip_stable was already set). Example prog: # ./bpftool p d x i 1655 0: (b7) r3 = 0 1: (18) r2 = map[id:526] 3: (85) call bpf_tail_call#12 4: (b7) r0 = 1 5: (95) exit Before: # ./bpftool p d j i 1655 0xffffffffc076e55c: 0: nopl 0x0(%rax,%rax,1) 5: push %rbp 6: mov %rsp,%rbp 9: sub $0x200,%rsp 10: push %rbx 11: push %r13 13: push %r14 15: push %r15 17: pushq $0x0 _ 19: xor %edx,%edx |_ index (arg 3) 1b: movabs $0xffff88d95cc82600,%rsi |_ map (arg 2) 25: mov %edx,%edx | index >= array->map.max_entries 27: cmp %edx,0x24(%rsi) | 2a: jbe 0x0000000000000066 |_ 2c: mov -0x224(%rbp),%eax | tail call limit check 32: cmp $0x20,%eax | 35: ja 0x0000000000000066 | 37: add $0x1,%eax | 3a: mov %eax,-0x224(%rbp) |_ 40: mov 0xd0(%rsi,%rdx,8),%rax |_ prog = array->ptrs[index] 48: test %rax,%rax | prog == NULL check 4b: je 0x0000000000000066 |_ 4d: mov 0x30(%rax),%rax | goto *(prog->bpf_func + prologue_size) 51: add $0x19,%rax | 55: callq 0x0000000000000061 | retpoline for indirect jump 5a: pause | 5c: lfence | 5f: jmp 0x000000000000005a | 61: mov %rax,(%rsp) | 65: retq |_ 66: mov $0x1,%eax 6b: pop %rbx 6c: pop %r15 6e: pop %r14 70: pop %r13 72: pop %rbx 73: leaveq 74: retq After; state after JIT: # ./bpftool p d j i 1655 0xffffffffc08e8930: 0: nopl 0x0(%rax,%rax,1) 5: push %rbp 6: mov %rsp,%rbp 9: sub $0x200,%rsp 10: push %rbx 11: push %r13 13: push %r14 15: push %r15 17: pushq $0x0 _ 19: xor %edx,%edx |_ index (arg 3) 1b: movabs $0xffff9d8afd74c000,%rsi |_ map (arg 2) 25: mov -0x224(%rbp),%eax | tail call limit check 2b: cmp $0x20,%eax | 2e: ja 0x000000000000003e | 30: add $0x1,%eax | 33: mov %eax,-0x224(%rbp) |_ 39: jmpq 0xfffffffffffd1785 |_ [direct] goto *(prog->bpf_func + prologue_size) 3e: mov $0x1,%eax 43: pop %rbx 44: pop %r15 46: pop %r14 48: pop %r13 4a: pop %rbx 4b: leaveq 4c: retq After; state after map update (target prog): # ./bpftool p d j i 1655 0xffffffffc08e8930: 0: nopl 0x0(%rax,%rax,1) 5: push %rbp 6: mov %rsp,%rbp 9: sub $0x200,%rsp 10: push %rbx 11: push %r13 13: push %r14 15: push %r15 17: pushq $0x0 19: xor %edx,%edx 1b: movabs $0xffff9d8afd74c000,%rsi 25: mov -0x224(%rbp),%eax 2b: cmp $0x20,%eax . 2e: ja 0x000000000000003e . 30: add $0x1,%eax . 33: mov %eax,-0x224(%rbp) |_ 39: jmpq 0xffffffffffb09f55 |_ goto *(prog->bpf_func + prologue_size) 3e: mov $0x1,%eax 43: pop %rbx 44: pop %r15 46: pop %r14 48: pop %r13 4a: pop %rbx 4b: leaveq 4c: retq After; state after map update (no prog): # ./bpftool p d j i 1655 0xffffffffc08e8930: 0: nopl 0x0(%rax,%rax,1) 5: push %rbp 6: mov %rsp,%rbp 9: sub $0x200,%rsp 10: push %rbx 11: push %r13 13: push %r14 15: push %r15 17: pushq $0x0 19: xor %edx,%edx 1b: movabs $0xffff9d8afd74c000,%rsi 25: mov -0x224(%rbp),%eax 2b: cmp $0x20,%eax . 2e: ja 0x000000000000003e . 30: add $0x1,%eax . 33: mov %eax,-0x224(%rbp) |_ 39: nopl 0x0(%rax,%rax,1) |_ fall-through nop 3e: mov $0x1,%eax 43: pop %rbx 44: pop %r15 46: pop %r14 48: pop %r13 4a: pop %rbx 4b: leaveq 4c: retq Nice bonus is that this also shrinks the code emission quite a bit for every tail call invocation. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/6ada4c1c9d35eeb5f4ecfab94593dafa6b5c4b09.1574452833.git.daniel@iogearbox.net commit d2e4c1e6c2947269346054ac8937ccfe9e0bcc6b Author: Daniel Borkmann Date: Fri Nov 22 21:07:59 2019 +0100 bpf: Constant map key tracking for prog array pokes Add tracking of constant keys into tail call maps. The signature of bpf_tail_call_proto is that arg1 is ctx, arg2 map pointer and arg3 is a index key. The direct call approach for tail calls can be enabled if the verifier asserted that for all branches leading to the tail call helper invocation, the map pointer and index key were both constant and the same. Tracking of map pointers we already do from prior work via c93552c443eb ("bpf: properly enforce index mask to prevent out-of-bounds speculation") and 09772d92cd5a ("bpf: avoid retpoline for lookup/update/ delete calls on maps"). Given the tail call map index key is not on stack but directly in the register, we can add similar tracking approach and later in fixup_bpf_calls() add a poke descriptor to the progs poke_tab with the relevant information for the JITing phase. We internally reuse insn->imm for the rewritten BPF_JMP | BPF_TAIL_CALL instruction in order to point into the prog's poke_tab, and keep insn->imm as 0 as indicator that current indirect tail call emission must be used. Note that publishing to the tracker must happen at the end of fixup_bpf_calls() since adding elements to the poke_tab reallocates its memory, so we need to wait until its in final state. Future work can generalize and add similar approach to optimize plain array map lookups. Difference there is that we need to look into the key value that sits on stack. For clarity in bpf_insn_aux_data, map_state has been renamed into map_ptr_state, so we get map_{ptr,key}_state as trackers. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/e8db37f6b2ae60402fa40216c96738ee9b316c32.1574452833.git.daniel@iogearbox.net commit da765a2f599304a81a25e77908d1790414ecdbb6 Author: Daniel Borkmann Date: Fri Nov 22 21:07:58 2019 +0100 bpf: Add poke dependency tracking for prog array maps This work adds program tracking to prog array maps. This is needed such that upon prog array updates/deletions we can fix up all programs which make use of this tail call map. We add ops->map_poke_{un,}track() helpers to maps to maintain the list of programs and ops->map_poke_run() for triggering the actual update. bpf_array_aux is extended to contain the list head and poke_mutex in order to serialize program patching during updates/deletions. bpf_free_used_maps() will untrack the program shortly before dropping the reference to the map. For clearing out the prog array once all urefs are dropped we need to use schedule_work() to have a sleepable context. The prog_array_map_poke_run() is triggered during updates/deletions and walks the maintained prog list. It checks in their poke_tabs whether the map and key is matching and runs the actual bpf_arch_text_poke() for patching in the nop or new jmp location. Depending on the type of update, we use one of BPF_MOD_{NOP_TO_JUMP,JUMP_TO_NOP,JUMP_TO_JUMP}. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/1fb364bb3c565b3e415d5ea348f036ff379e779d.1574452833.git.daniel@iogearbox.net commit a66886fe6c24ebeeb6dc10fbd9b75158029eacf7 Author: Daniel Borkmann Date: Fri Nov 22 21:07:57 2019 +0100 bpf: Add initial poke descriptor table for jit images Add initial poke table data structures and management to the BPF prog that can later be used by JITs. Also add an instance of poke specific data for tail call maps; plan for later work is to extend this also for BPF static keys. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/1db285ec2ea4207ee0455b3f8e191a4fc58b9ade.1574452833.git.daniel@iogearbox.net commit 2beee5f57441413b64a9c2bd657e17beabb98d1c Author: Daniel Borkmann Date: Fri Nov 22 21:07:56 2019 +0100 bpf: Move owner type, jited info into array auxiliary data We're going to extend this with further information which is only relevant for prog array at this point. Given this info is not used in critical path, move it into its own structure such that the main array map structure can be kept on diet. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/b9ddccdb0f6f7026489ee955f16c96381e1e7238.1574452833.git.daniel@iogearbox.net commit 6332be04c039a72fca32ed0a4265bac58d606bb6 Author: Daniel Borkmann Date: Fri Nov 22 21:07:55 2019 +0100 bpf: Move bpf_free_used_maps into sleepable section We later on are going to need a sleepable context as opposed to plain RCU callback in order to untrack programs we need to poke at runtime and tracking as well as image update is performed under mutex. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/09823b1d5262876e9b83a8e75df04cf0467357a4.1574452833.git.daniel@iogearbox.net commit 4b3da77b72ad6b3c48c6fe4a395ace7db39a12c5 Author: Daniel Borkmann Date: Fri Nov 22 21:07:54 2019 +0100 bpf, x86: Generalize and extend bpf_arch_text_poke for direct jumps Add BPF_MOD_{NOP_TO_JUMP,JUMP_TO_JUMP,JUMP_TO_NOP} patching for x86 JIT in order to be able to patch direct jumps or nop them out. We need this facility in order to patch tail call jumps and in later work also BPF static keys. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/aa4784196a8e5e985af4b30a4fe5336bce6e9643.1574452833.git.daniel@iogearbox.net commit c4781e37c6a22c39cb4a57411d14f42aca124f04 Author: Alexei Starovoitov Date: Thu Nov 21 17:15:15 2019 -0800 selftests/bpf: Add BPF trampoline performance test Add a test that benchmarks different ways of attaching BPF program to a kernel function. Here are the results for 2.4Ghz x86 cpu on a kernel without mitigations: $ ./test_progs -n 49 -v|grep events task_rename base 2743K events per sec task_rename kprobe 2419K events per sec task_rename kretprobe 1876K events per sec task_rename raw_tp 2578K events per sec task_rename fentry 2710K events per sec task_rename fexit 2685K events per sec On a kernel with retpoline: $ ./test_progs -n 49 -v|grep events task_rename base 2401K events per sec task_rename kprobe 1930K events per sec task_rename kretprobe 1485K events per sec task_rename raw_tp 2053K events per sec task_rename fentry 2351K events per sec task_rename fexit 2185K events per sec All 5 approaches: - kprobe/kretprobe in __set_task_comm() - raw tracepoint in trace_task_rename() - fentry/fexit in __set_task_comm() are roughly equivalent. __set_task_comm() by itself is quite fast, so any extra instructions add up. Until BPF trampoline was introduced the fastest mechanism was raw tracepoint. kprobe via ftrace was second best. kretprobe is slow due to trap. New fentry/fexit methods via BPF trampoline are clearly the fastest and the difference is more pronounced with retpoline on, since BPF trampoline doesn't use indirect jumps. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20191122011515.255371-1-ast@kernel.org commit 161f3cbcda06aa70faed6b703066fedbd7653e23 Merge: 6147a140c99f 260cb5df9d16 Author: Alexei Starovoitov Date: Fri Nov 22 10:29:38 2019 -0800 Merge branch 'jmp32-reg-bounds' Yonghong Song says: ==================== With latest llvm, bpf selftest test_progs, which has +alu32 enabled, failed for strobemeta.o and a few other subtests. The reason is due to that verifier did not provide better var_off.mask after jmp32 instructions. This patch set addressed this issue and after the fix, test_progs passed with alu32. Patch #1 provided detailed explanation of the problem and the fix. Patch #2 added three tests in test_verifier. Changelog: v1 -> v2: - do not directly manipulate tnum.{value,mask} in __reg_bound_offset32(), using tnum_lshift/tnum_rshift functions instead - do __reg_bound_offset32() after regular 64bit __reg_bound_offset() since the latter may give a better upper 32bit var_off, which can be inherited by __reg_bound_offset32(). ==================== Signed-off-by: Alexei Starovoitov commit 6147a140c99f1ded2b519dfbed17e781e5861bf3 Author: Andrii Nakryiko Date: Thu Nov 21 09:59:00 2019 -0800 selftests/bpf: Ensure core_reloc_kernel is reading test_progs's data only test_core_reloc_kernel.c selftest is the only CO-RE test that reads and returns for validation calling thread's information (pid, tgid, comm). Thus it has to make sure that only test_prog's invocations are honored. Fixes: df36e621418b ("selftests/bpf: add CO-RE relocs testing setup") Reported-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20191121175900.3486133-1-andriin@fb.com commit 260cb5df9d16c5715b32d73cc8af26ad9a17a792 Author: Yonghong Song Date: Thu Nov 21 09:06:51 2019 -0800 selftests/bpf: Add verifier tests for better jmp32 register bounds Three test cases are added. Test 1: jmp32 'reg op imm'. Test 2: jmp32 'reg op reg' where dst 'reg' has unknown constant and src 'reg' has known constant Test 3: jmp32 'reg op reg' where dst 'reg' has known constant and src 'reg' has unknown constant Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191121170651.449096-1-yhs@fb.com commit 1aace10f41adf1080d1cc54de9b3db98b8b8b0fb Author: Andrii Nakryiko Date: Thu Nov 21 16:35:27 2019 -0800 libbpf: Fix bpf_object name determination for bpf_object__open_file() If bpf_object__open_file() gets path like "some/dir/obj.o", it should derive BPF object's name as "obj" (unless overriden through opts->object_name). Instead, due to using `path` as a fallback value for opts->obj_name, path is used as is for object name, so for above example BPF object's name will be verbatim "some/dir/obj", which leads to all sorts of troubles, especially when internal maps are concern (they are using up to 8 characters of object name). Fix that by ensuring object_name stays NULL, unless overriden. Fixes: 291ee02b5e40 ("libbpf: Refactor bpf_object__open APIs to use common opts") Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191122003527.551556-1-andriin@fb.com commit 581738a681b6faae5725c2555439189ca81c0f1f Author: Yonghong Song Date: Thu Nov 21 09:06:50 2019 -0800 bpf: Provide better register bounds after jmp32 instructions With latest llvm (trunk https://github.com/llvm/llvm-project), test_progs, which has +alu32 enabled, failed for strobemeta.o. The verifier output looks like below with edit to replace large decimal numbers with hex ones. 193: (85) call bpf_probe_read_user_str#114 R0=inv(id=0) 194: (26) if w0 > 0x1 goto pc+4 R0_w=inv(id=0,umax_value=0xffffffff00000001) 195: (6b) *(u16 *)(r7 +80) = r0 196: (bc) w6 = w0 R6_w=inv(id=0,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) 197: (67) r6 <<= 32 R6_w=inv(id=0,smax_value=0x7fffffff00000000,umax_value=0xffffffff00000000, var_off=(0x0; 0xffffffff00000000)) 198: (77) r6 >>= 32 R6=inv(id=0,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) ... 201: (79) r8 = *(u64 *)(r10 -416) R8_w=map_value(id=0,off=40,ks=4,vs=13872,imm=0) 202: (0f) r8 += r6 R8_w=map_value(id=0,off=40,ks=4,vs=13872,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) 203: (07) r8 += 9696 R8_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) ... 255: (bf) r1 = r8 R1_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) ... 257: (85) call bpf_probe_read_user_str#114 R1 unbounded memory access, make sure to bounds check any array access into a map The value range for register r6 at insn 198 should be really just 0/1. The umax_value=0xffffffff caused later verification failure. After jmp instructions, the current verifier already tried to use just obtained information to get better register range. The current mechanism is for 64bit register only. This patch implemented to tighten the range for 32bit sub-registers after jmp32 instructions. With the patch, we have the below range ranges for the above code sequence: 193: (85) call bpf_probe_read_user_str#114 R0=inv(id=0) 194: (26) if w0 > 0x1 goto pc+4 R0_w=inv(id=0,smax_value=0x7fffffff00000001,umax_value=0xffffffff00000001, var_off=(0x0; 0xffffffff00000001)) 195: (6b) *(u16 *)(r7 +80) = r0 196: (bc) w6 = w0 R6_w=inv(id=0,umax_value=0xffffffff,var_off=(0x0; 0x1)) 197: (67) r6 <<= 32 R6_w=inv(id=0,umax_value=0x100000000,var_off=(0x0; 0x100000000)) 198: (77) r6 >>= 32 R6=inv(id=0,umax_value=1,var_off=(0x0; 0x1)) ... 201: (79) r8 = *(u64 *)(r10 -416) R8_w=map_value(id=0,off=40,ks=4,vs=13872,imm=0) 202: (0f) r8 += r6 R8_w=map_value(id=0,off=40,ks=4,vs=13872,umax_value=1,var_off=(0x0; 0x1)) 203: (07) r8 += 9696 R8_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=1,var_off=(0x0; 0x1)) ... 255: (bf) r1 = r8 R1_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=1,var_off=(0x0; 0x1)) ... 257: (85) call bpf_probe_read_user_str#114 ... At insn 194, the register R0 has better var_off.mask and smax_value. Especially, the var_off.mask ensures later lshift and rshift maintains proper value range. Suggested-by: Alexei Starovoitov Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191121170650.449030-1-yhs@fb.com commit 071cdecec57fb5d5df78e6a12114ad7bccea5b0e Author: Toke Høiland-Jørgensen Date: Thu Nov 21 14:36:12 2019 +0100 xdp: Fix cleanup on map free for devmap_hash map type Tetsuo pointed out that it was not only the device unregister hook that was broken for devmap_hash types, it was also cleanup on map free. So better fix this as well. While we're at it, there's no reason to allocate the netdev_map array for DEVMAP_HASH, so skip that and adjust the cost accordingly. Fixes: 6f9d451ab1a3 ("xdp: Add devmap_hash map type for looking up devices by hashed index") Reported-by: Tetsuo Handa Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Alexei Starovoitov Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20191121133612.430414-1-toke@redhat.com commit 1f60750401c7672419e1b606e2b73727c1f8626c Merge: a8fdaad5cfd2 393cdfbee809 Author: Alexei Starovoitov Date: Thu Nov 21 09:12:52 2019 -0800 Merge branch 'libbpf-global-vars' Andrii Nakryiko says: ==================== This patch set salvages all the non-extern-specific changes out of blocked externs patch set ([0]). In addition to small clean ups, it also refactors libbpf's handling of relocations and allows support for global (non-static) variables. [0] https://patchwork.ozlabs.org/project/netdev/list/?series=143358&state=* ==================== Signed-off-by: Alexei Starovoitov commit a8fdaad5cfd250b9effcec942b3bf7bc5a6c8b17 Author: Andrii Nakryiko Date: Tue Nov 19 16:35:48 2019 -0800 selftests/bpf: Integrate verbose verifier log into test_progs Add exra level of verboseness, activated by -vvv argument. When -vv is specified, verbose libbpf and verifier log (level 1) is output, even for successful tests. With -vvv, verifier log goes to level 2. This is extremely useful to debug verifier failures, as well as just see the state and flow of verification. Before this, you'd have to go and modify load_program()'s source code inside libbpf to specify extra log_level flags, which is suboptimal to say the least. Currently -vv and -vvv triggering verifier output is integrated into test_stub's bpf_prog_load as well as bpf_verif_scale.c tests. Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191120003548.4159797-1-andriin@fb.com commit 393cdfbee809891dc6ba859a44cc6441fa8dce9e Author: Andrii Nakryiko Date: Wed Nov 20 23:07:43 2019 -0800 libbpf: Support initialized global variables Initialized global variables are no different in ELF from static variables, and don't require any extra support from libbpf. But they are matching semantics of global data (backed by BPF maps) more closely, preventing LLVM/Clang from aggressively inlining constant values and not requiring volatile incantations to prevent those. This patch enables global variables. It still disables uninitialized variables, which will be put into special COM (common) ELF section, because BPF doesn't allow uninitialized data to be accessed. Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191121070743.1309473-5-andriin@fb.com commit 5940c5bf6504f66f57f03f1d0046abfaf2198b3a Author: Jakub Kicinski Date: Tue Nov 19 10:50:10 2019 +0000 selftests, bpftool: Skip the build test if not in tree If selftests are copied over to another machine/location for execution the build test of bpftool will obviously not work, since the sources are not copied. Skip it if we can't find bpftool's Makefile. Reported-by: Naresh Kamboju Signed-off-by: Jakub Kicinski Signed-off-by: Quentin Monnet Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191119105010.19189-3-quentin.monnet@netronome.com commit 8983b731ceb42939acaa6158abcf8adb56f834bf Author: Andrii Nakryiko Date: Wed Nov 20 23:07:42 2019 -0800 libbpf: Fix various errors and warning reported by checkpatch.pl Fix a bunch of warnings and errors reported by checkpatch.pl, to make it easier to spot new problems. Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191121070743.1309473-4-andriin@fb.com commit 31f8b8295bb8997f139fe34b68654f8f1408f0da Author: Quentin Monnet Date: Tue Nov 19 10:50:09 2019 +0000 selftests, bpftool: Set EXIT trap after usage function The trap on EXIT is used to clean up any temporary directory left by the build attempts. It is not needed when the user simply calls the script with its --help option, and may not be needed either if we add checks (e.g. on the availability of bpftool files) before the build attempts. Let's move this trap and related variables lower down in the code, so that we don't accidentally change the value returned from the script on early exits at pre-checks. Signed-off-by: Quentin Monnet Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/bpf/20191119105010.19189-2-quentin.monnet@netronome.com commit 1f8e2bcb2cd5ee1a731fb625a5438e2c305f6a7c Author: Andrii Nakryiko Date: Wed Nov 20 23:07:41 2019 -0800 libbpf: Refactor relocation handling Relocation handling code is convoluted and unnecessarily deeply nested. Split out per-relocation logic into separate function. Also refactor the logic to be more a sequence of per-relocation type checks and processing steps, making it simpler to follow control flow. This makes it easier to further extends it to new kinds of relocations (e.g., support for extern variables). This patch also makes relocation's section verification more robust. Previously relocations against not yet supported externs were silently ignored because of obj->efile.text_shndx was zero, when all BPF programs had custom section names and there was no .text section. Also, invalid LDIMM64 relocations against non-map sections were passed through, if they were pointing to a .text section (or 0, which is invalid section). All these bugs are fixed within this refactoring and checks are made more appropriate for each type of relocation. Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191121070743.1309473-3-andriin@fb.com commit a89b2cbf71d64b61e79bbe5cb7ff4664797eeaaf Author: Quentin Monnet Date: Tue Nov 19 10:56:26 2019 +0000 tools, bpf: Fix build for 'make -s tools/bpf O=' Building selftests with 'make TARGETS=bpf kselftest' was fixed in commit 55d554f5d140 ("tools: bpf: Use !building_out_of_srctree to determine srctree"). However, by updating $(srctree) in tools/bpf/Makefile for in-tree builds only, we leave out the case where we pass an output directory to build BPF tools, but $(srctree) is not set. This typically happens for: $ make -s tools/bpf O=/tmp/foo Makefile:40: /tools/build/Makefile.feature: No such file or directory Fix it by updating $(srctree) in the Makefile not only for out-of-tree builds, but also if $(srctree) is empty. Detected with test_bpftool_build.sh. Fixes: 55d554f5d140 ("tools: bpf: Use !building_out_of_srctree to determine srctree") Signed-off-by: Quentin Monnet Signed-off-by: Daniel Borkmann Acked-by: Jakub Kicinski Link: https://lore.kernel.org/bpf/20191119105626.21453-1-quentin.monnet@netronome.com commit ffc88174cdcf5f51fb7f6298fe9203a36c904f1f Author: Andrii Nakryiko Date: Wed Nov 20 23:07:40 2019 -0800 selftests/bpf: Ensure no DWARF relocations for BPF object files Add -mattr=dwarfris attribute to llc to avoid having relocations against DWARF data. These relocations make it impossible to inspect DWARF contents: all strings are invalid. Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191121070743.1309473-2-andriin@fb.com commit a0f17cc6665c80ab2765f9244c41ec127821f343 Author: Quentin Monnet Date: Tue Nov 19 11:17:06 2019 +0000 tools, bpftool: Fix warning on ignored return value for 'read' When building bpftool, a warning was introduced by commit a94364603610 ("bpftool: Allow to read btf as raw data"), because the return value from a call to 'read()' is ignored. Let's address it. Signed-off-by: Quentin Monnet Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Kicinski Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191119111706.22440-1-quentin.monnet@netronome.com commit 5d946c5abbaf68083fa6a41824dd79e1f06286d8 Author: Luc Van Oostenryck Date: Wed Nov 20 01:10:42 2019 +0100 xsk: Fix xsk_poll()'s return type xsk_poll() is defined as returning 'unsigned int' but the .poll method is declared as returning '__poll_t', a bitwise type. Fix this by using the proper return type and using the EPOLL constants instead of the POLL ones, as required for __poll_t. Signed-off-by: Luc Van Oostenryck Signed-off-by: Daniel Borkmann Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20191120001042.30830-1-luc.vanoostenryck@gmail.com commit c392bccf2c1075b5d2cc9022d0116a516acb721d Author: Eric Dumazet Date: Wed Nov 20 12:14:51 2019 +1100 powerpc: Add const qual to local_read() parameter A patch in net-next triggered a compile error on powerpc: include/linux/u64_stats_sync.h: In function 'u64_stats_read': include/asm-generic/local64.h:30:37: warning: passing argument 1 of 'local_read' discards 'const' qualifier from pointer target type This seems reasonable to relax powerpc local_read() requirements. Fixes: 316580b69d0a ("u64_stats: provide u64_stats_t type") Signed-off-by: Eric Dumazet Reported-by: kbuild test robot Acked-by: Michael Ellerman Tested-by: Stephen Rothwell # build only Signed-off-by: Jakub Kicinski commit c98dfcd306cc64e21f27fcc473f7b0b7b0da9cbb Merge: ab44081fef9b d168f328fecc Author: Jakub Kicinski Date: Sun Nov 24 14:50:43 2019 -0800 Merge branch 'bnxt_en-Updates' Michael Chan says: ==================== bnxt_en: Updates. This patchset contains these main features: 1. Add the proper logic to support suspend/resume on the new 57500 chips. 2. Allow Phy configurations from user on a Multihost function if supported by fw. 3. devlink NVRAM flashing support. 4. Add a couple of chip IDs, PHY loopback enhancement, and provide more RSS contexts to VFs. v2: Dropped the devlink info patches to address some feedback and resubmit for the 5.6 kernel. ==================== Signed-off-by: Jakub Kicinski commit d168f328fecc9f401b54db18ff4ddd4bca7b161d Author: Vasundhara Volam Date: Sat Nov 23 22:30:50 2019 -0500 bnxt_en: Add support for flashing the device via devlink Use the same bnxt_flash_package_from_file() function to support devlink flash operation. Cc: Jiri Pirko Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit c7e457f42c02066e49a6e03028c889aefbb8999b Author: Michael Chan Date: Sat Nov 23 22:30:49 2019 -0500 bnxt_en: Allow PHY settings on multi-function or NPAR PFs if allowed by FW. Currently, the driver does not allow PHY settings on a multi-function or NPAR NIC whose port is shared by more than one function. Newer firmware now allows PHY settings on some of these NICs. Check for this new firmware setting and allow the user to set the PHY settings accordingly. Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit b1613e78e98d065fd3356d0b93df665b0740f652 Author: Michael Chan Date: Sat Nov 23 22:30:48 2019 -0500 bnxt_en: Add async. event logic for PHY configuration changes. If the link settings have been changed by another function sharing the port, firmware will send us an async. message. In response, we will call the new bnxt_init_ethtool_link_settings() function to update the current settings. Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 8119e49b68fa1ec778f9ec8be05b5492046100b2 Author: Michael Chan Date: Sat Nov 23 22:30:47 2019 -0500 bnxt_en: Refactor the initialization of the ethtool link settings. Refactor this logic in bnxt_probe_phy() into a separate function bnxt_init_ethtool_link_settings(). It used to be that the settable link settings will never be changed without going through ethtool. So we only needed to do this once in bnxt_probe_phy(). Now, another function sharing the port may change it and we may need to re-initialize the ethtool settings again in run-time. Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 8a60efd1decbaf9ef71d4296b75ff262e653bd34 Author: Michael Chan Date: Sat Nov 23 22:30:46 2019 -0500 bnxt_en: Skip disabling autoneg before PHY loopback when appropriate. New firmware allows PHY loopback to be set without disabling autoneg first. Check this capability and skip disabling autoneg when it is supported by firmware. Using this scheme, loopback will always work even if the PHY only supports autoneg. Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 1acefc9aedb3179fc9add0a21fa62c0aca08efc4 Author: Michael Chan Date: Sat Nov 23 22:30:45 2019 -0500 bnxt_en: Assign more RSS context resources to the VFs. The driver currently only assignes 1 RSS context to each VF. This works for the Linux VF driver. But other drivers, such as DPDK, can make use of additional RSS contexts. Modify the code to divide up and assign RSS contexts to VFs just like other resources. Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 3be8136ce14ea12c7b40f7ad20a5ff8aec339289 Author: Michael Chan Date: Sat Nov 23 22:30:44 2019 -0500 bnxt_en: Initialize context memory to the value specified by firmware. Some chips that need host context memory as a backing store requires the memory to be initialized to a non-zero value. Query the value from firmware and initialize the context memory accordingly. Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit f9b69d7f62796b33657c98e0d3ca3be763f70fa4 Author: Vasundhara Volam Date: Sat Nov 23 22:30:43 2019 -0500 bnxt_en: Fix suspend/resume path on 57500 chips Driver calls HWRM_FUNC_RESET firmware call while resuming the device which clears the context memory backing store. Because of which allocating firmware resources would eventually fail. Fix it by freeing all context memory during suspend and reallocate the memory during resume. Call bnxt_hwrm_queue_qportcfg() in resume path. This firmware call is needed on the 57500 chips so that firmware will set up the proper queue mapping in relation to the context memory. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit f92335d830059f3f9db950f0af49405d287924d5 Author: Vasundhara Volam Date: Sat Nov 23 22:30:42 2019 -0500 bnxt_en: Send FUNC_RESOURCE_QCAPS command in bnxt_resume() After driver unregister, firmware is erasing the information that driver supports new resource management. Send FUNC_RESOURCE_QCAPS command to inform the firmware that driver supports new resource management while resuming from hibernation. Otherwise, we fallback to the older resource allocation scheme. Also, move driver register after sending FUNC_RESOURCE_QCAPS command to be consistent with the normal initialization sequence. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 2e882468fce263afef4a77ea4fe40808baaddae7 Author: Vasundhara Volam Date: Sat Nov 23 22:30:41 2019 -0500 bnxt_en: Combine 2 functions calling the same HWRM_DRV_RGTR fw command. Everytime driver registers with firmware, driver is required to register for async event notifications as well. These 2 calls are done using the same firmware command and can be combined. We are also missing the 2nd step to register for async events in the suspend/resume path and this will fix it. Prior to this, we were getting only default notifications. ULP can register for additional async events for the RDMA driver, so we add a parameter to the new function to only do step 2 when it is called from ULP. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit bdb3860236b3ec8bb0f55ddef6d62666a8b3b23e Author: Vasundhara Volam Date: Sat Nov 23 22:30:40 2019 -0500 bnxt_en: Do driver unregister cleanup in bnxt_init_one() failure path. In the bnxt_init_one() failure path, if the driver has already called firmware to register the driver, it is not undoing the driver registration. Add this missing step to unregister for correctness, so that the firmware knows that the driver has unloaded. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit ef02af8c8ece3d6fb01fe267c1c7622399bc34f6 Author: Michael Chan Date: Sat Nov 23 22:30:39 2019 -0500 bnxt_en: Disable/enable Bus master during suspend/resume. Disable Bus master during suspend to prevent DMAs after the device goes into D3hot state. The new 57500 devices may continue to DMA from context memory after the system goes into D3hot state. This may cause some PCIe errors on some system. Re-enable it during resume. Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit fb4cd81e4c03efa54b82e81e2a4afc092c061384 Author: Michael Chan Date: Sat Nov 23 22:30:38 2019 -0500 bnxt_en: Add chip IDs for 57452 and 57454 chips. Fix BNXT_CHIP_NUM_5645X() to include 57452 and 56454 chip IDs, so that these chips will be properly classified as P4 chips to take advantage of the P4 fixes and features. Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit ab44081fef9b5d31ea5641494c9a379b0ebe1839 Author: Jakub Kicinski Date: Sat Nov 23 09:45:42 2019 -0800 sfc: fix build without CONFIG_RFS_ACCEL The rfs members of struct efx_channel are under CONFIG_RFS_ACCEL. Ethtool stats which access those need to be as well. Reported-by: kbuild test robot Fixes: ca70bd423f10 ("sfc: add statistics for ARFS") Signed-off-by: Jakub Kicinski commit 23c1cce9f3174db9cdc91346cb4320fa6b97e35d Author: Krzysztof Kozlowski Date: Thu Nov 21 04:20:16 2019 +0100 xen: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit c6b6fc206586cc07a18595d2a3d815a806a057d0 Author: Takashi Iwai Date: Sun Nov 24 09:39:24 2019 +0100 ALSA: aloop: Fix dependency on timer API An explicit Kconfig dependency is missing for the recent addition of the timer support. CONFIG_SND_TIMER isn't always selected by SND_PCM. Fixes: 26c53379f98d ("ALSA: aloop: Support selection of snd_timer instead of jiffies") Reported-by: kbuild test robot Link: https://lore.kernel.org/r/20191124083924.14049-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 3dcb5fa23e16ef50b09e7a56b47d8e4c04ca09c0 Author: Chengguang Xu Date: Tue Nov 19 19:50:49 2019 +0800 erofs: remove unnecessary output in erofs_show_options() We have already handled cache_strategy option carefully, so incorrect setting could not pass option parsing. Meanwhile, print 'cache_strategy=(unknown)' can cause failure on remount. Link: https://lore.kernel.org/r/20191119115049.3401-1-cgxu519@mykernel.net Signed-off-by: Chengguang Xu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 0c638f70d7310f961a3482108c9d7ce15fcba8b3 Author: Gao Xiang Date: Fri Nov 8 11:37:33 2019 +0800 erofs: drop all vle annotations for runtime names VLE was an old informal name of fixed-sized output compression which came from published ATC'19 paper [1]. Drop those old annotations since erofs can handle all encoded clusters in block-aligned basis, which is wider than fixed-sized output compression after larger clustersize feature is fully implemented. Unaligned encoding won't be considered in EROFS since it's not friendly to inplace I/O and perhaps decompression inplace. a) Fixed-sized output compression with 16KB pcluster: ___________________________________ |xxxxxxxx|xxxxxxxx|xxxxxxxx|xxxxxxxx| |___ 0___|___ 1___|___ 2___|___ 3___| physical blocks b) Block-aligned fixed-sized input compression with 16KB pcluster: ___________________________________ |xxxxxxxx|xxxxxxxx|xxxxxxxx|xxx00000| |___ 0___|___ 1___|___ 2___|___ 3___| physical blocks c) Block-unaligned fixed-sized input compression with 16KB compression unit: ____________________________________________ |..xxxxxx|xxxxxxxx|xxxxxxxx|xxxxxxxx|x.......| |___ 0___|___ 1___|___ 2___|___ 3___|___ 4___| physical blocks Refine better names for those as well. [1] https://www.usenix.org/conference/atc19/presentation/gao Link: https://lore.kernel.org/r/20191108033733.63919-1-gaoxiang25@huawei.com Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit b858a4844cfba3d90a8d8ffd3a04d9557f76b60f Author: Pratik Shinde Date: Mon Nov 4 10:49:37 2019 +0800 erofs: support superblock checksum Introduce superblock checksum feature in order to check at mounting time. Note that the first 1024 bytes are ignore for x86 boot sectors and other oddities. Link: https://lore.kernel.org/r/20191104024937.113939-1-gaoxiang25@huawei.com Signed-off-by: Pratik Shinde Reviewed-by: Chao Yu Cc: Dan Carpenter Signed-off-by: Gao Xiang commit a93f8c36877b2ae9ba0ca07eda1933944dc5bcb8 Author: Gao Xiang Date: Tue Oct 8 20:56:16 2019 +0800 erofs: set iowait for sync decompression For those tasks waiting I/O for sync decompression, they should be better marked as IO wait state. Link: https://lore.kernel.org/r/20191008125616.183715-5-gaoxiang25@huawei.com Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit a4b1fab121ec3235e6c5f3543ae1937426bd4eb4 Author: Gao Xiang Date: Tue Oct 8 20:56:15 2019 +0800 erofs: clean up decompress queue stuffs Previously, both z_erofs_unzip_io and z_erofs_unzip_io_sb record decompress queues for backend to use. The only difference is that z_erofs_unzip_io is used for on-stack sync decompression so that it doesn't have a super block field (since the caller can pass it in its context), but it increases complexity with only a pointer saving. Rename z_erofs_unzip_io to z_erofs_decompressqueue with a fixed super_block member and kill the other entirely, and it can fallback to sync decompression if memory allocation failure. Link: https://lore.kernel.org/r/20191008125616.183715-4-gaoxiang25@huawei.com Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 5ddcee1f3a1ccaccb31bc17080f75a0bb13b4906 Author: Gao Xiang Date: Thu Nov 21 21:59:54 2019 +0800 erofs: get rid of __stagingpage_alloc helper Now open code is much cleaner due to iterative development. Link: https://lore.kernel.org/r/20191124025217.12345-1-hsiangkao@aol.com Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 6f3aeb1ba05d41320e6cf9a60f698d9c4e44348e Author: Stephen Hemminger Date: Sat Nov 23 15:50:17 2019 -0800 hv_netvsc: make recording RSS hash depend on feature flag The recording of RSS hash should be controlled by NETIF_F_RXHASH. Fixes: 1fac7ca4e63b ("hv_netvsc: record hardware hash in skb") Suggested-by: Eric Dumazet Signed-off-by: Stephen Hemminger Signed-off-by: Haiyang Zhang Reviewed-by: Michael Kelley Signed-off-by: Jakub Kicinski commit 312434617cb16be5166316cf9d08ba760b1042a1 Author: Xin Long Date: Sat Nov 23 11:56:49 2019 +0800 sctp: cache netns in sctp_ep_common This patch is to fix a data-race reported by syzbot: BUG: KCSAN: data-race in sctp_assoc_migrate / sctp_hash_obj write to 0xffff8880b67c0020 of 8 bytes by task 18908 on cpu 1: sctp_assoc_migrate+0x1a6/0x290 net/sctp/associola.c:1091 sctp_sock_migrate+0x8aa/0x9b0 net/sctp/socket.c:9465 sctp_accept+0x3c8/0x470 net/sctp/socket.c:4916 inet_accept+0x7f/0x360 net/ipv4/af_inet.c:734 __sys_accept4+0x224/0x430 net/socket.c:1754 __do_sys_accept net/socket.c:1795 [inline] __se_sys_accept net/socket.c:1792 [inline] __x64_sys_accept+0x4e/0x60 net/socket.c:1792 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 read to 0xffff8880b67c0020 of 8 bytes by task 12003 on cpu 0: sctp_hash_obj+0x4f/0x2d0 net/sctp/input.c:894 rht_key_get_hash include/linux/rhashtable.h:133 [inline] rht_key_hashfn include/linux/rhashtable.h:159 [inline] rht_head_hashfn include/linux/rhashtable.h:174 [inline] head_hashfn lib/rhashtable.c:41 [inline] rhashtable_rehash_one lib/rhashtable.c:245 [inline] rhashtable_rehash_chain lib/rhashtable.c:276 [inline] rhashtable_rehash_table lib/rhashtable.c:316 [inline] rht_deferred_worker+0x468/0xab0 lib/rhashtable.c:420 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269 worker_thread+0xa0/0x800 kernel/workqueue.c:2415 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 It was caused by rhashtable access asoc->base.sk when sctp_assoc_migrate is changing its value. However, what rhashtable wants is netns from asoc base.sk, and for an asoc, its netns won't change once set. So we can simply fix it by caching netns since created. Fixes: d6c0256a60e6 ("sctp: add the rhashtable apis for sctp global transport hashtable") Reported-by: syzbot+e3b35fe7918ff0ee474e@syzkaller.appspotmail.com Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit b6631c6031c746ed004c4221ec0616d7a520f441 Author: Navid Emamdoost Date: Fri Nov 22 16:17:56 2019 -0600 sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook In the implementation of sctp_sf_do_5_2_4_dupcook() the allocated new_asoc is leaked if security_sctp_assoc_request() fails. Release it via sctp_association_free(). Fixes: 2277c7cd75e3 ("sctp: Add LSM hooks") Signed-off-by: Navid Emamdoost Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit fc5141cb6a60afd81cf53cf4f9bd986f1b846010 Author: Tonghao Zhang Date: Fri Nov 22 20:38:01 2019 +0800 net: gro: use vlan API instead of accessing directly Use vlan common api to access the vlan_tag info. Signed-off-by: Tonghao Zhang Signed-off-by: Jakub Kicinski commit 9520aea75b88f4df4f9cae6b770626a143364ddc Merge: d46b7e4fb060 90ac245814ab Author: Jakub Kicinski Date: Sat Nov 23 16:36:49 2019 -0800 Merge tag 'mlx5-updates-2019-11-22' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2019-11-22 1) Misc Cleanups 2) Software steering support for Geneve ==================== Signed-off-by: Jakub Kicinski commit d46b7e4fb06037a61415f5b6964fcf632ee1dc34 Author: Russell King Date: Thu Nov 21 00:36:22 2019 +0000 net: phylink: rename mac_link_state() op to mac_pcs_get_state() Rename the mac_link_state() method to mac_pcs_get_state() to make it clear that it should be returning the MACs PCS current state, which is used for inband negotiation rather than just reading back what the MAC has been configured for. Update the documentation to explicitly mention that this is for inband. We drop the return value as well; most of phylink doesn't check the return value and it is not clear what it should do on error - instead arrange for state->link to be false. Signed-off-by: Russell King Signed-off-by: Jakub Kicinski commit 93f4e735b6d98ee4b7a1252d81e815a983e359f2 Author: Christoph Hellwig Date: Wed Nov 13 14:45:28 2019 +0100 mm/hmm: remove hmm_range_dma_map and hmm_range_dma_unmap These two functions have never been used since they were added. Link: https://lore.kernel.org/r/20191113134528.21187-1-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: John Hubbard Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit d28c2c9a487708b9db519ce7fedc10333032c76b Author: Ralph Campbell Date: Mon Nov 4 14:21:40 2019 -0800 mm/hmm: make full use of walk_page_range() hmm_range_fault() calls find_vma() and walk_page_range() in a loop. This is unnecessary duplication since walk_page_range() calls find_vma() in a loop already. Simplify hmm_range_fault() by defining a walk_test() callback function to filter unhandled vmas. This also fixes a bug where hmm_range_fault() was not checking start >= vma->vm_start before checking vma->vm_flags so hmm_range_fault() could return an error based on the wrong vma for the requested range. It also fixes a bug when the vma has no read access and the caller did not request a fault, there shouldn't be any error return code. Link: https://lore.kernel.org/r/20191104222141.5173-2-rcampbell@nvidia.com Signed-off-by: Ralph Campbell Reviewed-by: Christoph Hellwig Signed-off-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit d3eeb1d77c5d0af9df442db63722928238310a86 Author: Jason Gunthorpe Date: Tue Nov 12 16:22:31 2019 -0400 xen/gntdev: use mmu_interval_notifier_insert gntdev simply wants to monitor a specific VMA for any notifier events, this can be done straightforwardly using mmu_interval_notifier_insert() over the VMA's VA range. The notifier should be attached until the original VMA is destroyed. It is unclear if any of this is even sane, but at least a lot of duplicate code is removed. Link: https://lore.kernel.org/r/20191112202231.3856-15-jgg@ziepe.ca Reviewed-by: Boris Ostrovsky Signed-off-by: Jason Gunthorpe commit a22dd506400d0f4784ad596f073b9eb5ed7c6a2a Author: Jason Gunthorpe Date: Tue Nov 12 16:22:30 2019 -0400 mm/hmm: remove hmm_mirror and related The only two users of this are now converted to use mmu_interval_notifier, delete all the code and update hmm.rst. Link: https://lore.kernel.org/r/20191112202231.3856-14-jgg@ziepe.ca Reviewed-by: Jérôme Glisse Tested-by: Ralph Campbell Reviewed-by: Christoph Hellwig Signed-off-by: Jason Gunthorpe commit 81fa1af31b5d79047821def6abdcb97a735d8a52 Author: Jason Gunthorpe Date: Tue Nov 12 16:22:29 2019 -0400 drm/amdgpu: Use mmu_interval_notifier instead of hmm_mirror Convert the collision-retry lock around hmm_range_fault to use the one now provided by the mmu_interval notifier. Although this driver does not seem to use the collision retry lock that hmm provides correctly, it can still be converted over to use the mmu_interval_notifier api instead of hmm_mirror without too much trouble. This also deletes another place where a driver is associating additional data (struct amdgpu_mn) with a mmu_struct. Link: https://lore.kernel.org/r/20191112202231.3856-13-jgg@ziepe.ca Signed-off-by: Philip Yang Reviewed-by: Philip Yang Tested-by: Philip Yang Signed-off-by: Jason Gunthorpe commit 62914a99dee5ac51253a84e7d4a05c18f0c77535 Author: Jason Gunthorpe Date: Tue Nov 12 16:22:28 2019 -0400 drm/amdgpu: Use mmu_interval_insert instead of hmm_mirror Remove the interval tree in the driver and rely on the tree maintained by the mmu_notifier for delivering mmu_notifier invalidation callbacks. For some reason amdgpu has a very complicated arrangement where it tries to prevent duplicate entries in the interval_tree, this is not necessary, each amdgpu_bo can be its own stand alone entry. interval_tree already allows duplicates and overlaps in the tree. Also, there is no need to remove entries upon a release callback, the mmu_interval API safely allows objects to remain registered beyond the lifetime of the mm. The driver only has to stop touching the pages during release. Link: https://lore.kernel.org/r/20191112202231.3856-12-jgg@ziepe.ca Reviewed-by: Philip Yang Tested-by: Philip Yang Signed-off-by: Jason Gunthorpe commit a9ae8731e6e52829a935d81a65d7f925cb95dbac Author: Jason Gunthorpe Date: Tue Nov 12 16:22:27 2019 -0400 drm/amdgpu: Call find_vma under mmap_sem find_vma() must be called under the mmap_sem, reorganize this code to do the vma check after entering the lock. Further, fix the unlocked use of struct task_struct's mm, instead use the mm from hmm_mirror which has an active mm_grab. Also the mm_grab must be converted to a mm_get before acquiring mmap_sem or calling find_vma(). Fixes: 66c45500bfdc ("drm/amdgpu: use new HMM APIs and helpers") Fixes: 0919195f2b0d ("drm/amdgpu: Enable amdgpu_ttm_tt_get_user_pages in worker threads") Link: https://lore.kernel.org/r/20191112202231.3856-11-jgg@ziepe.ca Acked-by: Christian König Reviewed-by: Felix Kuehling Reviewed-by: Philip Yang Tested-by: Philip Yang Signed-off-by: Jason Gunthorpe commit 20fef4ef84bfb07d3658ff1347951c489fe7bafa Author: Jason Gunthorpe Date: Tue Nov 12 16:22:26 2019 -0400 nouveau: use mmu_interval_notifier instead of hmm_mirror Remove the hmm_mirror object and use the mmu_interval_notifier API instead for the range, and use the normal mmu_notifier API for the general invalidation callback. While here re-organize the pagefault path so the locking pattern is clear. nouveau is the only driver that uses a temporary range object and instead forwards nearly every invalidation range directly to the HW. While this is not how the mmu_interval_notifier was intended to be used, the overheads on the pagefaulting path are similar to the existing hmm_mirror version. Particularly since the interval tree will be small. Link: https://lore.kernel.org/r/20191112202231.3856-10-jgg@ziepe.ca Tested-by: Ralph Campbell Signed-off-by: Jason Gunthorpe commit c625c274ee0058c2a04aa0d794314b5b277606b2 Author: Jason Gunthorpe Date: Tue Nov 12 16:22:25 2019 -0400 nouveau: use mmu_notifier directly for invalidate_range_start There is no reason to get the invalidate_range_start() callback via an indirection through hmm_mirror, just register a normal notifier directly. Link: https://lore.kernel.org/r/20191112202231.3856-9-jgg@ziepe.ca Tested-by: Ralph Campbell Signed-off-by: Jason Gunthorpe commit 3506ff69c3ec725b9c3e7f074fd2d265922f139a Author: Jason Gunthorpe Date: Tue Nov 12 16:22:24 2019 -0400 drm/radeon: use mmu_interval_notifier_insert The new API is an exact match for the needs of radeon. For some reason radeon tries to remove overlapping ranges from the interval tree, but interval trees (and mmu_interval_notifier_insert()) support overlapping ranges directly. Simply delete all this code. Since this driver is missing a invalidate_range_end callback, but still calls get_user_pages(), it cannot be correct against all races. Link: https://lore.kernel.org/r/20191112202231.3856-8-jgg@ziepe.ca Reviewed-by: Christian König Signed-off-by: Jason Gunthorpe commit 3889551db21257919e0ef3449dfcc23450f9a5bd Author: Jason Gunthorpe Date: Tue Nov 12 16:22:23 2019 -0400 RDMA/hfi1: Use mmu_interval_notifier_insert for user_exp_rcv This converts one of the two users of mmu_notifiers to use the new API. The conversion is fairly straightforward, however the existing use of notifiers here seems to be racey. Link: https://lore.kernel.org/r/20191112202231.3856-7-jgg@ziepe.ca Tested-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit f25a546e65292b36f15cca0912450c4944fae031 Author: Jason Gunthorpe Date: Tue Nov 12 16:22:22 2019 -0400 RDMA/odp: Use mmu_interval_notifier_insert() Replace the internal interval tree based mmu notifier with the new common mmu_interval_notifier_insert() API. This removes a lot of code and fixes a deadlock that can be triggered in ODP: zap_page_range() mmu_notifier_invalidate_range_start() [..] ib_umem_notifier_invalidate_range_start() down_read(&per_mm->umem_rwsem) unmap_single_vma() [..] __split_huge_page_pmd() mmu_notifier_invalidate_range_start() [..] ib_umem_notifier_invalidate_range_start() down_read(&per_mm->umem_rwsem) // DEADLOCK mmu_notifier_invalidate_range_end() up_read(&per_mm->umem_rwsem) mmu_notifier_invalidate_range_end() up_read(&per_mm->umem_rwsem) The umem_rwsem is held across the range_start/end as the ODP algorithm for invalidate_range_end cannot tolerate changes to the interval tree. However, due to the nested invalidation regions the second down_read() can deadlock if there are competing writers. The new core code provides an alternative scheme to solve this problem. Fixes: ca748c39ea3f ("RDMA/umem: Get rid of per_mm->notifier_count") Link: https://lore.kernel.org/r/20191112202231.3856-6-jgg@ziepe.ca Tested-by: Artemy Kovalyov Signed-off-by: Jason Gunthorpe commit 107e899874e95dcddc779142942bf285eba38bc5 Author: Jason Gunthorpe Date: Tue Nov 12 16:22:21 2019 -0400 mm/hmm: define the pre-processor related parts of hmm.h even if disabled Only the function calls are stubbed out with static inlines that always fail. This is the standard way to write a header for an optional component and makes it easier for drivers that only optionally need HMM_MIRROR. Link: https://lore.kernel.org/r/20191112202231.3856-5-jgg@ziepe.ca Reviewed-by: Jérôme Glisse Tested-by: Ralph Campbell Reviewed-by: Christoph Hellwig Signed-off-by: Jason Gunthorpe commit 04ec32fbc2b29a640d67872d2f88daac4c73e45b Author: Jason Gunthorpe Date: Tue Nov 12 16:22:20 2019 -0400 mm/hmm: allow hmm_range to be used with a mmu_interval_notifier or hmm_mirror hmm_mirror's handling of ranges does not use a sequence count which results in this bug: CPU0 CPU1 hmm_range_wait_until_valid(range) valid == true hmm_range_fault(range) hmm_invalidate_range_start() range->valid = false hmm_invalidate_range_end() range->valid = true hmm_range_valid(range) valid == true Where the hmm_range_valid() should not have succeeded. Adding the required sequence count would make it nearly identical to the new mmu_interval_notifier. Instead replace the hmm_mirror stuff with mmu_interval_notifier. Co-existence of the two APIs is the first step. Link: https://lore.kernel.org/r/20191112202231.3856-4-jgg@ziepe.ca Reviewed-by: Jérôme Glisse Tested-by: Philip Yang Tested-by: Ralph Campbell Reviewed-by: Christoph Hellwig Signed-off-by: Jason Gunthorpe commit 99cb252f5e68d72afa3245a4e73d216d295cd335 Author: Jason Gunthorpe Date: Tue Nov 12 16:22:19 2019 -0400 mm/mmu_notifier: add an interval tree notifier Of the 13 users of mmu_notifiers, 8 of them use only invalidate_range_start/end() and immediately intersect the mmu_notifier_range with some kind of internal list of VAs. 4 use an interval tree (i915_gem, radeon_mn, umem_odp, hfi1). 4 use a linked list of some kind (scif_dma, vhost, gntdev, hmm) And the remaining 5 either don't use invalidate_range_start() or do some special thing with it. It turns out that building a correct scheme with an interval tree is pretty complicated, particularly if the use case is synchronizing against another thread doing get_user_pages(). Many of these implementations have various subtle and difficult to fix races. This approach puts the interval tree as common code at the top of the mmu notifier call tree and implements a shareable locking scheme. It includes: - An interval tree tracking VA ranges, with per-range callbacks - A read/write locking scheme for the interval tree that avoids sleeping in the notifier path (for OOM killer) - A sequence counter based collision-retry locking scheme to tell device page fault that a VA range is being concurrently invalidated. This is based on various ideas: - hmm accumulates invalidated VA ranges and releases them when all invalidates are done, via active_invalidate_ranges count. This approach avoids having to intersect the interval tree twice (as umem_odp does) at the potential cost of a longer device page fault. - kvm/umem_odp use a sequence counter to drive the collision retry, via invalidate_seq - a deferred work todo list on unlock scheme like RTNL, via deferred_list. This makes adding/removing interval tree members more deterministic - seqlock, except this version makes the seqlock idea multi-holder on the write side by protecting it with active_invalidate_ranges and a spinlock To minimize MM overhead when only the interval tree is being used, the entire SRCU and hlist overheads are dropped using some simple branches. Similarly the interval tree overhead is dropped when in hlist mode. The overhead from the mandatory spinlock is broadly the same as most of existing users which already had a lock (or two) of some sort on the invalidation path. Link: https://lore.kernel.org/r/20191112202231.3856-3-jgg@ziepe.ca Acked-by: Christian König Tested-by: Philip Yang Tested-by: Ralph Campbell Reviewed-by: John Hubbard Reviewed-by: Christoph Hellwig Signed-off-by: Jason Gunthorpe commit a8d0f11ee50ddbd9f243c7a8b1a393a4f23ba093 Author: Thomas Bogendoerfer Date: Tue Oct 15 14:09:51 2019 +0200 MIPS: SGI-IP27: Enable ethernet phy on second Origin 200 module PROM only enables ethernet PHY on first Origin 200 module, so we must do it ourselves for the second module. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Paul Burton Cc: Jakub Kicinski Cc: Jonathan Corbet Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: Lee Jones Cc: David S. Miller Cc: Srinivas Kandagatla Cc: Alessandro Zummo Cc: Alexandre Belloni Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-mips@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-rtc@vger.kernel.org Cc: linux-serial@vger.kernel.org commit 29b261ff6fd963da2de0e436ce03fff333740f35 Author: Thomas Bogendoerfer Date: Tue Oct 15 14:09:48 2019 +0200 MIPS: PCI: Fix fake subdevice ID for IOC3 Generation of fake subdevice ID had vendor and device ID swapped. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Paul Burton Cc: Jakub Kicinski Cc: Jonathan Corbet Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: Lee Jones Cc: David S. Miller Cc: Srinivas Kandagatla Cc: Alessandro Zummo Cc: Alexandre Belloni Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-mips@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-rtc@vger.kernel.org Cc: linux-serial@vger.kernel.org commit ab818362c9054beb950b97a09ce7b0d56f5a32a1 Author: Taehee Yoo Date: Fri Nov 22 08:15:19 2019 +0000 net: use rhashtable_lookup() instead of rhashtable_lookup_fast() rhashtable_lookup_fast() internally calls rcu_read_lock() then, calls rhashtable_lookup(). So if rcu_read_lock() is already held, rhashtable_lookup() is enough. Signed-off-by: Taehee Yoo Signed-off-by: Jakub Kicinski commit 3a06ee33963dea642d38c04ed18d2a5f4fdc78fd Merge: 72a2707a8743 05d6c8cfdbd6 Author: Jakub Kicinski Date: Sat Nov 23 12:00:54 2019 -0800 Merge tag 'wireless-drivers-next-2019-11-22' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for v5.5 Last set of patches for v5.5. Major features here 802.11ax support for qtnfmac and airtime fairness support to mt76. And naturally smaller fixes and improvements all over. Major changes: qtnfmac * add 802.11ax support in AP mode * enable offload bridging support iwlwifi * support TX/RX antennas reporting mt76 * mt7615 smart carrier sense support * aggregation statistics via debugfs * airtime fairness (ATF) support * mt76x0 OF mac address support ==================== Signed-off-by: Jakub Kicinski commit 72a2707a8743b62f9493e46af300f0cee4485d46 Merge: a5d66f810061 4791d77a08cc Author: Jakub Kicinski Date: Sat Nov 23 11:01:13 2019 -0800 Merge branch 'nfc-convert-from-txt-to-rst' Robert Schwebel says: ==================== here is v2 of the series converting the NFC documentation from txt to rst. Thanks to Jonathan and Dave for the input. Changes since (implicit) v1: * replace code-block by more compact :: syntax * really add the rst file to the index ==================== Signed-off-by: Jakub Kicinski commit 4791d77a08ccd33c989daf31bf948bbbaf673460 Author: Robert Schwebel Date: Fri Nov 22 08:43:06 2019 +0100 docs: networking: nfc: change to rst format Now that the sphinx syntax has been fixed, change the document from txt to rst and add it to the index. Signed-off-by: Robert Schwebel Signed-off-by: Jakub Kicinski commit bf0b2511e8d7d2f08b784469a4c1d84557305d3c Author: Robert Schwebel Date: Fri Nov 22 08:43:05 2019 +0100 docs: networking: nfc: fix code block syntax Silence this warning: Documentation/networking/nfc.rst:113: WARNING: Definition list ends without a blank line; unexpected unindent. Signed-off-by: Robert Schwebel Signed-off-by: Jakub Kicinski commit f67b7c087404d6a7f2abf7657d4ba3a0b9fdfcfa Author: Robert Schwebel Date: Fri Nov 22 08:43:04 2019 +0100 docs: networking: nfc: fix bullet list syntax Fix this warning: Documentation/networking/nfc.rst:87: WARNING: Bullet list ends without a blank line; unexpected unindent. Signed-off-by: Robert Schwebel Signed-off-by: Jakub Kicinski commit c0b96e8f9f84165c294b486712aa6303391692a0 Author: Robert Schwebel Date: Fri Nov 22 08:43:03 2019 +0100 docs: networking: nfc: change block diagram to sphinx syntax Change the block diagram to match the sphinx syntax. This will make it possible to switch this file to rst in the future. Signed-off-by: Robert Schwebel Signed-off-by: Jakub Kicinski commit 66ac53a8c5c8693741ea9e6682763f6ccb43db23 Author: Robert Schwebel Date: Fri Nov 22 08:43:02 2019 +0100 docs: networking: nfc: change headlines to sphinx syntax The headlines in this file do are not in the standard kernel docu- mentation headline format. Change it, so this file can be switched to rst in the future. Signed-off-by: Robert Schwebel Signed-off-by: Jakub Kicinski commit a5d66f810061e2dd70fb7a108dcd14e535bc639f Author: Russell King Date: Fri Nov 22 15:23:23 2019 +0000 net: phy: initialise phydev speed and duplex sanely When a phydev is created, the speed and duplex are set to zero and -1 respectively, rather than using the predefined SPEED_UNKNOWN and DUPLEX_UNKNOWN constants. There is a window at initialisation time where we may report link down using the 0/-1 values. Tidy this up and use the predefined constants, so debug doesn't complain with: "Unsupported (update phy-core.c)/Unsupported (update phy-core.c)" when the speed and duplex settings are printed. Signed-off-by: Russell King Signed-off-by: Jakub Kicinski commit e3cf8b3668a808c1d252269ffc34a5723cfb9a7b Author: Russell King Date: Fri Nov 22 12:37:08 2019 +0000 net: phy: remove phy_ethtool_sset() There are no users of phy_ethtool_sset() in the kernel anymore, and as of commit 3c1bcc8614db ("net: ethernet: Convert phydev advertize and supported from u32 to link mode"), the implementation is slightly buggy - it doesn't correctly check the masked advertising mask as it used to. Remove it, and update the phy documentation to refer to its replacement function. Signed-off-by: Russell King Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski commit 84bb46cd62283cc371769ec1f77ff7924099f584 Author: Jakub Kicinski Date: Sat Nov 23 09:54:58 2019 -0800 Revert "bpf: Emit audit messages upon successful prog load and unload" This commit reverts commit 91e6015b082b ("bpf: Emit audit messages upon successful prog load and unload") and its follow up commit 7599a896f2e4 ("audit: Move audit_log_task declaration under CONFIG_AUDITSYSCALL") as requested by Paul Moore. The change needs close review on linux-audit, tests etc. Signed-off-by: Jakub Kicinski commit b2b2dd71e0859436d4e05b2f61f86140250ed3f8 Author: Dmitry Torokhov Date: Fri Nov 22 12:42:20 2019 -0800 tty: vt: keyboard: reject invalid keycodes Do not try to handle keycodes that are too big, otherwise we risk doing out-of-bounds writes: BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline] BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722 ... kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118 input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145 input_pass_values drivers/input/input.c:949 [inline] input_set_keycode+0x290/0x320 drivers/input/input.c:954 evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882 evdev_do_ioctl drivers/input/evdev.c:1150 [inline] In this case we were dealing with a fuzzed HID device that declared over 12K buttons, and while HID layer should not be reporting to us such big keycodes, we should also be defensive and reject invalid data ourselves as well. Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com Signed-off-by: Dmitry Torokhov Cc: stable Link: https://lore.kernel.org/r/20191122204220.GA129459@dtor-ws Signed-off-by: Greg Kroah-Hartman commit 85c9aae9ac8b228f2134b56d4fc743afc446947a Author: Jim Mattson Date: Fri Nov 22 15:43:55 2019 -0800 kvm: nVMX: Relax guest IA32_FEATURE_CONTROL constraints Commit 37e4c997dadf ("KVM: VMX: validate individual bits of guest MSR_IA32_FEATURE_CONTROL") broke the KVM_SET_MSRS ABI by instituting new constraints on the data values that kvm would accept for the guest MSR, IA32_FEATURE_CONTROL. Perhaps these constraints should have been opt-in via a new KVM capability, but they were applied indiscriminately, breaking at least one existing hypervisor. Relax the constraints to allow either or both of FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX and FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX to be set when nVMX is enabled. This change is sufficient to fix the aforementioned breakage. Fixes: 37e4c997dadf ("KVM: VMX: validate individual bits of guest MSR_IA32_FEATURE_CONTROL") Signed-off-by: Jim Mattson Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini commit ad5996d9a0e8019c3ae5151e687939369acfe044 Author: Sean Christopherson Date: Fri Nov 22 08:58:18 2019 -0800 KVM: x86: Grab KVM's srcu lock when setting nested state Acquire kvm->srcu for the duration of ->set_nested_state() to fix a bug where nVMX derefences ->memslots without holding ->srcu or ->slots_lock. The other half of nested migration, ->get_nested_state(), does not need to acquire ->srcu as it is a purely a dump of internal KVM (and CPU) state to userspace. Detected as an RCU lockdep splat that is 100% reproducible by running KVM's state_test selftest with CONFIG_PROVE_LOCKING=y. Note that the failing function, kvm_is_visible_gfn(), is only checking the validity of a gfn, it's not actually accessing guest memory (which is more or less unsupported during vmx_set_nested_state() due to incorrect MMU state), i.e. vmx_set_nested_state() itself isn't fundamentally broken. In any case, setting nested state isn't a fast path so there's no reason to go out of our way to avoid taking ->srcu. ============================= WARNING: suspicious RCU usage 5.4.0-rc7+ #94 Not tainted ----------------------------- include/linux/kvm_host.h:626 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by evmcs_test/10939: #0: ffff88826ffcb800 (&vcpu->mutex){+.+.}, at: kvm_vcpu_ioctl+0x85/0x630 [kvm] stack backtrace: CPU: 1 PID: 10939 Comm: evmcs_test Not tainted 5.4.0-rc7+ #94 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: dump_stack+0x68/0x9b kvm_is_visible_gfn+0x179/0x180 [kvm] mmu_check_root+0x11/0x30 [kvm] fast_cr3_switch+0x40/0x120 [kvm] kvm_mmu_new_cr3+0x34/0x60 [kvm] nested_vmx_load_cr3+0xbd/0x1f0 [kvm_intel] nested_vmx_enter_non_root_mode+0xab8/0x1d60 [kvm_intel] vmx_set_nested_state+0x256/0x340 [kvm_intel] kvm_arch_vcpu_ioctl+0x491/0x11a0 [kvm] kvm_vcpu_ioctl+0xde/0x630 [kvm] do_vfs_ioctl+0xa2/0x6c0 ksys_ioctl+0x66/0x70 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x54/0x200 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f59a2b95f47 Fixes: 8fcc4b5923af5 ("kvm: nVMX: Introduce KVM_CAP_NESTED_STATE") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 05c19c2fe17c331ec384a2953be50101e8a15a73 Author: Sean Christopherson Date: Fri Nov 22 12:04:50 2019 -0800 KVM: x86: Open code shared_msr_update() in its only caller Fold shared_msr_update() into its sole user to eliminate its pointless bounds check, its godawful printk, its misleading comment (it's called under a global lock), and its woefully inaccurate name. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit faf0be22167486feb1ee386f0e819a336e829d0a Author: Miaohe Lin Date: Sat Nov 23 10:45:50 2019 +0800 KVM: Fix jump label out_free_* in kvm_init() The jump label out_free_1 and out_free_2 deal with the same stuff, so git rid of one and rename the label out_free_0a to retain the label name order. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit 24885d1d79e2e83d49201aeae0bc59f1402fd4f1 Author: Sean Christopherson Date: Fri Nov 22 12:15:49 2019 -0800 KVM: x86: Remove a spurious export of a static function A recent change inadvertently exported a static function, which results in modpost throwing a warning. Fix it. Fixes: cbbaa2727aa3 ("KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES") Signed-off-by: Sean Christopherson Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 8cacac6ecd6d289d4ab52590784636a5b1043c66 Merge: 8f6ee51d772d 4584f084aa9d Author: Ingo Molnar Date: Sat Nov 23 09:00:13 2019 +0100 Merge tag 'perf-core-for-mingo-5.5-20191122' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: perf report: Jin Yao: - Allow entering the annotation view (symbol source/assembly + overhead/cycles/etc column) from the 'perf report --total-cycles' interface. E.g.: # perf record --all-cpus --branch-any --all-kernel ^C[ perf record: Woken up 5 times to write data ] # # perf evlist -v cycles: size: 120, { sample_period, sample_freq }: 4000, sample_type: IP|TID|TIME|CPU|PERIOD|BRANCH_STACK, read_format: ID, disabled: 1, inherit: 1, exclude_user: 1, mmap: 1, comm: 1, freq: 1, task: 1, precise_ip: 3, sample_id_all: 1, exclude_guest: 1, mmap2: 1, comm_exec: 1, ksymbol: 1, bpf_event: 1, branch_sample_type: ANY # # perf report --total-cycles # # Samples: 78762 of event 'cycles' Sampled Sampled Avg Avg Cycles% Cycles Cycles% Cycles [Program Block Range] Shared Object 1.72% 95.8K 0.00% 254 [msr.h:105 -> msr.h:166] [kernel.vmlinux] 1.56% 107.6K 0.00% 618 [compiler.h:199 -> common.c:301] [kernel.vmlinux] 0.83% 46.3K 0.00% 409 [entry_64.S:153 -> entry_64.S:175] [kernel.vmlinux] 0.83% 46.1K 0.00% 83 [jump_label.h:41 -> tsc.c:230] [kernel.vmlinux] 0.64% 36.9K 0.01% 1.4K [hda_intel.c:904 -> hda_intel.c:916] [snd_hda_intel] 0.57% 30.2K 0.00% 282 [file.c:710 -> file.c:730] [kernel.vmlinux] 0.48% 25.8K 0.00% 82 [spinlock.c:158 -> spinlock.c:160] [kernel.vmlinux] 0.45% 23.7K 0.00% 369 [tick-broadcast.c:585 -> tick-broadcast.c:586] [kernel.vmlinux] 0.44% 24.4K 0.00% 73 [msr.h:236 -> tsc.c:1088] [kernel.vmlinux] 0.43% 22.7K 0.00% 144 [cpuidle.c:229 -> cpuidle.c:232] [kernel.vmlinux] Then press 'A' or Enter on one of those lines, just like with 'perf top', say the top one: [msr.h:105 -> msr.h:166], then this shows up: Samples: 78K of event 'cycles', 4000 Hz, Event count (approx.): 78762 native_write_msr /lib/modules/5.4.0-rc8/build/vmlinux [Percent: local period] Percent│ IPC Cycle (Average IPC: 0.02, IPC Coverage: 50.0%) │ │ Disassembly of section .text: │ │ ffffffff8106c480 : │ __wrmsr(): │ return EAX_EDX_VAL(val, low, high); │ } │ │ static inline void notrace __wrmsr(unsigned int msr, u32 low, u32 high) │ { │ asm volatile("1: wrmsr\n" 49.16 │0.02 mov %edi,%ecx │0.02 mov %esi,%eax │0.02 wrmsr │ arch_static_branch(): │ #include │ #include │ │ static __always_inline bool arch_static_branch(struct static_key *key, bool branch) │ { │ asm_volatile_goto("1:" 0.79 │0.02 nop │ native_write_msr(): │ { │ __wrmsr(msr, low, high); │ │ if (msr_tracepoint_active(__tracepoint_write_msr)) │ do_trace_write_msr(msr, ((u64)high << 32 | low), 0); │ } 50.05 │0.02 254 ← retq │ do_trace_write_msr(msr, ((u64)high << 32 | low), 0); │ shl $0x20,%rdx │ mov %esi,%esi │ or %rdx,%rsi │ xor %edx,%edx │ → jmpq do_trace_write_msr We need to improve this to show the source code line numbers in the annotation view, so one can go from that program block to the annotation view and see those source code line numbers straight away. auxtrace/Intel PT: Adrian Hunter: - Add support for AUX area sampling, requires new functionality that will land in 5.5, its already in tip. This includes kernel capability querying so that it fails gracefully with older kernels, duimping aux area samples in 'perf report -D' and 'perf script'. perf.data: Alexey Budankov: - Fix decompression of PERF_RECORD_COMPRESSED records. core: Arnaldo Carvalho de Melo: - Use the 'dcacheline' cmp routine to find the right DSOs taking into account the 'maj', 'min', 'ino' and 'ino_generation', that got moved from 'struct map' to 'struct dso', where it belongs. This further reduces the size of 'struct map', there is still more work to do to maybe get it to max one cacheline. libtraceevent: Hewenliang: - Fix memory leakage in copy_filter_type(). Sudip Mukherjee: - Fix header installation. perf parse: Ian Rogers : - Fix potential memory leak when handling tracepoint errors, found using LLVM's libFuzzer. perf probe: Colin Ian King: - Fix spelling mistake "addrees" -> "address". Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit b1fbfcb4a20949df08dd995927cdc5ad220c128d Author: Masahiro Yamada Date: Mon Nov 18 13:52:47 2019 +0900 kbuild: make single target builds even faster Commit 2dffd23f81a3 ("kbuild: make single target builds much faster") made the situation much better. To improve it even more, apply the similar idea to the top Makefile. Trim unrelated directories from build-dirs. The single build code must be moved above the 'descend' target. Signed-off-by: Masahiro Yamada Tested-by: Jens Axboe commit 7ef9ab3b32b4bb72a7d70b832d2eb12ceb93d9fd Author: Masahiro Yamada Date: Fri Nov 15 02:42:26 2019 +0900 modpost: respect the previous export when 'exported twice' is warned When 'exported twice' is warned, let sym_add_exported() return without updating the symbol info. This respects the previous export, which is ordered first in modules.order This simplifies the code too. Signed-off-by: Masahiro Yamada commit e4b26c9f75e48b5ef9e31ac6c8a445d4479b469c Author: Masahiro Yamada Date: Fri Nov 15 02:42:25 2019 +0900 modpost: do not set ->preloaded for symbols from Module.symvers Now that there is no overwrap between symbols from ELF files and ones from Module.symvers. So, the 'exported twice' warning should be reported irrespective of where the symbol in question came from. The exceptional case is external module; in some cases, we build an external module to provide a different version/variant of the corresponding in-kernel module, overriding the same set of exported symbols. You can see this use-case in upstream; tools/testing/nvdimm/libnvdimm.ko replaces drivers/nvdimm/libnvdimm.ko in order to link it against mocked version of core kernel symbols. So, let's relax the 'exported twice' warning when building external modules. The multiple export from external modules is warned only when the previous one is from vmlinux or itself. With this refactoring, the ugly preloading goes away. Signed-off-by: Masahiro Yamada commit 1743694eb2357b47cd9951079f9ab0d728c916bf Author: Masahiro Yamada Date: Fri Nov 15 02:42:24 2019 +0900 modpost: stop symbol preloading for modversion CRC It is complicated to add mocked-up symbols for pre-handling CRC. Handle CRC after all the export symbols in the relevant module are registered. Call handle_modversion() after the handle_symbol() iteration. In some cases, I see atand-alone __crc_* without __ksymtab_*. For example, ARCH=arm allyesconfig produces __crc_ccitt_veneer and __crc_itu_t_veneer. I guess they come from crc_ccitt, crc_itu_t, respectively. Since __*_veneer are auto-generated symbols, just ignore them. Signed-off-by: Masahiro Yamada commit 4a1288f1c1cf5829f90c30f9d1af67f526ba4d85 Author: Giovanni Mascellani Date: Fri Nov 22 11:15:19 2019 +0100 dell-smm-hwmon: Add documentation Part of the documentation is taken from the README of the userspace utils (https://github.com/vitorafsr/i8kutils). The license is GPL-2+ and the author Massimo Dal Zotto is already credited as author of the module. Therefore there should be no copyright problem. I also added a paragraph with specific information on the experimental support for automatic BIOS fan control. Signed-off-by: Giovanni Mascellani Link: https://lore.kernel.org/r/20191122101519.1246458-2-gio@debian.org [groeck: Fixed some of the documentation warnings] Signed-off-by: Guenter Roeck commit afe45277ade62438db8af8bbd812ead453b5d98d Author: Giovanni Mascellani Date: Fri Nov 22 11:15:18 2019 +0100 hwmon: (dell-smm) Add support for disabling automatic BIOS fan control This patch exports standard hwmon pwmX_enable sysfs attribute for enabling or disabling automatic fan control by BIOS. Standard value "1" is for disabling automatic BIOS fan control and value "2" for enabling. By default BIOS auto mode is enabled by laptop firmware. When BIOS auto mode is enabled, custom fan speed value (set via hwmon pwmX sysfs attribute) is overwritten by SMM in few seconds and therefore any custom settings are without effect. So this is reason why implementing option for disabling BIOS auto mode is needed. So finally this patch allows kernel to set and control fan speed on laptops, but it can be dangerous (like setting speed of other fans). The SMM commands to enable or disable automatic fan control are not documented and are not the same on all Dell laptops. Therefore a whitelist is used to send the correct codes only on laptopts for which they are known. This patch was originally developed by Pali Rohár; later Giovanni Mascellani implemented the whitelist. Signed-off-by: Giovanni Mascellani Co-Developed-by: Pali Rohár Signed-off-by: Pali Rohár Link: https://lore.kernel.org/r/20191122101519.1246458-1-gio@debian.org [groeck: Fixed checkpatch warnings] Signed-off-by: Guenter Roeck commit 9bd2a099d7224281dd7756efa5c79df4f3fe8daf Author: Masahiro Yamada Date: Fri Nov 15 02:42:23 2019 +0900 modpost: rename handle_modversions() to handle_symbol() This function handles not only modversions, but also unresolved symbols, export symbols, etc. Rename it to a more proper function name. While I was here, I also added the 'const' qualifier to *sym. Signed-off-by: Masahiro Yamada commit e84f9fbbece1585f45a03ccc11eeabe121cadc1b Author: Masahiro Yamada Date: Fri Nov 15 02:42:22 2019 +0900 modpost: refactor namespace_from_kstrtabns() to not hard-code section name Currently, namespace_from_kstrtabns() relies on the fact that namespace strings are recorded in the __ksymtab_strings section. Actually, it is coded in include/linux/export.h, but modpost does not need to hard-code the section name. Elf_Sym::st_shndx holds the index of the relevant section. Using it is a more portable way to get the namespace string. Make namespace_from_kstrtabns() simply call sym_get_data(), and delete the info->ksymtab_strings . While I was here, I added more 'const' qualifiers to pointers. Signed-off-by: Masahiro Yamada commit afa0459daa7b08c7b2c879705b69d39b734a11d0 Author: Masahiro Yamada Date: Fri Nov 15 02:42:21 2019 +0900 modpost: add a helper to get data pointed by a symbol When CONFIG_MODULE_REL_CRCS is enabled, the value of __crc_* is not an absolute value, but the address to the CRC data embedded in the .rodata section. Getting the data pointed by the symbol value is somewhat complex. Split it out into a new helper, sym_get_data(). I will reuse it to refactor namespace_from_kstrtabns() in the next commit. Signed-off-by: Masahiro Yamada commit 1646220a6d4b27153ddb5ffb117aa1f4c39e3d1f Merge: 8eace9fb3960 2e06b2717535 Author: Paul Walmsley Date: Fri Nov 22 18:59:23 2019 -0800 Merge branch 'next/defconfig-add-debug' into for-next commit 8eace9fb39605f0e201223fd34306ba3b53969b7 Merge: 5ba9aa56e6d3 2cc6c4a0da4a Author: Paul Walmsley Date: Fri Nov 22 18:59:17 2019 -0800 Merge branch 'next/misc2' into for-next commit 5ba9aa56e6d3e8fddb954c2f818d1ce0525235bb Merge: 4a979862dde4 405fe7aa0dba Author: Paul Walmsley Date: Fri Nov 22 18:59:09 2019 -0800 Merge branch 'next/nommu' into for-next Conflicts: arch/riscv/boot/Makefile arch/riscv/include/asm/sbi.h commit 4a979862dde46b738316014ca4995eae2f428413 Merge: e8cad25b7e8a c5ab54e9945b Author: Paul Walmsley Date: Fri Nov 22 18:58:34 2019 -0800 Merge branch 'next/misc' into for-next commit e8cad25b7e8ac8a1ecd7d7243cbea9cfa7049bee Merge: 9acfd6f5387d 6efb16b1d551 Author: Paul Walmsley Date: Fri Nov 22 18:58:32 2019 -0800 Merge branch 'next/tlb-opt' into for-next commit 9acfd6f5387dbded57a2d8e9f8480ebbbc3b03c6 Merge: 69049d523fb1 1edd28b7e85d Author: Paul Walmsley Date: Fri Nov 22 18:58:29 2019 -0800 Merge branch 'next/isa-string' into for-next commit 69049d523fb108abee59d94b89ea23b889f40236 Merge: a99d8080aaf3 5340627e3fe0 Author: Paul Walmsley Date: Fri Nov 22 18:58:26 2019 -0800 Merge branch 'next/seccomp' into for-next commit 2cc6c4a0da4ab11537b2567952b59af71a90ef12 Author: Yash Shah Date: Mon Nov 18 05:58:34 2019 +0000 RISC-V: Add address map dumper Add support for dumping the kernel address space layout to the console. User can enable CONFIG_DEBUG_VM to dump the virtual memory region into dmesg buffer during boot-up. Signed-off-by: Yash Shah Reviewed-by: Logan Gunthorpe Reviewed-by: Anup Patel [paul.walmsley@sifive.com: dropped .init/.text/.data/.bss prints; added PCI legacy I/O region display] Signed-off-by: Paul Walmsley commit 2e06b27175354a9a5a0c336a732739daf4489fb8 Author: Paul Walmsley Date: Thu Nov 21 18:24:26 2019 -0800 riscv: defconfigs: enable more debugging options Enable more debugging options in the RISC-V defconfigs to help kernel developers catch problems with patches earlier in the development cycle. Signed-off-by: Paul Walmsley Reviewed-by: Palmer Dabbelt commit 8dcdc9524cad74968b18322651d6fafb288a00ad Merge: c4f2cbd37651 6fbc05e59163 Author: Jakub Kicinski Date: Fri Nov 22 17:51:14 2019 -0800 Merge branch 'sfc-ARFS-expiry-improvements' Edward Cree says: ==================== A series of changes to how we check filters for expiry, manage how much of that work to do & when, etc. Prompted by some pathological behaviour under heavy load, which was Reported-by: David Ahern ==================== Signed-off-by: Jakub Kicinski commit 6fbc05e59163e66795a2bbdb4068abd7f7ae3510 Author: Edward Cree Date: Fri Nov 22 17:57:40 2019 +0000 sfc: do ARFS expiry work occasionally even without NAPI poll If there's no traffic on a channel, its ARFS expiry work will never get scheduled by efx_poll() as that isn't being run. So make efx_filter_rfs_expire() reschedule itself to run after 30 seconds. Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit ca70bd423f10b004f1bf7b2424d34025a9408e54 Author: Edward Cree Date: Fri Nov 22 17:57:27 2019 +0000 sfc: add statistics for ARFS Report the number of successful and failed insertions, and also the current count of filters, to aid in tuning e.g. rps_flow_cnt. Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit 0aa6608daec5d19275809d30df6a02529eb66c7d Author: Edward Cree Date: Fri Nov 22 17:57:19 2019 +0000 sfc: suppress MCDI errors from ARFS In high connection count usage, the NIC's filter table may be filled with sufficiently many ARFS filters that further insertions fail. As this does not represent a correctness issue, do not log the resulting MCDI errors. Add a debug-level message under the (by default disabled) rx_status category instead; and take the opportunity to do a little extra expiry work. Since there are now multiple workitems able to call __efx_filter_rfs_expire on a given channel, it is possible for them to race and thus pass quotas which, combined, exceed rfs_filter_count. Thus, don't WARN_ON if we loop all the way around the table with quota left over. Signed-off-by: Edward Cree Tested-by: David Ahern Signed-off-by: Jakub Kicinski commit 8490e75cdbb734829d3b324c3a52492c2edbfbd6 Author: Edward Cree Date: Fri Nov 22 17:57:03 2019 +0000 sfc: change ARFS expiry mechanism The old rfs_filters_added method for determining the quota could potentially allow the NIC to become filled with old filters, which never get tested for expiry. Instead, explicitly make expiry check work depend on the number of filters installed, and don't count checking slots without filters in as doing work. This guarantees that each filter will be checked for expiry at least once every thirty seconds (assuming the channel to which it belongs is NAPI polling actively) regardless of fill level. Signed-off-by: Edward Cree Tested-by: David Ahern Signed-off-by: Jakub Kicinski commit c4f2cbd37651372ad1775ee970e669ce735731c7 Merge: 30429fba99b5 ed960c1d36f5 Author: Jakub Kicinski Date: Fri Nov 22 16:59:00 2019 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== This series contains updates to the ice driver only. Bruce updates the driver to store the number of functions the device has so that it won't have to compute it when setting safe mode capabilities. Adds a check to adjust the reporting of capabilities for devices with more than 4 ports, which differ for devices with less than 4 ports. Brett adds a helper function to determine if the VF is allowed to do VLAN operations based on the host's VF configuration. Also adds a new function that initializes VLAN stripping (enabled/disabled) for the VF based on the device supported capabilities. Adds a check if the vector index is valid with the respect to the number of transmit and receive queues configured when we set coalesce settings for DCB. Adds a check if the promisc_mask contains ICE_PROMISC_VLAN_RX or ICE_PROMISC_VLAN_TX so that VLAN 0 promiscuous rules to be removed. Add a helper macro for a commonly used de-reference of a pointer to &pf->dev->pdev. Jesse fixes an issue where if an invalid virtchnl request from the VF, the driver would return uninitialized data to the VF from the PF stack, so ensure the stack variable is initialized earlier. Add helpers to the virtchnl interface make the reporting of strings consistent and help reduce stack space. Implements VF statistics gathering via the kernel ndo_get_vf_stats(). Akeem ensures we disable the state flag for each VF when its resources are returned to the device. Tony does additional cleanup in the driver to ensure the when we allocate and free memory within the same function, we should not be using devm_* variants; use regular alloc and free functions. Henry implements code to query and set the number of channels on the primary VSI for a PF via ethtool. Jake cleans up needless NULL checks in ice_sched_cleanup_all(). Kevin updates the firmware API version to align with current NVM images. v2: Added "Fixes:" tag to patch 5 commit description and added the use of netif_is_rxfh_configured() in patch 13 to see if RSS has been configured by the user, if so do not overwrite that configuration. ==================== Signed-off-by: Jakub Kicinski commit 30429fba99b51836ea8a11174be95ddaa8c47703 Author: Maciej Żenczykowski Date: Fri Nov 22 13:50:52 2019 -0800 net: inet_is_local_reserved_port() should return bool not int Cc: Eric Dumazet Signed-off-by: Maciej Żenczykowski Signed-off-by: Jakub Kicinski commit 16c0f03f629a89e6a1249497202b2c154ff46206 Author: Hassan Naveed Date: Fri Nov 15 23:44:49 2019 +0000 tracing: Enable syscall optimization for MIPS Since MIPS architecture has a sparse syscall array, select the HAVE_SPARSE_SYSCALL_NR to save space. Link: http://lkml.kernel.org/r/20191115234314.21599-2-hnaveed@wavecomp.com Signed-off-by: Hassan Naveed Reviewed-by: Paul Burton Signed-off-by: Steven Rostedt (VMware) commit 0e24220821b0e0e330a18bfef29ac6396545d62e Author: Hassan Naveed Date: Fri Nov 15 23:44:42 2019 +0000 tracing: Use xarray for syscall trace events Currently, a lot of memory is wasted for architectures like MIPS when init_ftrace_syscalls() allocates the array for syscalls using kcalloc. This is because syscalls numbers start from 4000, 5000 or 6000 and array elements up to that point are unused. Fix this by using a data structure more suited to storing sparsely populated arrays. The XARRAY data structure, implemented using radix trees, is much more memory efficient for storing the syscalls in question. Link: http://lkml.kernel.org/r/20191115234314.21599-1-hnaveed@wavecomp.com Signed-off-by: Hassan Naveed Reviewed-by: Paul Burton Signed-off-by: Steven Rostedt (VMware) commit 091189ab68d0b45de2f343b0c432804cacdeaf78 Merge: a9f852e92e40 8311f0be9763 Author: Jakub Kicinski Date: Fri Nov 22 16:46:33 2019 -0800 Merge branch 'cxgb4-add-udp-segmentation-offload-support' Rahul Lakkireddy says: ==================== This series of patches add UDP Segmentation Offload (USO) supported by Chelsio T5/T6 NICs. Patch 1 updates the current Scatter Gather List (SGL) DMA unmap logic for USO requests. Patch 2 adds USO support for NIC and MQPRIO QoS offload Tx path. Patch 3 adds missing stats for MQPRIO QoS offload Tx path. ==================== Signed-off-by: Jakub Kicinski commit 8311f0be9763386556d7b698f5e101c688f9c2eb Author: Rahul Lakkireddy Date: Fri Nov 22 06:30:03 2019 +0530 cxgb4: add stats for MQPRIO QoS offload Tx path Export necessary stats for traffic flowing through MQPRIO QoS offload Tx path. v2: - No change. Signed-off-by: Rahul Lakkireddy Signed-off-by: Jakub Kicinski commit 1a2a14fbc7e7df35aebb929ed6cdb1fcf238e9d2 Author: Rahul Lakkireddy Date: Fri Nov 22 06:30:02 2019 +0530 cxgb4: add UDP segmentation offload support Implement and export UDP segmentation offload (USO) support for both NIC and MQPRIO QoS offload Tx path. Update appropriate logic in Tx to parse GSO info in skb and configure FW_ETH_TX_EO_WR request needed to perform USO. v2: - Remove inline keyword from write_eo_udp_wr() in sge.c. Let the compiler decide. Signed-off-by: Rahul Lakkireddy Signed-off-by: Jakub Kicinski commit 0ed96b46c0ac26ebcdd2ee95c2479ef8cf94bbd6 Author: Rahul Lakkireddy Date: Fri Nov 22 06:30:01 2019 +0530 cxgb4/chcr: update SGL DMA unmap for USO The FW_ETH_TX_EO_WR used for sending UDP Segmentation Offload (USO) requests expects the headers to be part of the descriptor and the payload to be part of the SGL containing the DMA mapped addresses. Hence, the DMA address in the first entry of the SGL can start after the packet headers. Currently, unmap_sgl() tries to unmap from this wrong offset, instead of the originally mapped DMA address. So, use existing unmap_skb() instead, which takes originally saved DMA addresses as input. Update all necessary Tx paths to save the original DMA addresses, so that unmap_skb() can unmap them properly. v2: - No change. Signed-off-by: Rahul Lakkireddy Signed-off-by: Jakub Kicinski commit 341c1fda5e17156619fb71acfc7082b2669b4b72 Author: John Johansen Date: Sat Sep 14 03:34:06 2019 -0700 apparmor: make it so work buffers can be allocated from atomic context In some situations AppArmor needs to be able to use its work buffers from atomic context. Add the ability to specify when in atomic context and hold a set of work buffers in reserve for atomic context to reduce the chance that a large work buffer allocation will need to be done. Fixes: df323337e507 ("apparmor: Use a memory pool instead per-CPU caches") Signed-off-by: John Johansen commit 89ed42495ef4a020435f2b999093bb5731eeb8b9 Author: Divya Indi Date: Wed Nov 20 11:08:39 2019 -0800 tracing: Sample module to demonstrate kernel access to Ftrace instances. This is a sample module to demonstrate the use of the newly introduced and exported APIs to access Ftrace instances from within the kernel. Newly introduced APIs used here - 1. Create/Lookup a trace array with the given name. struct trace_array *trace_array_get_by_name(const char *name) 2. Destroy/Remove a trace array. int trace_array_destroy(struct trace_array *tr) 4. Enable/Disable trace events: int trace_array_set_clr_event(struct trace_array *tr, const char *system, const char *event, bool enable); Exported APIs - 1. trace_printk equivalent for instances. int trace_array_printk(struct trace_array *tr, unsigned long ip, const char *fmt, ...); 2. Helper function. void trace_printk_init_buffers(void); 3. To decrement the reference counter. void trace_array_put(struct trace_array *tr) Sample output(contents of /sys/kernel/tracing/instances/sample-instance) NOTE: Tracing disabled after ~5 sec) _-----=> irqs-off / _----=> need-resched | / _---=> hardirq/softirq || / _--=> preempt-depth ||| / delay TASK-PID CPU# |||| TIMESTAMP FUNCTION | | | |||| | | sample-instance-1452 [002] .... 49.430948: simple_thread: trace_array_printk: count=0 sample-instance-1452 [002] .... 49.430951: sample_event: count value=0 at jiffies=4294716608 sample-instance-1452 [002] .... 50.454847: simple_thread: trace_array_printk: count=1 sample-instance-1452 [002] .... 50.454849: sample_event: count value=1 at jiffies=4294717632 sample-instance-1452 [002] .... 51.478748: simple_thread: trace_array_printk: count=2 sample-instance-1452 [002] .... 51.478750: sample_event: count value=2 at jiffies=4294718656 sample-instance-1452 [002] .... 52.502652: simple_thread: trace_array_printk: count=3 sample-instance-1452 [002] .... 52.502655: sample_event: count value=3 at jiffies=4294719680 sample-instance-1452 [002] .... 53.526533: simple_thread: trace_array_printk: count=4 sample-instance-1452 [002] .... 53.526535: sample_event: count value=4 at jiffies=4294720704 sample-instance-1452 [002] .... 54.550438: simple_thread: trace_array_printk: count=5 sample-instance-1452 [002] .... 55.574336: simple_thread: trace_array_printk: count=6 Link: http://lkml.kernel.org/r/1574276919-11119-3-git-send-email-divya.indi@oracle.com Reviewed-by: Aruna Ramakrishna Signed-off-by: Divya Indi [ Moved to samples/ftrace ] Signed-off-by: Steven Rostedt (VMware) commit 28879787147358e8ffcae397f11748de3dd26577 Author: Divya Indi Date: Wed Nov 20 11:08:38 2019 -0800 tracing: Adding new functions for kernel access to Ftrace instances Adding 2 new functions - 1) struct trace_array *trace_array_get_by_name(const char *name); Return pointer to a trace array with given name. If it does not exist, create and return pointer to the new trace array. 2) int trace_array_set_clr_event(struct trace_array *tr, const char *system ,const char *event, bool enable); Enable/Disable events to this trace array. Additionally, - To handle reference counters, export trace_array_put() - Due to introduction of the above 2 new functions, we no longer need to export - ftrace_set_clr_event & trace_array_create APIs. Link: http://lkml.kernel.org/r/1574276919-11119-2-git-send-email-divya.indi@oracle.com Signed-off-by: Divya Indi Reviewed-by: Aruna Ramakrishna Signed-off-by: Steven Rostedt (VMware) commit fc809bc5ceaa665497384064ab2d76713c774bad Author: Krzysztof Kozlowski Date: Wed Nov 20 21:38:07 2019 +0800 tracing: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Link: http://lkml.kernel.org/r/20191120133807.12741-1-krzk@kernel.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Steven Rostedt (VMware) commit a82a4804b4ee3636c8988fea14d44f70f4de45f1 Author: Xianting Tian Date: Sat Nov 16 10:05:55 2019 -0500 ring-buffer: Fix typos in function ring_buffer_producer Fix spelling and other typos Link: http://lkml.kernel.org/r/1573916755-32478-1-git-send-email-xianting_tian@126.com Signed-off-by: Xianting Tian Signed-off-by: Steven Rostedt (VMware) commit b41db132821fdad9d80a177344a47468791fbe62 Author: Enrico Weigelt, metux IT consult Date: Thu Nov 21 14:38:15 2019 +0100 ftrace: Use BIT() macro It's cleaner to use the BIT() macro instead of raw shift operation. Link: http://lkml.kernel.org/r/20191121133815.15040-1-info@metux.net Signed-off-by: Enrico Weigelt, metux IT consult [ Added BIT() for bits 16 and 17 ] Signed-off-by: Steven Rostedt (VMware) commit bce4e7e9c45ef97ac1e30b9cb4adc25b5b5a7cfa Author: John Johansen Date: Fri Sep 13 22:24:23 2019 -0700 apparmor: reduce rcu_read_lock scope for aa_file_perm mediation Now that the buffers allocation has changed and no longer needs the full mediation under an rcu_read_lock, reduce the rcu_read_lock scope to only where it is necessary. Fixes: df323337e507 ("apparmor: Use a memory pool instead per-CPU caches") Signed-off-by: John Johansen commit 8f21a62475258ba07b032f5006fb26fd6501f314 Author: John Johansen Date: Thu Sep 12 02:01:35 2019 -0700 apparmor: fix wrong buffer allocation in aa_new_mount Fix the following trace caused by the dev_path buffer not being allocated. [ 641.044262] AppArmor WARN match_mnt: ((devpath && !devbuffer)): [ 641.044284] WARNING: CPU: 1 PID: 30709 at ../security/apparmor/mount.c:385 match_mnt+0x133/0x180 [ 641.044286] Modules linked in: snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_hda_codec snd_hda_core qxl ttm snd_hwdep snd_pcm drm_kms_helper snd_seq_midi snd_seq_midi_event drm snd_rawmidi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel iptable_mangle aesni_intel aes_x86_64 xt_tcpudp crypto_simd snd_seq cryptd bridge stp llc iptable_filter glue_helper snd_seq_device snd_timer joydev input_leds snd serio_raw fb_sys_fops 9pnet_virtio 9pnet syscopyarea sysfillrect soundcore sysimgblt qemu_fw_cfg mac_hid sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 8139too psmouse 8139cp i2c_piix4 pata_acpi mii floppy [ 641.044318] CPU: 1 PID: 30709 Comm: mount Tainted: G D W 5.1.0-rc4+ #223 [ 641.044320] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 641.044323] RIP: 0010:match_mnt+0x133/0x180 [ 641.044325] Code: 41 5d 41 5e 41 5f c3 48 8b 4c 24 18 eb b1 48 c7 c6 08 84 26 83 48 c7 c7 f0 56 54 83 4c 89 54 24 08 48 89 14 24 e8 7d d3 bb ff <0f> 0b 4c 8b 54 24 08 48 8b 14 24 e9 25 ff ff ff 48 c7 c6 08 84 26 [ 641.044327] RSP: 0018:ffffa9b34ac97d08 EFLAGS: 00010282 [ 641.044329] RAX: 0000000000000000 RBX: ffff9a86725a8558 RCX: 0000000000000000 [ 641.044331] RDX: 0000000000000002 RSI: 0000000000000001 RDI: 0000000000000246 [ 641.044333] RBP: ffffa9b34ac97db0 R08: 0000000000000000 R09: 0000000000000000 [ 641.044334] R10: 0000000000000000 R11: 00000000000077f5 R12: 0000000000000000 [ 641.044336] R13: ffffa9b34ac97e98 R14: ffff9a865e000008 R15: ffff9a86c4cf42b8 [ 641.044338] FS: 00007fab73969740(0000) GS:ffff9a86fbb00000(0000) knlGS:0000000000000000 [ 641.044340] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 641.044342] CR2: 000055f90bc62035 CR3: 00000000aab5f006 CR4: 00000000003606e0 [ 641.044346] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 641.044348] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 641.044349] Call Trace: [ 641.044355] aa_new_mount+0x119/0x2c0 [ 641.044363] apparmor_sb_mount+0xd4/0x430 [ 641.044367] security_sb_mount+0x46/0x70 [ 641.044372] do_mount+0xbb/0xeb0 [ 641.044377] ? memdup_user+0x4b/0x70 [ 641.044380] ksys_mount+0x7e/0xd0 [ 641.044384] __x64_sys_mount+0x21/0x30 [ 641.044388] do_syscall_64+0x5a/0x1a0 [ 641.044392] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 641.044394] RIP: 0033:0x7fab73a8790a [ 641.044397] Code: 48 8b 0d 89 85 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 56 85 0c 00 f7 d8 64 89 01 48 [ 641.044399] RSP: 002b:00007ffe0ffe4238 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 641.044401] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fab73a8790a [ 641.044429] RDX: 000055f90bc6203b RSI: 00007ffe0ffe57b1 RDI: 00007ffe0ffe57a5 [ 641.044431] RBP: 00007ffe0ffe4250 R08: 0000000000000000 R09: 00007fab73b51d80 [ 641.044433] R10: 00000000c0ed0004 R11: 0000000000000206 R12: 000055f90bc610b0 [ 641.044434] R13: 00007ffe0ffe4330 R14: 0000000000000000 R15: 0000000000000000 [ 641.044457] irq event stamp: 0 [ 641.044460] hardirqs last enabled at (0): [<0000000000000000>] (null) [ 641.044463] hardirqs last disabled at (0): [] copy_process.part.30+0x734/0x23f0 [ 641.044467] softirqs last enabled at (0): [] copy_process.part.30+0x734/0x23f0 [ 641.044469] softirqs last disabled at (0): [<0000000000000000>] (null) [ 641.044470] ---[ end trace c0d54bdacf6af6b2 ]--- Fixes: df323337e507 ("apparmor: Use a memory pool instead per-CPU caches") Signed-off-by: John Johansen commit 00e0590dbaec6f1bcaa36a85467d7e3497ced522 Author: Colin Ian King Date: Thu Jun 27 14:09:04 2019 +0100 apparmor: fix unsigned len comparison with less than zero The sanity check in macro update_for_len checks to see if len is less than zero, however, len is a size_t so it can never be less than zero, so this sanity check is a no-op. Fix this by making len a ssize_t so the comparison will work and add ulen that is a size_t copy of len so that the min() macro won't throw warnings about comparing different types. Addresses-Coverity: ("Macro compares unsigned to 0") Fixes: f1bd904175e8 ("apparmor: add the base fns() for domain labels") Signed-off-by: Colin Ian King Signed-off-by: John Johansen commit a9f852e92e40992c4ff09ac3940f7725e016317a Merge: 3243e04ab1c0 34c36f4564b8 Author: Jakub Kicinski Date: Fri Nov 22 16:27:24 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Minor conflict in drivers/s390/net/qeth_l2_main.c, kept the lock from commit c8183f548902 ("s390/qeth: fix potential deadlock on workqueue flush"), removed the code which was removed by commit 9897d583b015 ("s390/qeth: consolidate some duplicated HW cmd code"). Signed-off-by: Jakub Kicinski commit 71c296f6d5b33faf9867d04c6c5d75c7e56b886b Author: Hans Verkuil Date: Fri Nov 22 16:17:47 2019 -0800 Input: synaptics-rmi4 - fix various V4L2 compliance problems in F54 The v4l2-compliance utility reported several V4L2 API compliance issues: - the sequence counter wasn't filled in - the sequence counter wasn't reset to 0 at the start of streaming - the returned field value wasn't set to V4L2_FIELD_NONE - the timestamp wasn't set - the payload size was undefined if an error was returned - min_buffers_needed doesn't need to be initialized Fix these issues. Signed-off-by: Hans Verkuil Reviewed-by: Lucas Stach commit fc1156f373e3927e0dcf06678906c367588bfdd6 Author: Hans Verkuil Date: Fri Nov 22 16:17:08 2019 -0800 Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus Some Lenovo X1 Carbon Gen 6 laptops report LEN0091. Add this to the smbus_pnp_ids list. Signed-off-by: Hans Verkuil Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191119105118.54285-2-hverkuil-cisco@xs4all.nl Signed-off-by: Dmitry Torokhov commit 1e4fb2c0cb3443bf7d2606b6d571bd75879d098e Author: Manivannan Sadhasivam Date: Fri Nov 15 21:59:01 2019 +0530 MAINTAINERS: Add entry for BM1880 SoC clock driver Add MAINTAINERS entry for Bitmain BM1880 SoC clock driver. Signed-off-by: Manivannan Sadhasivam Link: https://lkml.kernel.org/r/20191115162901.17456-8-manivannan.sadhasivam@linaro.org Signed-off-by: Stephen Boyd commit 1ab4601da55be5d6374cca66f9ed9074763ca0a1 Author: Manivannan Sadhasivam Date: Fri Nov 15 21:59:00 2019 +0530 clk: Add common clock driver for BM1880 SoC Add common clock driver for Bitmain BM1880 SoC. The clock controller on BM1880 has supplies clocks to all peripherals in the form of gate clocks and composite clocks (fixed factor + gate). Signed-off-by: Manivannan Sadhasivam Link: https://lkml.kernel.org/r/20191115162901.17456-7-manivannan.sadhasivam@linaro.org Signed-off-by: Stephen Boyd commit 7046c6b018912726947d75c4cacf03ca51267f59 Author: Manivannan Sadhasivam Date: Fri Nov 15 21:58:57 2019 +0530 dt-bindings: clock: Add devicetree binding for BM1880 SoC Add YAML devicetree binding for Bitmain BM1880 SoC. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring Link: https://lkml.kernel.org/r/20191115162901.17456-4-manivannan.sadhasivam@linaro.org Signed-off-by: Stephen Boyd commit d8549bcd0529fcbd064c0e106f0a8806cab7546f Author: Manivannan Sadhasivam Date: Fri Nov 15 21:58:56 2019 +0530 clk: Add clk_hw_unregister_composite helper function definition This function has been delcared but not defined anywhere. Hence, this commit adds definition for it. Fixes: 49cb392d3639 ("clk: composite: Add hw based registration APIs") Signed-off-by: Manivannan Sadhasivam Link: https://lkml.kernel.org/r/20191115162901.17456-3-manivannan.sadhasivam@linaro.org Signed-off-by: Stephen Boyd commit cc819cf8d4760fac260e91dcf5c432abece3fcd2 Author: Manivannan Sadhasivam Date: Fri Nov 15 21:58:55 2019 +0530 clk: Zero init clk_init_data in helpers The clk_init_data struct needs to be initialized to zero for the new parent_map implementation to work correctly. Otherwise, the member which is available first will get processed. Signed-off-by: Manivannan Sadhasivam Link: https://lkml.kernel.org/r/20191115162901.17456-2-manivannan.sadhasivam@linaro.org Signed-off-by: Stephen Boyd commit bcf1e034d3aae39d27371b51916359ea7501db01 Author: Krzysztof Kozlowski Date: Fri Nov 22 14:49:30 2019 -0800 Input: fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/1574306373-29581-1-git-send-email-krzk@kernel.org Signed-off-by: Dmitry Torokhov commit b02efeb056998076163083a2be3df4a60830335a Author: Zhou Yanjie Date: Tue Nov 19 22:28:47 2019 +0800 MIPS: Ingenic: Disable abandoned HPTLB function. JZ4760/JZ4770/JZ4775/X1000/X1500 has an abandoned huge page tlb, this mode is not compatible with the MIPS standard, it will cause tlbmiss and into an infinite loop (line 21 in the tlb-funcs.S) when starting the init process. write 0xa9000000 to cp0 register 5 sel 4 to disable this function to prevent getting stuck. Confirmed by Ingenic, this operation will not adversely affect processors without HPTLB function. Signed-off-by: Zhou Yanjie Acked-by: Paul Cercueil Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: ralf@linux-mips.org Cc: jhogan@kernel.org Cc: jiaxun.yang@flygoat.com Cc: gregkh@linuxfoundation.org Cc: malat@debian.org Cc: tglx@linutronix.de Cc: chenhc@lemote.com commit 0ecdcaa6d5e78649578ff32c37556a4140b64edf Author: Krzysztof Kozlowski Date: Wed Nov 20 21:37:12 2019 +0800 openrisc: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Stafford Horne commit ed960c1d36f5db38a8038fcca83e1f6495f468fb Author: Kevin Scott Date: Fri Nov 8 06:23:31 2019 -0800 ice: Update FW API minor version Update FW API minor version to align to current value advertised by FW in new NVM images. Signed-off-by: Kevin Scott Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 1748ce80e0a3d4a66667fd154623aa1c33a44875 Author: Jacob Keller Date: Fri Nov 8 06:23:30 2019 -0800 ice: remove pointless NULL check of port_info The code in ice_sched_cleanup_all checks whether the port info is NULL prior to calling ice_sched_clear_port. However, ice_sched_clear_port already checks whether port info is non-NULL. More importantly, it also checks whether the port structure has been initialized by checking its port_state field as well. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 87324e747fde7693620f6d4c74aa11b7551e096d Author: Henry Tieman Date: Fri Nov 8 06:23:29 2019 -0800 ice: Implement ethtool ops for channels Add code to query and set the number of channels on the primary VSI for a PF. This is accessed from the 'ethtool -l' and 'ethtool -L' commands, respectively. Though the ice driver supports asymmetric queues report an IRQ vector that has both Rx and Tx queues attached and is counted as a 'combined' channel. Signed-off-by: Henry Tieman Co-developed-by: Maciej Fijalkowski Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 90ac245814abc30d2423474310654d31e3908b2f Author: Eli Cohen Date: Thu Oct 31 09:12:18 2019 +0200 net/mlx5e: Remove redundant pointer check When code reaches the "out" label, n is guaranteed to be valid so we can unconditionally call neigh_release. Also change the label to release_neigh to better reflect the fact that we unconditionally free the neighbour and also match other labels convention. Signed-off-by: Eli Cohen Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit e689e998e102100bdf7991763d4c244704846f2d Author: Saeed Mahameed Date: Fri Nov 1 15:38:30 2019 -0700 net/mlx5e: TC, Stub out ipv6 tun create header function Improve mlx5e_route_lookup_ipv6 function structure by avoiding #ifdef then return -EOPNOTSUPP in the middle of the function code. To do so, we stub out mlx5e_tc_tun_create_header_ipv6 which is the only caller of this helper function to avoid calling it altogether when ipv6 is compiled out, which should also cleanup some compiler warnings of unused variables. Signed-off-by: Saeed Mahameed Reviewed-by: Eli Cohen Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit b6d12238459d2f3c1140689c8fbb1bf1e0fe1927 Author: Yevgeny Kliteynik Date: Mon Oct 28 17:22:06 2019 +0200 net/mlx5: DR, Add support for Geneve packets SW steering Add support for SW steering matching on Geneve header fields: - VNI - OAM - protocol type - options length Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit a18fab48dbacbb7ff104a13e987778b7995bec07 Author: Yevgeny Kliteynik Date: Mon Oct 28 16:58:53 2019 +0200 net/mlx5: DR, Add HW bits and definitions for Geneve flex parser Add definition for flex parser tunneling header for Geneve. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 6e9e286e4ad53311b51b28fdc4b952ab7d2520c4 Author: Yevgeny Kliteynik Date: Mon Oct 28 16:30:27 2019 +0200 net/mlx5: DR, Refactor VXLAN GPE flex parser tunnel code for SW steering Refactor flex parser tunnel code: - Add definition for flex parser tunneling header for VXLAN-GPE - Use macros for VXLAN-GPE SW steering when building STE - Refactor the code to reflect that this is a VXLAN GPE only code and not a general flex parser code. This also significantly simplifies addition of more flex parser protocols, such as Geneve. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit ab118da4c10a70b8437f5c90ab77adae1835963e Author: Leon Romanovsky Date: Wed Nov 13 12:03:47 2019 +0200 net/mlx5: Don't write read-only fields in MODIFY_HCA_VPORT_CONTEXT command The MODIFY_HCA_VPORT_CONTEXT uses field_selector to mask fields needed to be written, other fields are required to be zero according to the HW specification. The supported fields are controlled by bitfield and limited to vport state, node and port GUIDs. Signed-off-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit 730fdea40beffbc47b5d03d8d6205e6f9a226adc Author: Jesse Brandeburg Date: Fri Nov 8 06:23:28 2019 -0800 ice: implement VF stats NDO Implement the VF stats gathering via the kernel via ndo_get_vf_stats(). The driver will show per-VF stats in the output of the ip -s link show dev command. Signed-off-by: Jesse Brandeburg Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 4c66d227e424c23af2c1c90f397909394f782c02 Author: Jesse Brandeburg Date: Fri Nov 8 06:23:27 2019 -0800 ice: add helpers for virtchnl The virtchannel interface was repeating a lot of strings and wasting storage space in the kernel. There was also inconsistent messages for the same thing. Consolidate all those messages and bit checks into a couple of helper functions. Also, reduce stack space usage by simplifying getting the pointer to the pf using a helper. Signed-off-by: Jesse Brandeburg Co-developed-by: Brett Creeley Signed-off-by: Brett Creeley Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 4015d11e4b9720718de7df28d25c04d08d8b6226 Author: Brett Creeley Date: Fri Nov 8 06:23:26 2019 -0800 ice: Add ice_pf_to_dev(pf) macro We use &pf->dev->pdev all over the code. Add a simple macro to do this for us. When multiple de-references like this are being done add a local struct device variable. Signed-off-by: Brett Creeley Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 9efe35d0db84cb7189e4a2c3d6a50eefd4380ff9 Author: Tony Nguyen Date: Fri Nov 8 06:23:25 2019 -0800 ice: Do not use devm* functions for local uses In situations where we alloc and free memory within the same function do not use the devm_* variants; use regular alloc and free functions. Remove any unused vars if there are no usages after these changes. Also, replace an allocate and copy with kmemdup() and remove an unnecessary memset() to 0 after a kzalloc(). Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 1bc7a4ab85ba0d874b193f2812a5e14e1ec6e9af Author: Brett Creeley Date: Fri Nov 8 06:23:24 2019 -0800 ice: Refactor removal of VLAN promiscuous rules Currently ice_clear_vsi_promisc() detects if the VLAN ID sent is not 0 and sets the recipe_id to ICE_SW_LKUP_PROMISC_VLAN in that case and ICE_SW_LKUP_PROMISC if the VLAN_ID is 0. However this doesn't allow VLAN 0 promiscuous rules to be removed, but they can be added. Fix this by checking if the promisc_mask contains ICE_PROMISC_VLAN_RX or ICE_PROMISC_VLAN_TX. This change was made to match what is being done for ice_set_vsi_promisc(). Signed-off-by: Brett Creeley Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit e25f9152bc07de534b2b590ce6c052ea25dd8900 Author: Brett Creeley Date: Fri Nov 8 06:23:23 2019 -0800 ice: Fix setting coalesce to handle DCB configuration Currently there can be a case where a DCB map is applied and there are more interrupt vectors (vsi->num_q_vectors) than Rx queues (vsi->num_rxq) and Tx queues (vsi->num_txq). If we try to set coalesce settings in this case it will report a false failure. Fix this by checking if vector index is valid with respect to the number of Tx and Rx queues configured. Signed-off-by: Brett Creeley Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 1f9639d2fb9188a59acafae9dea626391c442a8d Author: Akeem G Abodunrin Date: Fri Nov 8 06:23:22 2019 -0800 ice: Only disable VF state when freeing each VF resources It is wrong to set PF disable state flag for all VFs when freeing VF resources - Instead, we should set VF disable state flag for each VF with its resources being returned to the device. Right now, all VF opcodes, mailbox communication to clear its resources as well fails - since we already indicate that PF is in disable state, with all VFs not active. In addition, we don't need to notify VF that PF is intending to reset it, if it is already in disabled state. Signed-off-by: Akeem G Abodunrin Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 949375de945f7042df2b6488228a1a2b36e69f35 Author: Jesse Brandeburg Date: Fri Nov 8 06:23:21 2019 -0800 ice: fix stack leakage In the case of an invalid virtchannel request the driver would return uninitialized data to the VF from the PF stack which is a bug. Fix by initializing the stack variable earlier in the function before any return paths can be taken. Fixes: 1071a8358a28 ("ice: Implement virtchnl commands for AVF support") Signed-off-by: Jesse Brandeburg Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 2f9ec2419820350ee70b49a3c4feaa5b7b242f33 Author: Brett Creeley Date: Fri Nov 8 06:23:20 2019 -0800 ice: Don't modify stripping for add/del VLANs on VF Currently when adding/deleting vlans in ice_vc_process_vlan_msg() we are calling ice_vsi_manage_vlan_stripping() to enable/disable when adding and deleting a VLAN respectively. This is wrong because adding/deleting VLANs has nothing to do with configuring VLAN stripping. VLAN stripping is configured through the following VIRTCHNL operations: VIRTCHNL_OP_ENABLE_VLAN_STRIPPING VIRTCHNL_OP_DISABLE_VLAN_STRIPPING Unfortunately we can't just remove this because then stripping will never be configured on VF initialization. Fix this by adding a new function that initializes (disables/enables) VLAN stripping for the VF based on the device supported capabilities. This allows us to remove the call to ice_vsi_manage_vlan_stripping() in ice_vc_process_vlan_msg(). Signed-off-by: Brett Creeley Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit d4bc4e2d6b57712206abfc4e7751ff629b713070 Author: Brett Creeley Date: Fri Nov 8 06:23:19 2019 -0800 ice: Disallow VF VLAN opcodes if VLAN offloads disabled Currently if the host disables VLAN offloads on the VF by not setting the VIRTCHNL_VF_OFFLOAD_VLAN capability bit we will still honor VF VLAN configuration messages over VIRTCHNL. These messages (i.e. enable/disable VLAN stripping and VLAN filtering) should be blocked when the feature is not supported. Fix that by adding a helper function to determine if the VF is allowed to do VLAN operations based on the host's VF configuration. Also, mirror the VF communicated capabilities in the host's VF configuration. Signed-off-by: Brett Creeley Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 9164f761c99493a947dcbf3889a157943b46e738 Author: Bruce Allan Date: Fri Nov 8 06:23:18 2019 -0800 ice: Correct capabilities reporting of max TCs Firmware always returns 8 as the max number of supported TCs. However on devices with more than 4 ports, the maximum number of TCs per port is limited to 4. Check and, if necessary, correct the reporting of capabilities for devices with more than 4 ports. Signed-off-by: Bruce Allan Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit eae1bbb2a4519ad6c920a061dc49035ab5c36f1f Author: Bruce Allan Date: Fri Nov 8 06:23:17 2019 -0800 ice: Store number of functions for the device Store the number of functions the device has and use this number when setting safe mode capabilities instead of calculating it. Signed-off-by: Bruce Allan Co-developed-by: Kevin Scott Signed-off-by: Kevin Scott Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit e2ce328b282d0c7660576c25af6b9be34a6d2614 Merge: ca4196aa1008 79591b7db21d Author: Mark Brown Date: Fri Nov 22 19:56:37 2019 +0000 Merge remote-tracking branch 'spi/topic/ptp' into spi-next commit ca4196aa10087fe3ba3ce2383761898dc95b5e94 Merge: 8f3ed6d0b0db ffa119f7c42d Author: Mark Brown Date: Fri Nov 22 19:56:35 2019 +0000 Merge branch 'spi-5.5' into spi-next commit 8f3ed6d0b0db04db8297d951c26c809dd7b4778d Merge: af42d3466bdc c5923243eb32 Author: Mark Brown Date: Fri Nov 22 19:56:33 2019 +0000 Merge branch 'spi-5.4' into spi-linus commit a21da94f617bce0771144ea8093b6987184b38d0 Merge: c642e8708684 c15d5a645875 Author: Mark Brown Date: Fri Nov 22 19:56:20 2019 +0000 Merge branch 'regulator-5.5' into regulator-next commit c642e87086847d7f61b7b7d8744ac23e44cac91e Merge: af42d3466bdc 3f1a9e630b6e Author: Mark Brown Date: Fri Nov 22 19:56:18 2019 +0000 Merge branch 'regulator-5.4' into regulator-linus commit 8c4d2a0bfbd27d030e4652b714cd5a1598f3559b Merge: 3701d2cb8767 39870b0dec68 Author: Mark Brown Date: Fri Nov 22 19:56:02 2019 +0000 Merge branch 'asoc-5.5' into asoc-next commit 3701d2cb87671c227f1aa59226c9a01e9f01c2ea Merge: af42d3466bdc ef8e14794308 Author: Mark Brown Date: Fri Nov 22 19:55:59 2019 +0000 Merge branch 'asoc-5.4' into asoc-linus commit f920d1bb9c4e77efb08c41d70b6d442f46fd8902 Author: changzhu Date: Tue Nov 19 11:13:29 2019 +0800 drm/amdgpu: invalidate mmhub semaphore workaround in gmc9/gmc10 It may lose gpuvm invalidate acknowldege state across power-gating off cycle. To avoid this issue in gmc9/gmc10 invalidation, add semaphore acquire before invalidation and semaphore release after invalidation. After adding semaphore acquire before invalidation, the semaphore register become read-only if another process try to acquire semaphore. Then it will not be able to release this semaphore. Then it may cause deadlock problem. If this deadlock problem happens, it needs a semaphore firmware fix. Signed-off-by: changzhu Acked-by: Huang Rui Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 6c2c8972374ac5c35078d36d7559f64c368f7b33 Author: changzhu Date: Tue Nov 19 10:18:39 2019 +0800 drm/amdgpu: initialize vm_inv_eng0_sem for gfxhub and mmhub SW must acquire/release one of the vm_invalidate_eng*_sem around the invalidation req/ack. Through this way,it can avoid losing invalidate acknowledge state across power-gating off cycle. To use vm_invalidate_eng*_sem, it needs to initialize vm_invalidate_eng*_sem firstly. Signed-off-by: changzhu Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 1b34de7c3fef0c7ebb3d05acc1756bfb585279ca Author: Jack Zhang Date: Thu Nov 21 14:09:08 2019 +0800 drm/amd/amdgpu/sriov skip RLCG s/r list for arcturus VF. After rlcg fw 2.1, kmd driver starts to load extra fw for LIST_CNTL,GPM_MEM,SRM_MEM. We needs to skip the three fw because all rlcg related fw have been loaded by host driver. Guest driver would load the three fw fail without this change. Signed-off-by: Jack Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit ef1c0cbcd1e0db497ad0d7128e7157f0e3788b14 Author: Jack Zhang Date: Thu Nov 21 13:59:28 2019 +0800 drm/amd/amdgpu/sriov temporarily skip ras,dtm,hdcp for arcturus VF Temporarily skip ras,dtm,hdcp initialize and terminate for arcturus VF Currently the three features haven't been enabled at SRIOV, it would trigger guest driver load fail with the bare-metal path of the three features. Signed-off-by: Jack Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 210b3b3c7563df391bd81d49c51af303b928de4a Author: Xiaojie Yuan Date: Wed Nov 20 14:02:22 2019 +0800 drm/amdgpu/gfx10: re-init clear state buffer after gpu reset This patch fixes 2nd baco reset failure with gfxoff enabled on navi1x. clear state buffer (resides in vram) is corrupted after 1st baco reset, upon gfxoff exit, CPF gets garbage header in CSIB and hangs. Signed-off-by: Xiaojie Yuan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit a3511321fd004d0b2a6d81dab1837dcc6c752da4 Author: Stephen Rothwell Date: Thu Nov 21 14:54:03 2019 +1100 merge fix for "ftrace: Rework event_create_dir()" Reviewed-by: Kevin Wang Signed-off-by: Stephen Rothwell Signed-off-by: Alex Deucher commit 57fb0ab2f1398d81b42a8143a40e5d209a290a48 Author: Jay Cornwall Date: Wed Nov 20 16:32:46 2019 +0000 drm/amdgpu: Update Arcturus golden registers Signed-off-by: Jay Cornwall Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 908a28be092e425967099a2488ead7fc80572989 Author: Xiaojie Yuan Date: Fri Nov 22 14:21:15 2019 -0500 drm/amdgpu/gfx10: fix out-of-bound mqd_backup array access Fixes: 0900a9efdb7909 ("drm/amdgpu/gfx10: fix mqd backup/restore for gfx rings (v2)") Signed-off-by: Xiaojie Yuan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 1e902a6d32d73e4a6b3bc9d7cd43d4ee2b242dea Author: Xiaojie Yuan Date: Thu Nov 14 16:56:08 2019 +0800 drm/amdgpu/gfx10: explicitly wait for cp idle after halt/unhalt 50us is not enough to wait for cp ready after gpu reset on some navi asics. Signed-off-by: Xiaojie Yuan Suggested-by: Jack Xiao Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8e6a5c833333e14a5023a5dcabb64b7d9e046bc6 Author: Luc Van Oostenryck Date: Wed Nov 20 01:07:41 2019 +0100 ipmi: fix ipmb_poll()'s return type ipmb_poll() is defined as returning 'unsigned int' but the .poll method is declared as returning '__poll_t', a bitwise type. Fix this by using the proper return type and using the EPOLL constants instead of the POLL ones, as required for __poll_t. CC: Corey Minyard CC: openipmi-developer@lists.sourceforge.net CC: Greg Kroah-Hartman Signed-off-by: Luc Van Oostenryck Message-Id: <20191120000741.30657-1-luc.vanoostenryck@gmail.com> Reviewed-by: Asmaa Mnebhi Signed-off-by: Corey Minyard commit 39870b0dec68ed7dd814beb697e541670975c7d8 Author: Jaroslav Kysela Date: Wed Nov 20 18:44:35 2019 +0100 ASoC: DMI long name - avoid to add board name if matches with product name Current code: LENOVO-20QE000VMC-ThinkPadX1Carbon7th-20QE000VMC With the patch: LENOVO-20QE000VMC-ThinkPadX1Carbon7th Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20191120174435.30920-2-perex@perex.cz Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 4e01e5dbba96f731119f3f1a6bf51b54c98c5940 Author: Jaroslav Kysela Date: Wed Nov 20 18:44:34 2019 +0100 ASoC: improve the DMI long card code in asoc-core Add append_dmi_string() function and make the code more readable. Signed-off-by: Jaroslav Kysela Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191120174435.30920-1-perex@perex.cz Signed-off-by: Mark Brown commit ffa119f7c42d29be2dd759bb18cc4d1f45804c6b Author: Benjamin Gaignard Date: Wed Nov 20 20:44:44 2019 +0100 dt-bindings: spi: Convert stm32 QSPI bindings to json-schema Convert the STM32 QSPI binding to DT schema format using json-schema Signed-off-by: Benjamin Gaignard Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20191120194444.10540-1-benjamin.gaignard@st.com Signed-off-by: Mark Brown commit eb7e6dc6d9ffcce129ac04d4e7bd2dc015bd45a5 Author: Peter Ujfalusi Date: Thu Nov 21 11:27:03 2019 +0200 spi: pic32: Retire dma_request_slave_channel_compat() There is no reason to use the dma_request_slave_channel_compat() as no filter function and parameter is provided. Switch the driver to use dma_request_chan() instead and add support for deferred probing against DMA channel. Signed-off-by: Peter Ujfalusi Reviewed-by: Vinod Koul Link: https://lore.kernel.org/r/20191121092703.30465-1-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit c15d5a645875bc9b89f68f5d3fb608f691ac78d7 Author: Axel Lin Date: Fri Nov 22 12:51:54 2019 +0800 regulator: da9062: Return REGULATOR_MODE_INVALID for invalid mode -EINVAL is not a valid return value for .of_map_mode, return REGULATOR_MODE_INVALID instead. Fixes: 844e7492ee3d ("regulator: da9062: add of_map_mode support for bucks") Signed-off-by: Axel Lin Link: https://lore.kernel.org/r/20191122045154.802-1-axel.lin@ingics.com Signed-off-by: Mark Brown commit ef8e14794308a428b194f8b06ad9ae06b43466e4 Author: Nilkanth Ahirrao Date: Thu Nov 21 12:10:23 2019 +0100 ASoC: rsnd: fix DALIGN register for SSIU The current driver only sets 0x76543210 and 0x67452301 for DALIGN. This doesn’t work well for TDM split and ex-split mode for all SSIU. This patch programs the DALIGN registers based on the SSIU number. Cc: Kuninori Morimoto Cc: Jiada Wang Cc: Andrew Gabbasov Fixes: a914e44693d41b ("ASoC: rsnd: more clear rsnd_get_dalign() for DALIGN") Signed-off-by: Nilkanth Ahirrao Signed-off-by: Eugeniu Rosca Acked-by: Kuninori Morimoto Link: https://lore.kernel.org/r/20191121111023.10976-1-erosca@de.adit-jv.com Signed-off-by: Mark Brown commit 5e18d2b14c704d465ce85b0f6004c75f1150ab0b Author: Alex Deucher Date: Fri Nov 15 10:26:52 2019 -0500 Revert "drm/amd/display: enable S/G for RAVEN chip" This reverts commit 1c4259159132ae4ceaf7c6db37a6cf76417f73d9. S/G display is not stable with the IOMMU enabled on some platforms. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=205523 Acked-by: Christian König Signed-off-by: Alex Deucher commit 8fc41344138831071c5d5f51635c7eb33459e249 Author: Alex Deucher Date: Fri Nov 15 10:21:23 2019 -0500 drm/amdgpu: disable gfxoff on original raven There are still combinations of sbios and firmware that are not stable. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=204689 Acked-by: Christian König Signed-off-by: Alex Deucher commit 5355d7e054fcc4497c7100f131fb40a541c112f1 Author: Alex Deucher Date: Fri Nov 15 09:38:28 2019 -0500 drm/amdgpu: remove experimental flag for Navi14 5.4 and newer works fine with navi14. Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher commit 70f7eb639e2f1fd749f8ead171052bb28f2353df Author: Alex Deucher Date: Thu Nov 14 11:39:05 2019 -0500 drm/amdgpu: disable gfxoff when using register read interface When gfxoff is enabled, accessing gfx registers via MMIO can lead to a hang. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=205497 Acked-by: Xiaojie Yuan Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit dda0f4558c72260444ca8e8aef7366349dbb2ae3 Author: Alex Deucher Date: Wed Nov 13 11:08:35 2019 -0500 drm/amdgpu/powerplay: properly set PP_GFXOFF_MASK (v2) So that the setting reflects what the hw supports. This will be used in a subsequent patch so needs to be correct. v2: squash in fix from Colin Ian King Bug: https://bugzilla.kernel.org/show_bug.cgi?id=205497 Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 3d0e3ce52ce3eb4b9de3caf9c38dbb5a4d3e13c3 Author: Sam Bobroff Date: Mon Nov 18 10:53:54 2019 +1100 drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2 The INTERRUPT_CNTL2 register expects a valid DMA address, but is currently set with a GPU MC address. This can cause problems on systems that detect the resulting DMA read from an invalid address (found on a Power8 guest). Instead, use the DMA address of the dummy page because it will always be safe. Fixes: 27ae10641e9c ("drm/amdgpu: add interupt handler implementation for si v3") Signed-off-by: Sam Bobroff Signed-off-by: Alex Deucher commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 Author: Sam Bobroff Date: Mon Nov 18 10:53:53 2019 +1100 drm/radeon: fix bad DMA from INTERRUPT_CNTL2 The INTERRUPT_CNTL2 register expects a valid DMA address, but is currently set with a GPU MC address. This can cause problems on systems that detect the resulting DMA read from an invalid address (found on a Power8 guest). Instead, use the DMA address of the dummy page because it will always be safe. Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)") Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI") Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)") Signed-off-by: Sam Bobroff Signed-off-by: Alex Deucher commit e3dd3aa8e0b650c296ef5cc017639ecdc6c66619 Author: Mikita Lipski Date: Thu Oct 31 16:09:01 2019 -0400 drm/amd/display: Fix debugfs on MST connectors [why] Previous patch allowed to initialize debugfs entries on both MST and SST connectors, but MST connectors get registered much later which exposed an issue of debugfs entries being initialized in the same folder. [how] Return SST debugfs entries' initialization back to where it was. For MST connectors we should initialize debugfs entries in connector register function after the connector is registered. Signed-off-by: Mikita Lipski Reviewed-by: Nicholas Kazlauskas Acked-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit f8a69a8022a2aafe534c44f421534909869e619e Author: Alex Deucher Date: Wed Nov 13 14:27:54 2019 -0500 drm/amdgpu/nv: add asic func for fetching vbios from rom directly Needed as a fallback if the vbios can't be fetched by other means. Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher commit c0e21ea1d0b557bdedd5b54d529162f74e7ef407 Author: Yintian Tao Date: Mon Nov 18 16:06:00 2019 +0800 drm/amdgpu: put flush_delayed_work at first There is one regression from 042f3d7b745cd76aa To put flush_delayed_work after adev->shutdown = true which will make amdgpu_ih_process not response the irq At last, all ib ring tests will be failed just like below [drm] amdgpu: finishing device. [drm] Fence fallback timer expired on ring gfx [drm] Fence fallback timer expired on ring comp_1.0.0 [drm] Fence fallback timer expired on ring comp_1.1.0 [drm] Fence fallback timer expired on ring comp_1.2.0 [drm] Fence fallback timer expired on ring comp_1.3.0 [drm] Fence fallback timer expired on ring comp_1.0.1 amdgpu 0000:00:07.0: [drm:amdgpu_ib_ring_tests [amdgpu]] *ERROR* IB test failed on comp_1.1.1 (-110). amdgpu 0000:00:07.0: [drm:amdgpu_ib_ring_tests [amdgpu]] *ERROR* IB test failed on comp_1.2.1 (-110). amdgpu 0000:00:07.0: [drm:amdgpu_ib_ring_tests [amdgpu]] *ERROR* IB test failed on comp_1.3.1 (-110). amdgpu 0000:00:07.0: [drm:amdgpu_ib_ring_tests [amdgpu]] *ERROR* IB test failed on sdma0 (-110). amdgpu 0000:00:07.0: [drm:amdgpu_ib_ring_tests [amdgpu]] *ERROR* IB test failed on sdma1 (-110). amdgpu 0000:00:07.0: [drm:amdgpu_ib_ring_tests [amdgpu]] *ERROR* IB test failed on uvd_enc_0.0 (-110). amdgpu 0000:00:07.0: [drm:amdgpu_ib_ring_tests [amdgpu]] *ERROR* IB test failed on vce0 (-110). [drm:amdgpu_device_delayed_init_work_handler [amdgpu]] *ERROR* ib ring test failed (-110). v2: replace cancel_delayed_work_sync() with flush_delayed_work() Signed-off-by: Yintian Tao Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 4e20f6550b52bdc46e6237fc894985cb9fadffa4 Author: Leo Liu Date: Fri Nov 15 17:10:34 2019 -0500 drm/amdgpu/vcn2.5: fix the enc loop with hw fini Signed-off-by: Leo Liu Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit 06f75d54f462241ec19947e4b9abb8ef543503f1 Author: Evan Quan Date: Thu Nov 14 16:58:31 2019 +0800 drm/amd/powerplay: correct fine grained dpm force level setting For fine grained dpm, there is only two levels supported. However to reflect correctly the current clock frequency, there is an intermediate level faked. Thus on forcing level setting, we need to treat level 2 correctly as level 1. Signed-off-by: Evan Quan Reviewed-by: Kevin Wang Signed-off-by: Alex Deucher commit 1ac38dbf6edeaeb34a859b6e266c2462b6fee1eb Author: Evan Quan Date: Thu Nov 14 15:30:39 2019 +0800 drm/amd/powerplay: issue no PPSMC_MSG_GetCurrPkgPwr on unsupported ASICs Otherwise, the error message prompted will confuse user. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit a310a1b4c1a9b3a487f95c2fa5559a2869f56f15 Author: Evan Quan Date: Tue Nov 12 14:18:54 2019 +0800 drm/amd/powerplay: issue BTC on Navi during SMU setup RunBTC is added for Navi ASIC on hardware setup. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit d112ea3cf08695cf4377e6ecb102af34f2b76824 Author: Evan Quan Date: Mon Nov 11 17:15:02 2019 +0800 drm/amd/powerplay: avoid DPM reenable process on Navi1x ASICs V2 Otherwise, without RLC reinitialization, the DPM reenablement will fail. That affects the custom pptable uploading. V2: setting/clearing uploading_custom_pp_table in smu_sys_set_pp_table() Reported-by: Matt Coffin Signed-off-by: Evan Quan Tested-by: Matt Coffin Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 0900a9efdb79097dac253a67f6c4fe0a42b2508d Author: Xiaojie Yuan Date: Tue Oct 29 16:59:09 2019 +0800 drm/amdgpu/gfx10: fix mqd backup/restore for gfx rings (v2) 1. no need to allocate an extra member for 'mqd_backup' array 2. backup/restore mqd to/from the correct 'mqd_backup' array slot v2: warning fix (Alex) Signed-off-by: Xiaojie Yuan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit f2c5fd9e4c05947d3b98506731d9776625d7b7e5 Author: Paul Walmsley Date: Thu Jul 18 15:30:04 2019 -0700 riscv: defconfigs: enable debugfs debugfs is broadly useful, so enable it in the RISC-V defconfigs. Signed-off-by: Paul Walmsley Reviewed-by: Palmer Dabbelt commit 37640adbefd66491cb8083a438f7bf366ac09bc7 Author: Thomas Bogendoerfer Date: Tue Nov 19 12:08:57 2019 +0100 MIPS: PCI: remember nasid changed by set interrupt affinity When changing interrupt affinity remember the possible changed nasid, otherwise an interrupt deactivate/activate sequence will incorrectly setup interrupt. Fixes: e6308b6d35ea ("MIPS: SGI-IP27: abstract chipset irq from bridge") Signed-off-by: Thomas Bogendoerfer Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit e3d765a941f6130fd94e47b2064cfee71f4cbadd Author: Thomas Bogendoerfer Date: Tue Nov 19 12:08:56 2019 +0100 MIPS: SGI-IP27: Fix crash, when CPUs are disabled via nr_cpus parameter If number of CPUs are limited by the kernel commandline parameter nr_cpus assignment of interrupts accourding to numa rules might not be possibe. As a fallback use one of the online CPUs as interrupt destination. Fixes: 69a07a41d908 ("MIPS: SGI-IP27: rework HUB interrupts") Signed-off-by: Thomas Bogendoerfer Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 2bee1b58484f036e3e2dc657e524d095d0d332b3 Author: Mike Rapoport Date: Thu Nov 21 18:21:33 2019 +0200 mips: add support for folded p4d page tables Implement primitives necessary for the 4th level folding, add walks of p4d level where appropriate, replace 5leve-fixup.h with pgtable-nop4d.h and drop usage of __ARCH_USE_5LEVEL_HACK. Signed-off-by: Mike Rapoport Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org Cc: Mike Rapoport commit 31168f033e3751d1c9245d9ee847d775af16dcd6 Author: Mike Rapoport Date: Thu Nov 21 18:21:32 2019 +0200 mips: drop __pXd_offset() macros that duplicate pXd_index() ones The __pXd_offset() macros are identical to the pXd_index() macros and there is no point to keep both of them. All architectures define and use pXd_index() so let's keep only those to make mips consistent with the rest of the kernel. Signed-off-by: Mike Rapoport Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org Cc: Mike Rapoport commit 3ed6751bb8fa89c3014399bb0414348499ee202a Author: Mike Rapoport Date: Thu Nov 21 18:21:31 2019 +0200 mips: fix build when "48 bits virtual memory" is enabled With CONFIG_MIPS_VA_BITS_48=y the build fails miserably: CC arch/mips/kernel/asm-offsets.s In file included from arch/mips/include/asm/pgtable.h:644, from include/linux/mm.h:99, from arch/mips/kernel/asm-offsets.c:15: include/asm-generic/pgtable.h:16:2: error: #error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{P4D,PUD,PMD}_FOLDED #error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{P4D,PUD,PMD}_FOLDED ^~~~~ include/asm-generic/pgtable.h:390:28: error: unknown type name 'p4d_t'; did you mean 'pmd_t'? static inline int p4d_same(p4d_t p4d_a, p4d_t p4d_b) ^~~~~ pmd_t [ ... more such errors ... ] scripts/Makefile.build:99: recipe for target 'arch/mips/kernel/asm-offsets.s' failed make[2]: *** [arch/mips/kernel/asm-offsets.s] Error 1 This happens because when CONFIG_MIPS_VA_BITS_48 enables 4th level of the page tables, but neither pgtable-nop4d.h nor 5level-fixup.h are included to cope with the 5th level. Replace #ifdef conditions around includes of the pgtable-nop{m,u}d.h with explicit CONFIG_PGTABLE_LEVELS and add include of 5level-fixup.h for the case when CONFIG_PGTABLE_LEVELS==4 Signed-off-by: Mike Rapoport Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org Cc: Mike Rapoport commit 9314e44f455c8b46d08b2d379cb9e8fba5767207 Author: Andrew Gabbasov Date: Fri Nov 22 11:52:18 2019 -0600 ALSA: aloop: Avoid unexpected timer event callback tasklets loopback_snd_timer_close_cable() function waits until all scheduled tasklets are completed, but the timer is closed after that and can generate more event callbacks, scheduling new tasklets, that will not be synchronized with cable closing. Move tasklet_kill() call to be executed after snd_timer_close() call to avoid such case. Fixes: 26c53379f98d ("ALSA: aloop: Support selection of snd_timer instead of jiffies") Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191122175218.17187-2-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit 716864586c6261b079a4d5ebc02f19adc8e6aa38 Author: Simon Goldschmidt Date: Fri May 3 11:15:07 2019 +0200 arm: socfpga: execute cold reboot by default This changes system reboot for socfpga to issue a cold reboot by default instead of a warm reboot. Warm reboot can still be used by setting reboot_mode to REBOOT_WARM (e.g. via kernel command line 'reboot='), but this patch ensures cold reboot is issued for both REBOOT_COLD and REBOOT_HARD. Also, cold reboot is more fail safe than warm reboot has some issues at least fo CSEL=0 and BSEL=qspi, where the boot rom does not set the qspi clock to a valid range. Signed-off-by: Simon Goldschmidt Signed-off-by: Dinh Nguyen commit c037239c2373f79613dac32d0fb20c07f12f719b Author: Andrew Gabbasov Date: Fri Nov 22 11:52:17 2019 -0600 ALSA: aloop: Remove redundant locking in timer open function loopback_parse_timer_id() uses snd_card_ref(), that can lock on mutex, also snd_timer_instance_new() uses non-atomic allocation, that can sleep. So, both functions can not be called from loopback_snd_timer_open() with cable->lock spinlock locked. Moreover, most part of loopback_snd_timer_open() function body works when the opposite stream of the same cable does not yet exist, and the current stream is not yet completely open and can't be running, so existing locking of loopback->cable_lock mutex is enough to protect from conflicts with simultaneous opening or closing. Locking of cable->lock spinlock is not needed in this case. Fixes: 26c53379f98d ("ALSA: aloop: Support selection of snd_timer instead of jiffies") Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191122175218.17187-1-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit a264abad51d8ecb7954a2f6d9f1885b38daffc74 Author: Chuck Lever Date: Wed Nov 20 16:25:52 2019 -0500 SUNRPC: Capture completion of all RPC tasks RPC tasks on the backchannel never invoke xprt_complete_rqst(), so there is no way to report their tk_status at completion. Also, any RPC task that exits via rpc_exit_task() before it is replied to will also disappear without a trace. Introduce a trace point that is symmetrical with rpc_task_begin that captures the termination status of each RPC task. Sample trace output for callback requests initiated on the server: kworker/u8:12-448 [003] 127.025240: rpc_task_end: task:50@3 flags=ASYNC|DYNAMIC|SOFT|SOFTCONN|SENT runstate=RUNNING|ACTIVE status=0 action=rpc_exit_task kworker/u8:12-448 [002] 127.567310: rpc_task_end: task:51@3 flags=ASYNC|DYNAMIC|SOFT|SOFTCONN|SENT runstate=RUNNING|ACTIVE status=0 action=rpc_exit_task kworker/u8:12-448 [001] 130.506817: rpc_task_end: task:52@3 flags=ASYNC|DYNAMIC|SOFT|SOFTCONN|SENT runstate=RUNNING|ACTIVE status=0 action=rpc_exit_task Odd, though, that I never see trace_rpc_task_complete, either in the forward or backchannel. Should it be removed? Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 3243e04ab1c06e7cb1402aff609c83de97956489 Author: Chen Wandun Date: Fri Nov 22 20:32:45 2019 +0800 net: dsa: ocelot: fix "should it be static?" warnings Fix following sparse warnings: drivers/net/dsa/ocelot/felix.c:351:6: warning: symbol 'felix_txtstamp' was not declared. Should it be static? Signed-off-by: Chen Wandun Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller commit fd1fef0c453df60921472008f436189ed351f9e2 Author: Andrea Mayer Date: Fri Nov 22 17:22:42 2019 +0100 seg6: allow local packet processing for SRv6 End.DT6 behavior End.DT6 behavior makes use of seg6_lookup_nexthop() function which drops all packets that are destined to be locally processed. However, DT* should be able to deliver decapsulated packets that are destined to local addresses. Function seg6_lookup_nexthop() is also used by DX6, so in order to maintain compatibility I created another routing helper function which is called seg6_lookup_any_nexthop(). This function is able to take into account both packets that have to be processed locally and the ones that are destined to be forwarded directly to another machine. Hence, seg6_lookup_any_nexthop() is used in DT6 rather than seg6_lookup_nexthop() to allow local delivery. Signed-off-by: Andrea Mayer Signed-off-by: David S. Miller commit d1746d1e80a86ca86b0c2680510898d411d2ef47 Author: Petr Machata Date: Fri Nov 22 15:47:21 2019 +0000 net: flow_dissector: Wrap unionized VLAN fields in a struct In commit a82055af5959 ("netfilter: nft_payload: add VLAN offload support"), VLAN fields in struct flow_dissector_key_vlan were unionized with the intention of introducing another field that covered the whole TCI header. However without a wrapping struct the subfields end up sharing the same bits. As a result, "tc filter add ... flower vlan_id 14" specifies not only vlan_id, but also vlan_priority. Fix by wrapping the individual VLAN fields in a struct. Fixes: a82055af5959 ("netfilter: nft_payload: add VLAN offload support") Signed-off-by: Petr Machata Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 4bbb02f1a5561b5b2056ca1ef56c1baa54aeb263 Merge: 41b416f1fc4c 7a89233ac504 Author: David S. Miller Date: Fri Nov 22 09:40:52 2019 -0800 Merge tag 'mac80211-next-for-net-next-2019-11-22' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== The interesting new thing here is AQL, the Airtime Queue Limit patchset from Kan Yan (Google) and Toke Høiland-Jørgensen (Redhat). The effect is intended to eventually be similar to BQL, but byte queue limits are not useful in wifi where the actual throughput can vary by around 4 orders of magnitude. There are more details in the patches themselves. ==================== Signed-off-by: David S. Miller commit 51e46c7a4007d271b2d42dbc2df953ab968577a7 Author: Kees Cook Date: Thu Nov 21 12:59:29 2019 -0800 docs, parallelism: Rearrange how jobserver reservations are made Rasmus correctly observed that the existing jobserver reservation only worked if no other build targets were specified. The correct approach is to hold the jobserver slots until sphinx has finished. To fix this, the following changes are made: - refactor (and rename) scripts/jobserver-exec to set an environment variable for the maximally reserved jobserver slots and exec a child, to release the slots on exit. - create Documentation/scripts/parallel-wrapper.sh which examines both $PARALLELISM and the detected "-jauto" logic from Documentation/Makefile to decide sphinx's final -j argument. - chain these together in Documentation/Makefile Suggested-by: Rasmus Villemoes Link: https://lore.kernel.org/lkml/eb25959a-9ec4-3530-2031-d9d716b40b20@rasmusvillemoes.dk Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20191121205929.40371-4-keescook@chromium.org Signed-off-by: Jonathan Corbet commit dffd011480d727a819c537edf3b90ef063731725 Author: Kees Cook Date: Thu Nov 21 12:59:28 2019 -0800 docs, parallelism: Do not leak blocking mode to other readers Setting non-blocking via a local copy of the jobserver file descriptor is safer than just assuming other reader processes with the same fd open are prepared for it to be non-blocking. Suggested-by: Rasmus Villemoes Link: https://lore.kernel.org/lkml/44c01043-ab24-b4de-6544-e8efd153e27a@rasmusvillemoes.dk Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20191121205929.40371-3-keescook@chromium.org Signed-off-by: Jonathan Corbet commit 4920323cffc0fe10ac107ab3e94d1bd218a678d9 Author: Kees Cook Date: Thu Nov 21 12:59:27 2019 -0800 docs, parallelism: Fix failure path and add comment Rasmus noted that the failure path didn't correctly exit. Fix this and add another comment about GNU Make's job server environment variable names over time. Reported-by: Rasmus Villemoes Link: https://lore.kernel.org/lkml/eb25959a-9ec4-3530-2031-d9d716b40b20@rasmusvillemoes.dk Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20191121205929.40371-2-keescook@chromium.org Signed-off-by: Jonathan Corbet commit 41b416f1fc4c7074e1801fc20f1c7fda94459487 Author: Tuong Lien Date: Thu Nov 21 15:34:58 2019 +0700 tipc: support in-order name publication events It is observed that TIPC service binding order will not be kept in the publication event report to user if the service is subscribed after the bindings. For example, services are bound by application in the following order: Server: bound port A to {18888,66,66} scope 2 Server: bound port A to {18888,33,33} scope 2 Now, if a client subscribes to the service range (e.g. {18888, 0-100}), it will get the 'TIPC_PUBLISHED' events in that binding order only when the subscription is started before the bindings. Otherwise, if started after the bindings, the events will arrive in the opposite order: Client: received event for published {18888,33,33} Client: received event for published {18888,66,66} For the latter case, it is clear that the bindings have existed in the name table already, so when reported, the events' order will follow the order of the rbtree binding nodes (- a node with lesser 'lower'/'upper' range value will be first). This is correct as we provide the tracking on a specific service status (available or not), not the relationship between multiple services. However, some users expect to see the same order of arriving events irrespective of when the subscription is issued. This turns out to be easy to fix. We now add functionality to ensure that publication events always are issued in the same temporal order as the corresponding bindings were performed. v2: replace the unnecessary macro - 'publication_after()' with inline function. v3: reuse 'time_after32()' instead of reinventing the same exact code. Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller commit ba5f6a8617f4cd8e77da0a190b9647065014eade Author: Hoang Le Date: Thu Nov 21 10:01:09 2019 +0700 tipc: update replicast capability for broadcast send link When setting up a cluster with non-replicast/replicast capability supported. This capability will be disabled for broadcast send link in order to be backwards compatible. However, when these non-support nodes left and be removed out the cluster. We don't update this capability on broadcast send link. Then, some of features that based on this capability will also disabling as unexpected. In this commit, we make sure the broadcast send link capabilities will be re-calculated as soon as a node removed/rejoined a cluster. Acked-by: Jon Maloy Signed-off-by: Hoang Le Signed-off-by: David S. Miller commit cd94eade0b2ab7673a97223d09406abf668b7f73 Author: Stephen Boyd Date: Wed Nov 13 16:19:25 2019 -0800 clk: ingenic: Allow drivers to be built with COMPILE_TEST We don't need the MIPS architecture or even a MIPS compiler to compile test these drivers. Let's add a COMPILE_TEST possibility on the menuconfig here so that we can build these drivers on more configurations. Cc: Paul Cercueil Signed-off-by: Stephen Boyd Link: https://lkml.kernel.org/r/20191114001925.159276-1-sboyd@kernel.org Reviewed-by: Paul Cercueil commit e3fedd570dedc0cde6240aff7a2bf62043b67ce9 Author: Masami Hiramatsu Date: Fri Nov 22 22:50:17 2019 +0900 Documentation: Remove bootmem_debug from kernel-parameters.txt Remove bootmem_debug kernel paramenter because it has been replaced by memblock=debug. Signed-off-by: Masami Hiramatsu Cc: Mike Rapoport Cc: Andrew Morton Cc: Jonathan Corbet Link: https://lore.kernel.org/r/157443061745.20995.9432492850513217966.stgit@devnote2 Signed-off-by: Jonathan Corbet commit 402613f3ef4bdac0406d710c7b9dabac76a43679 Author: Daniel W. S. Almeida Date: Fri Nov 22 01:18:06 2019 -0300 Documentation: security: core.rst: fix warnings Fix warnings due to missing markup, no change in content otherwise. Signed-off-by: Daniel W. S. Almeida Link: https://lore.kernel.org/r/20191122041806.68650-1-dwlsalmeida@gmail.com Signed-off-by: Jonathan Corbet commit 605b0f53a126467aa24424690500ba1e6d8fbba2 Author: SeongJae Park Date: Fri Nov 22 00:41:25 2019 +0100 Documentation/process/howto/kokr: Update for 4.x -> 5.x versioning Translate this commit to Korean: d2b008f134b7 ("Documentation/process/howto: Update for 4.x -> 5.x versioning") Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20191121234125.28032-8-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit bf23a48edbe331f834eb49d1bd6484ae98cf4dc7 Author: SeongJae Park Date: Fri Nov 22 00:41:24 2019 +0100 Documentation/translation: Use Korean for Korean translation title Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20191121234125.28032-7-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit a897b13d1b77c8bd532a239adfd48c286a1b39ab Author: SeongJae Park Date: Fri Nov 22 00:41:23 2019 +0100 docs/memory-barriers.txt: Remove remaining references to mmiowb() This commit removes references to sections erased by Commit 915530396c78 ("Documentation: Kill all references to mmiowb()"). Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20191121234125.28032-6-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit 3ef2f6aca51d305251fa90ff3bf9738f5af7f63e Author: SeongJae Park Date: Fri Nov 22 00:41:22 2019 +0100 docs/memory-barriers.txt/kokr: Update I/O section to be clearer about CPU vs thread Translate this commit to Korean: 9726840d9cf0 ("docs/memory-barriers.txt: Update I/O section to be clearer about CPU vs thread") Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20191121234125.28032-5-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit 18b68475c5ef2a7bde2e151729f0c10c17e05fa6 Author: SeongJae Park Date: Fri Nov 22 00:41:21 2019 +0100 docs/memory-barriers.txt/kokr: Fix style, spacing and grammar in I/O section Translate this commit to Korean: 0cde62a46e88 ("docs/memory-barriers.txt: Fix style, spacing and grammar in I/O section") Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20191121234125.28032-4-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit bf3b965bc45c87c0bb49d834d1bfff263e522d59 Author: SeongJae Park Date: Fri Nov 22 00:41:20 2019 +0100 Documentation/kokr: Kill all references to mmiowb() Translate this commit to Korean: 915530396c78 ("Documentation: Kill all references to mmiowb()") Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20191121234125.28032-3-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit 2ece3e00ac9581e67d3b7316a6bf36d64fed61df Author: SeongJae Park Date: Fri Nov 22 00:41:19 2019 +0100 docs/memory-barriers.txt/kokr: Rewrite "KERNEL I/O BARRIER EFFECTS" section Translate this commit to Korean: 4614bbdee357 ("docs/memory-barriers.txt: Rewrite "KERNEL I/O BARRIER EFFECTS" section") Signed-off-by: SeongJae Park Link: https://lore.kernel.org/r/20191121234125.28032-2-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit 8f39f22f73b3066623d488d3a54dd669575b56dc Author: Ulf Hansson Date: Thu Nov 21 11:07:26 2019 +0100 MAINTAINERS: Update section for Ux500 clock drivers There's no longer any need host a tree solely to serve changes for the Ux500 clock driver, thus drop this from the corresponding section and use the common clk tree instead. Moreover, let's also add the generic linux-clk mailing list and rename the section header. Cc: Linus Walleij Signed-off-by: Ulf Hansson Link: https://lkml.kernel.org/r/20191121100726.17725-1-ulf.hansson@linaro.org Reviewed-by: Linus Walleij Signed-off-by: Stephen Boyd commit 419e9c38aa075ed0cd3c13d47e15954b686bcdb6 Author: Jan Kara Date: Thu Nov 21 16:14:38 2019 -0800 iomap: Fix pipe page leakage during splicing When splicing using iomap_dio_rw() to a pipe, we may leak pipe pages because bio_iov_iter_get_pages() records that the pipe will have full extent worth of data however if file size is not block size aligned iomap_dio_rw() returns less than what bio_iov_iter_get_pages() set up and splice code gets confused leaking a pipe page with the file tail. Handle the situation similarly to the old direct IO implementation and revert iter to actually returned read amount which makes iter consistent with value returned from iomap_dio_rw() and thus the splice code is happy. Fixes: ff6a9292e6f6 ("iomap: implement direct I/O") CC: stable@vger.kernel.org Reported-by: syzbot+991400e8eba7e00a26e1@syzkaller.appspotmail.com Signed-off-by: Jan Kara Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit 6334b91e502ca1ec10157f2a3a2c74eea6b5e279 Author: Darrick J. Wong Date: Thu Nov 21 16:14:49 2019 -0800 iomap: trace iomap_appply results Add some tracepoints so that we can more easily debug what the filesystem is returning from ->iomap_begin. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit 9c0015ef092879f61129cdffbbe22fd30201d39b Author: Danit Goldberg Date: Wed Nov 6 15:18:12 2019 +0200 IB/mlx5: Implement callbacks for getting VFs GUID attributes Implement the IB defined callback mlx5_ib_get_vf_guid used to query FW for VFs attributes and return node and port GUIDs. Signed-off-by: Danit Goldberg Signed-off-by: Leon Romanovsky commit 2446887ed226786fcf9b3ece8d89e6b22551411b Author: Danit Goldberg Date: Wed Nov 6 14:57:00 2019 +0200 IB/ipoib: Add ndo operation for getting VFs GUID attributes Add ndo operation to the network driver that enables configuring ipoib_get_vf_guid operation. The operation allows to get a VF port and node GUIDs. Signed-off-by: Danit Goldberg Signed-off-by: Leon Romanovsky commit bfcb3c5d14854f001881dc3f5cc29bf186598d9f Author: Danit Goldberg Date: Wed Nov 6 15:08:32 2019 +0200 IB/core: Add interfaces to get VF node and port GUIDs Provide ability to get node and port GUIDs of VFs to be symmetrical to already existing set option. Signed-off-by: Danit Goldberg Signed-off-by: Leon Romanovsky commit 2911edb653b9c64e0aad461f308cae8ce030eb7b Author: Christoph Hellwig Date: Wed Nov 20 09:46:05 2019 -0800 xfs: remove the mappedbno argument to xfs_da_get_buf Use the xfs_da_get_buf_daddr function directly for the two callers that pass a mapped disk address, and then remove the mappedbno argument. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit cd2c9f1b544b8f5e1ca1874032fd669d74946a6d Author: Christoph Hellwig Date: Wed Nov 20 09:46:04 2019 -0800 xfs: remove the mappedbno argument to xfs_da_read_buf Move the code for reading an already mapped block into xfs_da3_node_read_mapped, which is the only caller ever passing a block number in the mappedbno argument and replace the mappedbno argument with the simple xfs_dabuf_get flags. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 02c57f0a8b07f5c8a393530ff29b2f6fbe17c825 Author: Christoph Hellwig Date: Wed Nov 20 09:46:04 2019 -0800 xfs: split xfs_da3_node_read Split xfs_da3_node_read into one variant that always looks up the daddr and doesn't accept holes, and one that already has a daddr at hand. This is in preparation of splitting up xfs_da_read_buf in a similar way. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit f3fcb314d16cdcffb6c521564b86b453869300da Author: Christoph Hellwig Date: Wed Nov 20 09:46:03 2019 -0800 xfs: remove the mappedbno argument to xfs_dir3_leafn_read This argument is always hard coded to -1, so remove it. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit c943c0b2e5c310e2f70e64055666732782f00254 Author: Christoph Hellwig Date: Wed Nov 20 09:46:03 2019 -0800 xfs: remove the mappedbno argument to xfs_dir3_leaf_read This argument is always hard coded to -1, so remove it. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit dfb8759408a9dd8a31a222ed0987bad3e83b50a0 Author: Christoph Hellwig Date: Wed Nov 20 09:46:02 2019 -0800 xfs: remove the mappedbno argument to xfs_attr3_leaf_read This argument is always hard coded to -1, so remove it. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 06566fda428e6420aa993e32845b165936fb50d6 Author: Christoph Hellwig Date: Wed Nov 20 09:46:02 2019 -0800 xfs: remove the mappedbno argument to xfs_da_reada_buf Replace the mappedbno argument with the simple flags for xfs_da_reada_buf and xfs_dir3_data_readahead. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 199e9ba4e4a9927f5addb644c1a1e1002e68cc30 Author: Christoph Hellwig Date: Wed Nov 20 10:18:50 2019 -0800 xfs: improve the xfs_dabuf_map calling conventions Use a flags argument with the XFS_DABUF_MAP_HOLE_OK flag to signal that a hole is okay and not corruption, and return 0 with *nmap set to 0 to signal that case in the return value instead of a nameless -1 return code. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 45feef8f50b94d56d6a433ad5baf5cdf58e3db98 Author: Christoph Hellwig Date: Wed Nov 20 10:18:44 2019 -0800 xfs: refactor xfs_dabuf_map Merge xfs_buf_map_from_irec and xfs_da_map_covers_blocks into a single loop in the caller. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit fa0d44ec7faab82da468aa7ab4f0c2614cadf7e7 Author: Christoph Hellwig Date: Wed Nov 20 09:46:00 2019 -0800 xfs: simplify mappedbno handling in xfs_da_{get,read}_buf Shortcut the creation of xfs_bmbt_irec and xfs_buf_map for the case where the callers passed an already mapped xfs_daddr_t. This is in preparation for splitting these cases out entirely later. Also reject the mappedbno case for xfs_da_reada_buf as no callers currently uses it and it will be removed soon. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 30aad41721e087babcf27c5192474724d555936c Author: Danit Goldberg Date: Wed Nov 6 15:30:07 2019 +0200 net/core: Add support for getting VF GUIDs Introduce a new ndo: ndo_get_vf_guid, to get from the net device the port and node GUID. New applications can choose to use this interface to show GUIDs with iproute2 with commands such as: - ip link show ib4 ib4: mtu 4092 qdisc noop state DOWN mode DEFAULT group default qlen 256 link/infiniband 00:00:0a:2d:fe:80:00:00:00:00:00:00:ec:0d:9a:03:00:44:36:8d brd 00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff vf 0 link/infiniband 00:00:0a:2d:fe:80:00:00:00:00:00:00:ec:0d:9a:03:00:44:36:8d brd 00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff, spoof checking off, NODE_GUID 22:44:33:00:33:11:00:33, PORT_GUID 10:21:33:12:00:11:22:10, link-state disable, trust off, query_rss off Signed-off-by: Danit Goldberg Acked-by: David Ahern Signed-off-by: Leon Romanovsky commit 15b9cbb2c5e1cf22c13fe38bf513bab821b47630 Author: Chris Wilson Date: Thu Nov 21 07:10:40 2019 +0000 Revert "drm/i915/gt: Wait for new requests in intel_gt_retire_requests()" From inside an active timeline in the execbuf ioctl, we may try to reclaim some space in the GGTT. We need GGTT space for all objects on !full-ppgtt platforms, and for context images everywhere. However, to free up space in the GGTT we may need to remove some pinned objects (e.g. context images) that require flushing the idle barriers to remove. For this we use the big hammer of intel_gt_wait_for_idle() However, commit 7936a22dd466 ("drm/i915/gt: Wait for new requests in intel_gt_retire_requests()") will continue spinning on the wait if a timeline is active but lacks requests, as is the case during execbuf reservation. Spinning forever is quite time consuming, so revert that commit and start again. In practice, the effect commit 7936a22dd466 was trying to achieve is accomplished by commit 1683d24c1470 ("drm/i915/gt: Move new timelines to the end of active_list"), so there is no immediate rush to replace the looping. Testcase: igt/gem_exec_reloc/basic-range Fixes: a46bfdc83fee ("drm/i915/gt: Wait for new requests in intel_gt_retire_requests()") References: 1683d24c1470 ("drm/i915/gt: Move new timelines to the end of active_list") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Joonas Lahtinen Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20191121071044.97798-1-chris@chris-wilson.co.uk (cherry picked from commit 689122dcc36e08f53732adf7ae0246f62eff3eb6) [Joonas: Corrected Fixes: tag ref to match drm-intel-next-fixes] Signed-off-by: Joonas Lahtinen commit 0e4a459f56c32d3e52ae69a4b447db2f48a65f44 Author: Kusanagi Kouichi Date: Wed Nov 20 19:43:50 2019 +0900 tracing: Remove unnecessary DEBUG_FS dependency Tracing replaced debugfs with tracefs. Signed-off-by: Kusanagi Kouichi Reviewed-by: Steven Rostedt (VMware) Link: https://lore.kernel.org/r/20191120104350753.EWCT.12796.ppp.dion.ne.jp@dmta0009.auone-net.jp Signed-off-by: Greg Kroah-Hartman commit 4584f084aa9d8033d5911935837dbee7b082d0e9 Author: Ian Rogers Date: Wed Nov 20 10:09:25 2019 -0800 perf parse: Fix potential memory leak when handling tracepoint errors An error may be in place when tracepoint_error is called, use parse_events__handle_error to avoid a memory leak and to capture the first and last error. Error detected by LLVM's libFuzzer using the following event: $ perf stat -e 'msr/event/,f:e' event syntax error: 'msr/event/,f:e' \___ can't access trace events Error: No permissions to read /sys/kernel/debug/tracing/events/f/e Hint: Try 'sudo mount -o remount,mode=755 /sys/kernel/debug/tracing/' Initial error: event syntax error: 'msr/event/,f:e' \___ no value assigned for term Run 'perf list' for a list of valid events Usage: perf stat [] [] -e, --event event selector. use 'perf list' to list available events Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jin Yao Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: clang-built-linux@googlegroups.com Link: http://lore.kernel.org/lkml/20191120180925.21787-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 358f98ee8a3578bbf464ac767b726c5de1ce0647 Author: Colin Ian King Date: Thu Nov 21 09:26:23 2019 +0000 perf probe: Fix spelling mistake "addrees" -> "address" There is a spelling mistake in a pr_warning message. Fix it. Signed-off-by: Colin King Acked-by: Masami Hiramatsu Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: kernel-janitors@vger.kernel.org Link: http://lore.kernel.org/lkml/20191121092623.374896-1-colin.king@canonical.com Signed-off-by: Arnaldo Carvalho de Melo commit 10992af6bf46a2048ad964985a5b77464e5563b1 Author: Hewenliang Date: Mon Nov 18 20:44:15 2019 -0500 libtraceevent: Fix memory leakage in copy_filter_type It is necessary to free the memory that we have allocated when error occurs. Fixes: ef3072cd1d5c ("tools lib traceevent: Get rid of die in add_filter_type()") Signed-off-by: Hewenliang Reviewed-by: Steven Rostedt (VMware) Cc: Tzvetomir Stoyanov Link: http://lore.kernel.org/lkml/20191119014415.57210-1-hewenliang4@huawei.com Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Arnaldo Carvalho de Melo commit 68401a1799fa14cb72c2a129bbefdacd44279772 Author: Sudip Mukherjee Date: Thu Nov 14 13:37:19 2019 +0000 libtraceevent: Fix header installation When we passed some location in DESTDIR, install_headers called do_install with DESTDIR as part of the second argument. But do_install is again using '$(DESTDIR_SQ)$2', so as a result the headers were installed in a location $DESTDIR/$DESTDIR. In my testing I passed DESTDIR=/home/sudip/test and the headers were installed in: /home/sudip/test/home/sudip/test/usr/include/traceevent. Lets remove DESTDIR from the second argument of do_install so that the headers are installed in the correct location. Signed-off-by: Sudipm Mukherjee Reviewed-by: Steven Rostedt (VMware) Cc: Sudipm Mukherjee Cc: linux-trace-devel@vger.kernel.org Link: http://lore.kernel.org/lkml/20191114133719.309-1-sudipm.mukherjee@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 32a1ece4bdbde24734ab16484bad7316f03fc42d Author: Adrian Hunter Date: Fri Nov 15 14:42:25 2019 +0200 perf intel-bts: Does not support AUX area sampling Add an error message because Intel BTS does not support AUX area sampling. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-16-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit dbd134322e74f19dbabf174b2cbf7fca9bbc34d3 Author: Adrian Hunter Date: Fri Nov 15 14:42:24 2019 +0200 perf intel-pt: Add support for decoding AUX area samples Add support for dumping, queuing and decoding AUX area samples. Decoding samples is the same as regular decoding, except in the case where there are no timestamps, in which case buffers are decoded immediately before the sample event. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-15-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit c4ab2f0f763da64d88cec6f20fd664f2347eca60 Author: Adrian Hunter Date: Fri Nov 15 14:42:23 2019 +0200 perf intel-pt: Add support for recording AUX area samples Set up the default number of mmap pages, default sample size and default psb_period for AUX area sampling. Add documentation also. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-14-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a1ac7de6902c1ea6def7a743f1d2e6ba429684b3 Author: Adrian Hunter Date: Fri Nov 15 14:42:22 2019 +0200 perf pmu: When using default config, record which bits of config were changed by the user Default config for a PMU is defined before selected events are parsed. That allows the user-entered config to override the default config. However that does not allow for changing the default config based on other options. For example, if the user chooses AUX area sampling mode, in the case of Intel PT, the psb_period needs to be small for sampling, so there is a need to set the default psb_period to 0 (2 KiB) in that case. However that should not override a value set by the user. To allow for that, when using default config, record which bits of config were changed by the user. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-13-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ac2f445fc8989e152dc35eb7af368fd34b92e48a Author: Adrian Hunter Date: Fri Nov 15 14:42:21 2019 +0200 perf auxtrace: Add support for queuing AUX area samples Add functions to queue AUX area samples in advance (auxtrace_queue_data()) or individually (auxtrace_queues__add_sample()) or find out what queue a sample belongs on (auxtrace_queues__sample_queue()). auxtrace_queue_data() can also queue snapshot data which keeps snapshots and samples ordered with respect to each other in case support for that is desired. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-12-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 103ed40e4bfa6986d80983b3e67be9d2f61fc9ee Author: Adrian Hunter Date: Fri Nov 15 14:42:20 2019 +0200 perf session: Add facility to peek at all events AUX area samples are not limited in how far back in time the sample could start. Consequently samples must be queued in advance to allow for time-ordered processing. To achieve that, add perf_session__peek_events() that walks and peeks at all the events. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-11-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit b04b8dd1e4265525dbd74647f747e63e85540189 Author: Adrian Hunter Date: Fri Nov 15 14:42:19 2019 +0200 perf auxtrace: Add support for dumping AUX area samples Add support for dumping AUX area samples i.e. via the perf script/report -D (--dump-raw-trace) option. Committer notes: Add __maybe_unused to the two args for auxtrace__dump_auxtrace_sample() for when we don't HAVE_AUXTRACE_SUPPORT. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-10-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ba2675bf15fc3ec1d54b9bf938cf5b28392f79fb Author: Adrian Hunter Date: Fri Nov 15 14:42:18 2019 +0200 perf inject: Cut AUX area samples After decoding AUX area samples, the AUX area data is no longer needed (having been replaced by synthesized events) so cut it out. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-9-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit eb7a52d46c6ac95df563f867d526b3d46616b10b Author: Adrian Hunter Date: Fri Nov 15 14:42:17 2019 +0200 perf record: Add aux-sample-size config term To allow individual events to be selected for AUX area sampling, add aux-sample-size config term. attr.aux_sample_size is updated by auxtrace_parse_sample_options() so that the existing validation will see the value. Any event that has a non-zero aux_sample_size will cause AUX area sampling to be configured, irrespective of the --aux-sample option. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-8-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit c0a6de06c446f8d173ef53fba361acedd5880b20 Author: Adrian Hunter Date: Fri Nov 15 14:42:16 2019 +0200 perf record: Add support for AUX area sampling Add a 'perf record' option '--aux-sample' to request AUX area sampling. AUX area sampling uses an overwriting buffer much like snapshot mode, so adjust the AUX buffer mmapping accordingly. To make it easy to queue samples for decoding, synthesize an ID index. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-7-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit f0bb7ee8530a07d3c23bd2e06984796e66cfbcf1 Author: Adrian Hunter Date: Fri Nov 15 14:42:15 2019 +0200 perf auxtrace: Add support for AUX area sample recording Add support for parsing and validating AUX area sample options. At present, the only option is the sample size, but it is also necessary to ensure that events are in a group with an AUX area event as the leader. Committer note: Add missing 'static inline' in front of auxtrace_parse_sample_options() for when we don't HAVE_AUXTRACE_SUPPORT. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-6-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit f306de275b7c18da9ab060acb3dfa91c09e9ae89 Author: Adrian Hunter Date: Fri Nov 15 14:42:14 2019 +0200 perf auxtrace: Move perf_evsel__find_pmu() Move perf_evsel__find_pmu() so it can be used without forward declaration. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-5-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 41c4616bb81ff9b2efd981453f2c5d8f57d0c0b8 Author: Linus Walleij Date: Fri Nov 22 14:26:15 2019 +0100 gpio: Add TODO item for regmap helper Add a TODO item for a generic MMIO regmap helper. Suggested-by: Bartosz Golaszewski Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 9bca1a4ef5034f0a82861ac0375eb0272c5ce04e Author: Adrian Hunter Date: Fri Nov 15 14:42:13 2019 +0200 perf record: Add a function to test for kernel support for AUX area sampling Architectures are expected to know if AUX area sampling is supported by the hardware. Add a function perf_can_aux_sample() which will determine whether the kernel supports it. Committer notes: I reported that this message was taking place on a kernel without the required bits: # perf record --aux-sample -e '{intel_pt//u,branch-misses:u}' Error: The sys_perf_event_open() syscall returned with 7 (Argument list too long) for event (branch-misses:u). /bin/dmesg | grep -i perf may provide additional information. Adrian sent a patch addressing it, with this explanation: ---- perf_can_aux_sample_size() always returned true because it did not pass the attribute size to sys_perf_event_open, nor correctly check the return value and errno. ---- After applying it I get, later in the series, when --aux-sample is added: # perf record --aux-sample -e '{intel_pt//u,branch-misses:u}' AUX area sampling is not supported by kernel Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-4-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 1e5ddb6ba73894e6186e6379dde870979852af6d Author: Takashi Iwai Date: Thu Nov 21 20:07:09 2019 +0100 ASoC: component: Add sync_stop PCM ops Add the support of the new PCM sync_stop ops in ASoC component. It's optional and can be NULL unless you need the sync operation. Acked-by: Mark Brown Link: https://lore.kernel.org/r/20191121190709.29121-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit 3b1c952c951d5ae91821386d692bc291e87a17b1 Author: Takashi Iwai Date: Thu Nov 21 20:07:08 2019 +0100 ASoC: pcm: Make ioctl ops optional Now PCM core accepts the NULL ioctl ops as default, and passing a proper ioctl ops is no longer mandatory. Adjust soc_new_pcm() to allow also the NULL for component ioctl ops, too. Acked-by: Mark Brown Link: https://lore.kernel.org/r/20191121190709.29121-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 10a9594563415855bd99678ea4f91dea792e5499 Author: Takashi Iwai Date: Fri Nov 22 14:26:24 2019 +0100 ALSA: hda/hdmi - Clear codec->relaxed_resume flag at unbinding The HDMI codec may leave codec->relaxed_resume flag set even after unbinding. Clear it unconditionally. It's very unlikely that this actually matters in the real use case, so just a fix for consistency. Fixes: ade49db337a9 ("ALSA: hda/hdmi - Allow audio component for AMD/ATI and Nvidia HDMI") Link: https://lore.kernel.org/r/20191122132624.5482-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 5a858e79c911330678b5a9be91a24830e94a0dc9 Author: Takashi Iwai Date: Fri Nov 22 14:20:00 2019 +0100 ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs The old Nvidia chips have multiple HD-audio codecs on the same HD-audio controller, and this doesn't work as expected with the current audio component binding that is implemented under the one-codec-per- controller assumption; at the probe time, the driver leads to several kernel WARNING messages. For the proper support, we may change the pin2port and port2pin to traverse the codec list per the given pin number, but this needs more development and testing. As a quick workaround, instead, this patch drops the binding in the audio side for these legacy chips since the audio component support in nouveau graphics driver is still not merged (hence it's basically unused). BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205625 Fixes: ade49db337a9 ("ALSA: hda/hdmi - Allow audio component for AMD/ATI and Nvidia HDMI") Link: https://lore.kernel.org/r/20191122132000.4460-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit d60229d84846a8399257006af9c5444599f64361 Author: Colin Ian King Date: Fri Nov 22 13:13:54 2019 +0000 ALSA: cs4236: fix error return comparison of an unsigned integer The return from pnp_irq is an unsigned integer type resource_size_t and hence the error check for a positive non-error code is always going to be true. A check for a non-failure return from pnp_irq should in fact be for (resource_size_t)-1 rather than >= 0. Addresses-Coverity: ("Unsigned compared against 0") Fixes: a9824c868a2c ("[ALSA] Add CS4232 PnP BIOS support") Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20191122131354.58042-1-colin.king@canonical.com Signed-off-by: Takashi Iwai commit 9435f2bb66874a0c4dd25e7c978957a7ca2c93b1 Author: Takashi Iwai Date: Fri Nov 22 12:28:40 2019 +0100 ALSA: usb-audio: Fix NULL dereference at parsing BADD snd_usb_mixer_controls_badd() that parses UAC3 BADD profiles misses a NULL check for the given interfaces. When a malformed USB descriptor is passed, this may lead to an Oops, as spotted by syzkaller. Skip the iteration if the interface doesn't exist for avoiding the crash. Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support") Reported-by: syzbot+a36ab65c6653d7ccdd62@syzkaller.appspotmail.com Suggested-by: Dan Carpenter Cc: Link: https://lore.kernel.org/r/20191122112840.24797-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 4e29b70d54376f795285bc337c9ebf7439e374c6 Author: Daniel W. S. Almeida Date: Fri Nov 22 00:47:02 2019 -0300 Documentation: gpio: driver.rst: Fix warnings Fix warnings due to incorrect rst markup. Also improved the presentation a little without changing the underlying content. Signed-off-by: Daniel W. S. Almeida Link: https://lore.kernel.org/r/20191122034702.58563-1-dwlsalmeida@gmail.com Signed-off-by: Linus Walleij commit 808b9931d5a06760315c0dd02519da78cb944d8e Author: Geert Uytterhoeven Date: Wed Nov 20 16:45:21 2019 +0100 gpio: of: Fix bogus reference to gpiod_get_count() The recommended function is called gpiod_count(), not gpiod_get_count(). Fixes: f626d6dfb7098525 ("gpio: of: Break out OF-only code") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20191120154521.16273-1-geert+renesas@glider.be Signed-off-by: Linus Walleij commit 51158416c24d8aca224ac80dc0ee82d90438b8c8 Author: Geert Uytterhoeven Date: Wed Nov 20 15:37:45 2019 +0100 gpiolib: Grammar s/manager/managed/ Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20191120143745.1254-1-geert+renesas@glider.be Signed-off-by: Linus Walleij commit 7a89233ac50468a3a9636803a85d06c8f907f8ee Author: Toke Høiland-Jørgensen Date: Mon Nov 18 22:06:10 2019 -0800 mac80211: Use Airtime-based Queue Limits (AQL) on packet dequeue The previous commit added the ability to throttle stations when they queue too much airtime in the hardware. This commit enables the functionality by calculating the expected airtime usage of each packet that is dequeued from the TXQs in mac80211, and accounting that as pending airtime. The estimated airtime for each skb is stored in the tx_info, so we can subtract the same amount from the running total when the skb is freed or recycled. The throttling mechanism relies on this accounting to be accurate (i.e., that we are not freeing skbs without subtracting any airtime they were accounted for), so we put the subtraction into ieee80211_report_used_skb(). As an optimisation, we also subtract the airtime on regular TX completion, zeroing out the value stored in the packet afterwards, to avoid having to do an expensive lookup of the station from the packet data on every packet. This patch does *not* include any mechanism to wake a throttled TXQ again, on the assumption that this will happen anyway as a side effect of whatever freed the skb (most commonly a TX completion). Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20191119060610.76681-5-kyan@google.com Signed-off-by: Johannes Berg commit 3ace10f5b5ad94bdbd4b419dc9da2217d57720a9 Author: Kan Yan Date: Mon Nov 18 22:06:09 2019 -0800 mac80211: Implement Airtime-based Queue Limit (AQL) In order for the Fq_CoDel algorithm integrated in mac80211 layer to operate effectively to control excessive queueing latency, the CoDel algorithm requires an accurate measure of how long packets stays in the queue, AKA sojourn time. The sojourn time measured at the mac80211 layer doesn't include queueing latency in the lower layer (firmware/hardware) and CoDel expects lower layer to have a short queue. However, most 802.11ac chipsets offload tasks such TX aggregation to firmware or hardware, thus have a deep lower layer queue. Without a mechanism to control the lower layer queue size, packets only stay in mac80211 layer transiently before being sent to firmware queue. As a result, the sojourn time measured by CoDel in the mac80211 layer is almost always lower than the CoDel latency target, hence CoDel does little to control the latency, even when the lower layer queue causes excessive latency. The Byte Queue Limits (BQL) mechanism is commonly used to address the similar issue with wired network interface. However, this method cannot be applied directly to the wireless network interface. "Bytes" is not a suitable measure of queue depth in the wireless network, as the data rate can vary dramatically from station to station in the same network, from a few Mbps to over Gbps. This patch implements an Airtime-based Queue Limit (AQL) to make CoDel work effectively with wireless drivers that utilized firmware/hardware offloading. AQL allows each txq to release just enough packets to the lower layer to form 1-2 large aggregations to keep hardware fully utilized and retains the rest of the frames in mac80211 layer to be controlled by the CoDel algorithm. Signed-off-by: Kan Yan [ Toke: Keep API to set pending airtime internal, fix nits in commit msg ] Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20191119060610.76681-4-kyan@google.com Signed-off-by: Johannes Berg commit db3e1c40cf2f973fbdd52ae0b59a9472b1c04f4a Author: Toke Høiland-Jørgensen Date: Mon Nov 18 22:06:08 2019 -0800 mac80211: Import airtime calculation code from mt76 Felix recently added code to calculate airtime of packets to the mt76 driver. Import this into mac80211 so we can use it for airtime queue limit calculations. The airtime.c file is copied verbatim from the mt76 driver, and adjusted to be usable in mac80211. This involves: - Switching to mac80211 data structures. - Adding support for 160 MHz channels and HE mode. - Moving the symbol and duration calculations around a bit to avoid rounding with the higher rates and longer symbol times used for HE rates. The per-rate TX rate calculation is also split out to its own function so it can be used directly for the AQL calculations later. Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20191119060610.76681-3-kyan@google.com [fix HE_GROUP_IDX() to use 3 * bw, since there are 3 _gi values] Signed-off-by: Johannes Berg commit bc71d8b580ba81b55b6e15b1c0320632515b4bac Author: Taehee Yoo Date: Thu Nov 21 12:26:45 2019 +0000 virt_wifi: fix use-after-free in virt_wifi_newlink() When virt_wifi interface is created, virt_wifi_newlink() is called and it calls register_netdevice(). if register_netdevice() fails, it internally would call ->priv_destructor(), which is virt_wifi_net_device_destructor() and it frees netdev. but virt_wifi_newlink() still use netdev. So, use-after-free would occur in virt_wifi_newlink(). Test commands: ip link add dummy0 type dummy modprobe bonding ip link add bonding_masters link dummy0 type virt_wifi Splat looks like: [ 202.220554] BUG: KASAN: use-after-free in virt_wifi_newlink+0x88b/0x9a0 [virt_wifi] [ 202.221659] Read of size 8 at addr ffff888061629cb8 by task ip/852 [ 202.222896] CPU: 1 PID: 852 Comm: ip Not tainted 5.4.0-rc5 #3 [ 202.223765] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 202.225073] Call Trace: [ 202.225532] dump_stack+0x7c/0xbb [ 202.226869] print_address_description.constprop.5+0x1be/0x360 [ 202.229362] __kasan_report+0x12a/0x16f [ 202.230714] kasan_report+0xe/0x20 [ 202.232595] virt_wifi_newlink+0x88b/0x9a0 [virt_wifi] [ 202.233370] __rtnl_newlink+0xb9f/0x11b0 [ 202.244909] rtnl_newlink+0x65/0x90 [ ... ] Cc: stable@vger.kernel.org Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device") Signed-off-by: Taehee Yoo Link: https://lore.kernel.org/r/20191121122645.9355-1-ap420073@gmail.com [trim stack dump a bit] Signed-off-by: Johannes Berg commit 08a5bdde3812993cb8eb7aa9124703df0de28e4b Author: Thomas Pedersen Date: Mon Nov 18 21:35:38 2019 -0800 mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED Commit 7b6ddeaf27ec ("mac80211: use QoS NDP for AP probing") let STAs send QoS Null frames as PS triggers if the AP was a QoS STA. However, the mac80211 PS stack relies on an interface flag IEEE80211_STA_NULLFUNC_ACKED for determining trigger frame ACK, which was not being set for acked non-QoS Null frames. The effect is an inability to trigger hardware sleep via IEEE80211_CONF_PS since the QoS Null frame was seemingly never acked. This bug only applies to drivers which set both IEEE80211_HW_REPORTS_TX_ACK_STATUS and IEEE80211_HW_PS_NULLFUNC_STACK. Detect the acked QoS Null frame to restore STA power save. Fixes: 7b6ddeaf27ec ("mac80211: use QoS NDP for AP probing") Signed-off-by: Thomas Pedersen Link: https://lore.kernel.org/r/20191119053538.25979-4-thomas@adapt-ip.com Signed-off-by: Johannes Berg commit c90142a518d3744c84beb51cab0cda8956bb82a4 Author: Thomas Pedersen Date: Mon Nov 18 21:35:37 2019 -0800 mac80211: expose HW conf flags through debugfs This is useful during testing to eg. check the currently configured HW power save state. Signed-off-by: Thomas Pedersen Link: https://lore.kernel.org/r/20191119053538.25979-3-thomas@adapt-ip.com Signed-off-by: Johannes Berg commit a4f95f31a9f38d9bb1fd313fcc2d0c0d48116ee3 Author: Andre Heider Date: Fri Nov 22 13:31:42 2019 +0100 Bluetooth: btbcm: Use the BDADDR_PROPERTY quirk Some devices ship with the controller default address, like the Orange Pi 3 (BCM4345C5). Allow the bootloader to set a valid address through the device tree. Signed-off-by: Andre Heider Signed-off-by: Marcel Holtmann commit 724c15a43e2c7ac26e2d07abef99191162498fa9 Author: Vivek Goyal Date: Wed Oct 30 11:07:19 2019 -0400 virtiofs: Use completions while waiting for queue to be drained While we wait for queue to finish draining, use completions instead of usleep_range(). This is better way of waiting for event. Signed-off-by: Vivek Goyal Reviewed-by: Stefan Hajnoczi Signed-off-by: Miklos Szeredi commit 1efcf39eb627573f8d543ea396cf36b0651b1e56 Author: Vivek Goyal Date: Wed Oct 30 11:07:18 2019 -0400 virtiofs: Do not send forget request "struct list_head" element We are sending whole of virtio_fs_forget struct to the other end over virtqueue. Other end does not need to see elements like "struct list". That's internal detail of guest kernel. Fix it. Signed-off-by: Vivek Goyal Reviewed-by: Stefan Hajnoczi Signed-off-by: Miklos Szeredi commit 58ada94f95f71d4f73197ab0e9603dbba6e47fe3 Author: Vivek Goyal Date: Wed Oct 30 11:07:17 2019 -0400 virtiofs: Use a common function to send forget Currently we are duplicating logic to send forgets at two places. Consolidate the code by calling one helper function. This also uses virtqueue_add_outbuf() instead of virtqueue_add_sgs(). Former is simpler to call. Signed-off-by: Vivek Goyal Reviewed-by: Stefan Hajnoczi Signed-off-by: Miklos Szeredi commit 5072f73cb6ee0867d2d11996a244eba48bfda931 Author: Toke Høiland-Jørgensen Date: Tue Nov 12 14:08:35 2019 +0100 mac80211: Add new sta_info getter by sta/vif addrs In ieee80211_tx_status() we don't have an sdata struct when looking up the destination sta. Instead, we just do a lookup by the vif addr that is the source of the packet being completed. Factor this out into a new sta_info getter helper, since we need to use it for accounting AQL as well. Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20191112130835.382062-1-toke@redhat.com [remove internal rcu_read_lock(), document instead] Signed-off-by: Johannes Berg commit b226a826d83d66806fae20fc3518dace8b86bacb Author: Johannes Berg Date: Fri Nov 22 12:42:42 2019 +0100 mac80211: add a comment about monitor-to-dev injection Add a note with a use-case for the monitor-to-dev injection mechanism in mac80211, reported by Ben Greear. Change-Id: I6456997ef9bc40b24ede860b6ef2fed5af49cf44 Signed-off-by: Johannes Berg commit 4ee812f6143d78d8ba1399671d78c8d78bf2817c Author: Michael Ellerman Date: Wed Nov 20 22:27:38 2019 +1100 crypto: vmx - Avoid weird build failures In the vmx crypto Makefile we assign to a variable called TARGET and pass that to the aesp8-ppc.pl and ghashp8-ppc.pl scripts. The variable is meant to describe what flavour of powerpc we're building for, eg. either 32 or 64-bit, and big or little endian. Unfortunately TARGET is a fairly common name for a make variable, and if it happens that TARGET is specified as a command line parameter to make, the value specified on the command line will override our value. In particular this can happen if the kernel Makefile is driven by an external Makefile that uses TARGET for something. This leads to weird build failures, eg: nonsense at /build/linux/drivers/crypto/vmx/ghashp8-ppc.pl line 45. /linux/drivers/crypto/vmx/Makefile:20: recipe for target 'drivers/crypto/vmx/ghashp8-ppc.S' failed Which shows that we passed an empty value for $(TARGET) to the perl script, confirmed with make V=1: perl /linux/drivers/crypto/vmx/ghashp8-ppc.pl > drivers/crypto/vmx/ghashp8-ppc.S We can avoid this confusion by using override, to tell make that we don't want anything to override our variable, even a value specified on the command line. We can also use a less common name, given the script calls it "flavour", let's use that. Signed-off-by: Michael Ellerman Signed-off-by: Herbert Xu commit 413808b71e6204b0cc1eeaa77960f7c3cd381d33 Author: Eric Biggers Date: Sun Nov 17 23:22:16 2019 -0800 crypto: lib/chacha20poly1305 - use chacha20_crypt() Use chacha20_crypt() instead of chacha_crypt(), since it's not really appropriate for users of the ChaCha library API to be passing the number of rounds as an argument. Signed-off-by: Eric Biggers Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit b62755aed3a3f5ca9edd2718339ccea3b6bbbe57 Author: Eric Biggers Date: Sun Nov 17 23:21:58 2019 -0800 crypto: x86/chacha - only unregister algorithms if registered It's not valid to call crypto_unregister_skciphers() without a prior call to crypto_register_skciphers(). Fixes: 84e03fa39fbe ("crypto: x86/chacha - expose SIMD ChaCha routine as library function") Signed-off-by: Eric Biggers Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 2043323a799a660bc84bbee404cf7a2617ec6157 Author: Eric Biggers Date: Sun Nov 17 23:21:29 2019 -0800 crypto: chacha_generic - remove unnecessary setkey() functions Use chacha20_setkey() and chacha12_setkey() from instead of defining them again in chacha_generic.c. Signed-off-by: Eric Biggers Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 3d04158814e7a808c38124c87502b430b916dfcb Author: Corentin Labbe Date: Sun Nov 17 16:09:53 2019 +0000 crypto: amlogic - enable working on big endian kernel On big endian kernel, the GXL crypto driver does not works. This patch do the necessary modification to permit it to work on BE kernel (removing bitfield and adds some cpu_to_le32). Fixes: 48fe583fe541 ("crypto: amlogic - Add crypto accelerator for amlogic GXL") Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu commit 93c7f4d357de68f1e3a998b2fc775466d75c4c07 Author: Corentin Labbe Date: Sun Nov 17 17:07:45 2019 +0100 crypto: sun8i-ce - enable working on big endian On big endian kernel, the sun8i-ce crypto driver does not works. This patch do the necessary modification to permit it to work on BE kernel (setting descriptor entries as __le32 and adding some cpu_to_le32) Fixes: 06f751b61329 ("crypto: allwinner - Add sun8i-ce Crypto Engine") Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu commit 660eda8d50f866e8fc38f3edcd4192c2626b44ea Author: Eric Biggers Date: Sat Nov 16 18:53:24 2019 -0800 crypto: mips/chacha - select CRYPTO_SKCIPHER, not CRYPTO_BLKCIPHER Another instance of CRYPTO_BLKCIPHER made it in just after it was renamed to CRYPTO_SKCIPHER. Fix it. Signed-off-by: Eric Biggers Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 90c4b29eb1e555fee66f8329a18cb8a070090ad6 Author: Herbert Xu Date: Sun Nov 17 08:43:44 2019 +0800 hwrng: ks-sa - Enable COMPILE_TEST This patch enables COMPILE_TEST on the ks-sa-rng driver. Signed-off-by: Herbert Xu Reviewed-by: Alexander Sverdlin Signed-off-by: Herbert Xu commit e18036da5c23530994faf7243b592e581f1efed2 Author: Chen Wandun Date: Sat Nov 16 14:51:00 2019 +0800 crypto: essiv - remove redundant null pointer check before kfree kfree has taken null pointer check into account. so it is safe to remove the unnecessary check. Signed-off-by: Chen Wandun Signed-off-by: Herbert Xu commit 57d8154f15e89f53dfb412f4ed32ebe3c3d755a0 Author: Tudor Ambarus Date: Fri Nov 15 13:49:09 2019 +0000 crypto: atmel-aes - Change data type for "lastc" buffer In case of in-place decryption, the "lastc" buffer is used to copy the last ciphertext block before the decryption of the message. It is later used to update the req->iv of the skcipher_request. "lastc" variable is not used to interact with the hardware, there is no restriction to be of type "u32". Change the type of "lastc" to "u8". Signed-off-by: Tudor Ambarus Signed-off-by: Herbert Xu commit 61b0dd664fa1873501297efbb12e5684aff074d4 Author: Tudor Ambarus Date: Fri Nov 15 13:49:06 2019 +0000 crypto: atmel-tdes - Set the IV after {en,de}crypt The req->iv of the skcipher_request is expected to contain the last ciphertext block when the {en,de}crypt operation is done. In case of in-place decryption, copy the ciphertext in an intermediate buffer before decryption. This fixes the following tcrypt tests: alg: skcipher: atmel-cbc-des encryption test failed (wrong output IV) on test vector 0, cfg="in-place" 00000000: fe dc ba 98 76 54 32 10 alg: skcipher: atmel-cbc-tdes encryption test failed (wrong output IV) on test vector 0, cfg="in-place" 00000000: 7d 33 88 93 0f 93 b2 42 Signed-off-by: Tudor Ambarus Signed-off-by: Herbert Xu commit d1d787bcebfe122a5bd443ae565696661e2e9656 Author: Corentin Labbe Date: Thu Nov 14 13:58:49 2019 +0100 crypto: sun4i-ss - fix big endian issues When testing BigEndian kernel, the sun4i-ss was failling all crypto tests. This patch fix endian issues with it. Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator") Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu commit 2edf86414b66b2cd921547000208b383972cd11a Author: Corentin Labbe Date: Thu Nov 14 11:58:52 2019 +0100 crypto: sun4i-ss - hide the Invalid keylen message Drop the "Invalid keylen" message to debug level, it adds no value, and when CRYPTO_EXTRA_TEST is enabled, it floods the console. Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu commit 626abd3125e02d75e26f3cd2e2aa4a6fb74507b5 Author: Corentin Labbe Date: Thu Nov 14 11:58:13 2019 +0100 crypto: sun4i-ss - use crypto_ahash_digestsize The size of the digest is different between MD5 and SHA1 so instead of using the higher value (5 words), let's use crypto_ahash_digestsize(). Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu commit 7ca2a71d177f51d1d0d339657d3b0cc988d1518e Author: Corentin Labbe Date: Thu Nov 14 11:49:07 2019 +0100 crypto: sun4i-ss - remove dependency on not 64BIT The driver now compile without warnings on 64bits, we can remove the !64BIT condition. Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu commit a7126603d46fe8f01aeedf589e071c6aaa6c6c39 Author: Corentin Labbe Date: Thu Nov 14 11:49:06 2019 +0100 crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c If you try to compile this driver on a 64-bit platform then you will get warnings because it mixes size_t with unsigned int which only works on 32-bit. This patch fixes all of the warnings on sun4i-ss-hash.c. Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu commit a30583fcfb86ebf332573598359c189a4e02c2da Author: Zaibo Xu Date: Wed Nov 13 19:11:08 2019 +0800 MAINTAINERS: Add maintainer for HiSilicon SEC V2 driver Here adds maintainer information for security engine driver. Signed-off-by: Zaibo Xu Signed-off-by: Herbert Xu commit 1e9bc276f8f19ea65b617d7c9458ead14da4ef60 Author: Zaibo Xu Date: Wed Nov 13 19:11:07 2019 +0800 crypto: hisilicon - add DebugFS for HiSilicon SEC The HiSilicon SEC engine driver uses DebugFS to provide main debug information for user space. Signed-off-by: Zaibo Xu Signed-off-by: Longfang Liu Signed-off-by: Herbert Xu commit cbfe56e6938b2f7ca5e78b04417ee07f7c8d87fb Author: Longfang Liu Date: Wed Nov 13 19:11:06 2019 +0800 Documentation: add DebugFS doc for HiSilicon SEC This Documentation is for HiSilicon SEC DebugFS. Signed-off-by: Longfang Liu Signed-off-by: Kai Ye Reviewed-by: Zaibo Xu Signed-off-by: Herbert Xu commit 73bcb049a77ba75b694cb4142b3a3ef09584a77c Author: Zaibo Xu Date: Wed Nov 13 19:11:05 2019 +0800 crypto: hisilicon - add SRIOV for HiSilicon SEC HiSilicon SEC engine supports PCI SRIOV. This patch enable this feature. User can enable VFs and pass through them to VM, same SEC driver can work in VM to provide skcipher algorithms. Signed-off-by: Zaibo Xu Signed-off-by: Longfang Liu Signed-off-by: Herbert Xu commit 416d82204df44ef727de6eafafeaa4d12fdc78dc Author: Zaibo Xu Date: Wed Nov 13 19:11:04 2019 +0800 crypto: hisilicon - add HiSilicon SEC V2 driver SEC driver provides PCIe hardware device initiation with AES, SM4, and 3DES skcipher algorithms registered to Crypto. It uses Hisilicon QM as interface to CPU. Signed-off-by: Zaibo Xu Signed-off-by: Longfang Liu Signed-off-by: Herbert Xu commit aee1f9f3c30e1e20e7f74729ced61eac7d74ca68 Author: YueHaibing Date: Wed Nov 13 17:55:50 2019 +0800 crypto: atmel - Fix build error of CRYPTO_AUTHENC If CRYPTO_DEV_ATMEL_AUTHENC is m, CRYPTO_DEV_ATMEL_SHA is m, but CRYPTO_DEV_ATMEL_AES is y, building will fail: drivers/crypto/atmel-aes.o: In function `atmel_aes_authenc_init_tfm': atmel-aes.c:(.text+0x670): undefined reference to `atmel_sha_authenc_get_reqsize' atmel-aes.c:(.text+0x67a): undefined reference to `atmel_sha_authenc_spawn' drivers/crypto/atmel-aes.o: In function `atmel_aes_authenc_setkey': atmel-aes.c:(.text+0x7e5): undefined reference to `atmel_sha_authenc_setkey' Make CRYPTO_DEV_ATMEL_AUTHENC depend on CRYPTO_DEV_ATMEL_AES, and select CRYPTO_DEV_ATMEL_SHA and CRYPTO_AUTHENC for it under there. Reported-by: Hulk Robot Suggested-by: Herbert Xu Fixes: 89a82ef87e01 ("crypto: atmel-authenc - add support to...") Signed-off-by: YueHaibing Reviewed-by: Tudor Ambarus Signed-off-by: Herbert Xu commit 3e8b4ccdc4ec73a721cb69cff643670ac1eba995 Author: Peter Ujfalusi Date: Wed Nov 13 11:09:47 2019 +0200 crypto: qce/dma - Use dma_request_chan() directly for channel request dma_request_slave_channel_reason() is: #define dma_request_slave_channel_reason(dev, name) \ dma_request_chan(dev, name) Signed-off-by: Peter Ujfalusi Reviewed-by: Vinod Koul Signed-off-by: Herbert Xu commit ec310caf13b5505c268cfa526b7b28152a879d1e Author: Brijesh Singh Date: Tue Nov 12 13:58:34 2019 -0600 crypto: ccp - add SEV command privilege separation Currently, there is no privilege separation of the SEV command; you can run them all or none of them. This is less than ideal because it means that a compromise of the code which launches VMs could make permanent change to the SEV certifcate chain which will affect others. These commands are required to attest the VM environment: - SEV_PDH_CERT_EXPORT - SEV_PLATFORM_STATUS - SEV_GET_{ID,ID2} These commands manage the SEV certificate chain: - SEV_PEK_CERR_IMPORT - SEV_FACTORY_RESET - SEV_PEK_GEN - SEV_PEK_CSR - SEV_PDH_GEN Lets add the CAP_SYS_ADMIN check for the group of the commands which alters the SEV certificate chain to provide some level of privilege separation. Cc: Herbert Xu Cc: Gary Hook Cc: Erdem Aktas Cc: Tom Lendacky Tested-by: David Rientjes Co-developed-by: David Rientjes Signed-off-by: David Rientjes Signed-off-by: Brijesh Singh Signed-off-by: Herbert Xu commit c433a1a8572eceb7c45dd85d93fec6946b71bb72 Author: David Sterba Date: Tue Nov 12 11:20:30 2019 +0100 crypto: blake2b - rename tfm context and _setkey callback The TFM context can be renamed to a more appropriate name and the local varaibles as well, using 'tctx' which seems to be more common than 'mctx'. The _setkey callback was the last one without the blake2b_ prefix, rename that too. Signed-off-by: David Sterba Signed-off-by: Herbert Xu commit 0b4b5f10ac1ffb7f51db1832d189c33955c0d4c1 Author: David Sterba Date: Tue Nov 12 11:20:29 2019 +0100 crypto: blake2b - merge _update to api callback Now that there's only one call to blake2b_update, we can merge it to the callback and simplify. The empty input check is split and the rest of code un-indented. Signed-off-by: David Sterba Signed-off-by: Herbert Xu commit a2e4bdce0f6e69c6cf9e460c4fe158bcc0db351f Author: David Sterba Date: Tue Nov 12 11:20:28 2019 +0100 crypto: blake2b - open code set last block helper The helper is trival and called once, inlining makes things simpler. There's a comment to tie it back to the idea behind the code. Signed-off-by: David Sterba Signed-off-by: Herbert Xu commit d063d6327e7de18e16e4742579a0ff759c3889fb Author: David Sterba Date: Tue Nov 12 11:20:27 2019 +0100 crypto: blake2b - delete unused structs or members All the code for param block has been inlined, last_node and outlen from the state are not used or have become redundant due to other code. Remove it. Signed-off-by: David Sterba Signed-off-by: Herbert Xu commit e87e484d60b0da8302b45f27fe32af1cea02c8d2 Author: David Sterba Date: Tue Nov 12 11:20:26 2019 +0100 crypto: blake2b - simplify key init The keyed init writes the key bytes to the input buffer and does an update. We can do that in two ways: fill the buffer and update immediatelly. This is what current blake2b_init_key does. Any other following _update or _final will continue from the updated state. The other way is to write the key and set the number of bytes to process at the next _update or _final, lazy evaluation. Which leads to the the simplified code in this patch. Signed-off-by: David Sterba Signed-off-by: Herbert Xu commit e374969565472824eba4669dea4a23ad2edb414f Author: David Sterba Date: Tue Nov 12 11:20:25 2019 +0100 crypto: blake2b - merge blake2 init to api callback The call chain from blake2b_init can be simplified because the param block is effectively zeros, besides the key. - blake2b_init0 zeroes state and sets IV - blake2b_init sets up param block with defaults (key and some 1s) - init with key, write it to the input buffer and recalculate state So the compact way is to zero out the state and initialize index 0 of the state directly with the non-zero values and the key. Signed-off-by: David Sterba Signed-off-by: Herbert Xu commit 086db43b5a2281f7ce7d8a67a171b91e1e8fe0ec Author: David Sterba Date: Tue Nov 12 11:20:24 2019 +0100 crypto: blake2b - merge _final implementation to callback blake2b_final is called only once, merge it to the crypto API callback and simplify. This avoids the temporary buffer and swaps the bytes of internal buffer. Signed-off-by: David Sterba Signed-off-by: Herbert Xu commit c7351845b2d685b3ea695f02047bd1b825fb6c98 Author: YueHaibing Date: Tue Nov 12 07:23:14 2019 +0000 crypto: sun8i-ce - Fix memdup.cocci warnings Use kmemdup rather than duplicating its implementation Signed-off-by: YueHaibing Acked-by: Corentin Labbe Signed-off-by: Herbert Xu commit d6e9da21ee8246b5e556b3b153401ab045adb986 Author: Herbert Xu Date: Tue Nov 12 10:38:34 2019 +0800 crypto: sun4i-ss - Fix 64-bit size_t warnings If you try to compile this driver on a 64-bit platform then you will get warnings because it mixes size_t with unsigned int which only works on 32-bit. This patch fixes all of the warnings. Signed-off-by: Herbert Xu Acked-by: Corentin Labbe Tested-by: Corentin Labbe Signed-off-by: Herbert Xu commit 0f6f8749872e7be6c083dc845bf4d45a7018b79c Author: Marcelo Diop-Gonzalez Date: Wed Nov 20 15:21:02 2019 -0500 staging: vchiq: Have vchiq_dump_* functions return an error code These functions currently modify the struct dump_context passed to them, and set context->actual to -EFAULT in case of error. The issue is that this is never returned to the user (except accidentally when things align so that that happens). So, have these functions return 0 on success and the appropriate error code otherwise, and return nonzero errors to the user. Reviewed-by: Dan Carpenter Signed-off-by: Marcelo Diop-Gonzalez Reviewed-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/20191120202102.249121-5-marcgonzalez@google.com Signed-off-by: Greg Kroah-Hartman commit 0046b33ce553f48551ea6e4879562d423ed3f1a0 Author: Marcelo Diop-Gonzalez Date: Wed Nov 20 15:21:01 2019 -0500 staging: vchiq: Refactor indentation in vchiq_dump_* functions Doing this helps with readability, and makes the logic easier to follow. Signed-off-by: Marcelo Diop-Gonzalez Reviewed-by: Nicolas Saenz Julienne Link: https://lore.kernel.org/r/20191120202102.249121-4-marcgonzalez@google.com Signed-off-by: Greg Kroah-Hartman commit 2ae0b31e0faced43c011ce3221f2535721cb6a66 Author: Jiri Slaby Date: Fri Nov 22 11:17:21 2019 +0100 tty: don't crash in tty_init_dev when missing tty_port We currently warn the user when tty->port is not set in tty_init_dev yet. The warning says that the kernel will crash later. And it really will only few lines below at: tty->port->itty = tty; So be nice and avoid the crash -- return an error instead. And update the warning. Signed-off-by: Jiri Slaby Cc: Sudip Mukherjee Link: https://lore.kernel.org/r/20191122101721.7222-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 7f00be96f1252f1e97fd2300e19250b4dc521fb1 Author: Saravana Kannan Date: Tue Nov 19 23:13:01 2019 -0800 of: property: Add device link support for interrupt-parent, dmas and -gpio(s) Add support for creating device links out of more DT properties. Cc: Thomas Gleixner Cc: Vinod Koul Signed-off-by: Saravana Kannan Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20191120071302.227777-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 00d52fb7e4fd1b1b2dc3aa7e6844d074948485b3 Author: Krzysztof Kozlowski Date: Thu Nov 21 21:28:51 2019 +0800 staging: fwserial: Fix Kconfig indentation (seven spaces) Adjust indentation from seven spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191121132851.29072-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit 96a8b2912fe56f49193879a771baf214b4f209e4 Author: Marcelo Diop-Gonzalez Date: Wed Nov 20 15:21:00 2019 -0500 staging: vchiq_dump: Replace min with min_t Replacing this fixes checkpatch warnings. Signed-off-by: Marcelo Diop-Gonzalez Link: https://lore.kernel.org/r/20191120202102.249121-3-marcgonzalez@google.com Signed-off-by: Greg Kroah-Hartman commit eacb77aad729c1ec077de267065210f92efdece2 Author: Marcelo Diop-Gonzalez Date: Wed Nov 20 15:20:59 2019 -0500 staging: vchiq: Fix block comment format in vchiq_dump() This fixes a checkpatch warning. Signed-off-by: Marcelo Diop-Gonzalez Link: https://lore.kernel.org/r/20191120202102.249121-2-marcgonzalez@google.com Signed-off-by: Greg Kroah-Hartman commit 282eaa624f0682a212977076c9062de349540ebb Author: Giovanni Gherdovich Date: Mon Nov 18 19:38:52 2019 +0100 staging: octeon: indent with tabs instead of spaces Remove a coding style error from the Octeon driver's tree and keep checkpatch.pl a little quieter. Being a white-spaces patch the chances of breakage are minimal; we don't have the hardware to run this driver so we built it with COMPILE_TEST enabled on an x86 machine. Signed-off-by: Giovanni Gherdovich Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20191118183852.3699-1-bobdc9664@seznam.cz Signed-off-by: Greg Kroah-Hartman commit 5618332e5b955b4bff06d0b88146b971c8dd7b32 Author: Bernd Porr Date: Mon Nov 18 23:07:59 2019 +0000 staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error The userspace comedilib function 'get_cmd_generic_timed' fills the cmd structure with an informed guess and then calls the function 'usbduxfast_ai_cmdtest' in this driver repeatedly while 'usbduxfast_ai_cmdtest' is modifying the cmd struct until it no longer changes. However, because of rounding errors this never converged because 'steps = (cmd->convert_arg * 30) / 1000' and then back to 'cmd->convert_arg = (steps * 1000) / 30' won't be the same because of rounding errors. 'Steps' should only be converted back to the 'convert_arg' if 'steps' has actually been modified. In addition the case of steps being 0 wasn't checked which is also now done. Signed-off-by: Bernd Porr Cc: # 4.4+ Reviewed-by: Ian Abbott Link: https://lore.kernel.org/r/20191118230759.1727-1-mail@berndporr.me.uk Signed-off-by: Greg Kroah-Hartman commit d088337c38a5cd8f0230fbf2d514ff7672f9d0d3 Author: Navid Emamdoost Date: Thu Nov 21 14:20:36 2019 -0600 Bluetooth: Fix memory leak in hci_connect_le_scan In the implementation of hci_connect_le_scan() when conn is added via hci_conn_add(), if hci_explicit_conn_params_set() fails the allocated memory for conn is leaked. Use hci_conn_del() to release it. Fixes: f75113a26008 ("Bluetooth: add hci_connect_le_scan") Signed-off-by: Navid Emamdoost Signed-off-by: Marcel Holtmann commit 5781823fd0d39082bfe2bbc20408aaa85a6e06ad Author: Thor Thayer Date: Thu Nov 21 12:30:48 2019 -0600 EDAC/altera: Use the Altera System Manager driver Simplify by using the Altera System Manager driver that abstracts the differences between ARM32 and ARM64. Also allows the removal of the Arria10 test function since this is handled by the System Manager driver. Signed-off-by: Thor Thayer Signed-off-by: Borislav Petkov Cc: James Morse Cc: linux-edac Cc: Mauro Carvalho Chehab Cc: Meng.Li@windriver.com Cc: Robert Richter Cc: Tony Luck Link: https://lkml.kernel.org/r/1574361048-17572-4-git-send-email-thor.thayer@linux.intel.com commit 08a260d968d27b7c1abfc9ea32d64a2dc7af0449 Author: Thor Thayer Date: Thu Nov 7 14:01:29 2019 -0600 EDAC/altera: Cleanup the ECC Manager Cleanup the ECC Manager peripheral test in probe function as suggested by James. Remove the check for Stratix10. Suggested-by: James Morse Signed-off-by: Thor Thayer Signed-off-by: Borislav Petkov Cc: linux-edac Cc: Mauro Carvalho Chehab Cc: Robert Richter Cc: Tony Luck Link: https://lkml.kernel.org/r/1573156890-26891-2-git-send-email-thor.thayer@linux.intel.com commit 56d9e7bd3fa0f105b6670021d167744bc50ae4fe Author: Meng Li Date: Thu Nov 21 12:30:46 2019 -0600 EDAC/altera: Use fast register IO for S10 IRQs When an IRQ occurs, regmap_{read,write,...}() is invoked in atomic context. Regmap must indicate register IO is fast so that a spinlock is used instead of a mutex to avoid sleeping in atomic context: lock_acquire __mutex_lock mutex_lock_nested regmap_lock_mutex regmap_write a10_eccmgr_irq_unmask unmask_irq.part.0 irq_enable __irq_startup irq_startup __setup_irq request_threaded_irq devm_request_threaded_irq altr_sdram_probe Mark it so. [ bp: Massage. ] Fixes: 3dab6bd52687 ("EDAC, altera: Add support for Stratix10 SDRAM EDAC") Reported-by: Meng Li Signed-off-by: Meng Li Signed-off-by: Thor Thayer Signed-off-by: Borislav Petkov Cc: James Morse Cc: linux-edac Cc: Mauro Carvalho Chehab Cc: Robert Richter Cc: stable Cc: Tony Luck Link: https://lkml.kernel.org/r/1574361048-17572-2-git-send-email-thor.thayer@linux.intel.com commit 16214bd9e43a31683a7073664b000029bba00354 Author: Robert Richter Date: Thu Nov 21 21:36:57 2019 +0000 EDAC/ghes: Do not warn when incrementing refcount on 0 The following warning from the refcount framework is seen during ghes initialization: EDAC MC0: Giving out device to module ghes_edac.c controller ghes_edac: DEV ghes (INTERRUPT) ------------[ cut here ]------------ refcount_t: increment on 0; use-after-free. WARNING: CPU: 36 PID: 1 at lib/refcount.c:156 refcount_inc_checked [...] Call trace: refcount_inc_checked ghes_edac_register ghes_probe ... It warns if the refcount is incremented from zero. This warning is reasonable as a kernel object is typically created with a refcount of one and freed once the refcount is zero. Afterwards the object would be "used-after-free". For GHES, the refcount is initialized with zero, and that is why this message is seen when initializing the first instance. However, whenever the refcount is zero, the device will be allocated and registered. Since the ghes_reg_mutex protects the refcount and serializes allocation and freeing of ghes devices, a use-after-free cannot happen here. Instead of using refcount_inc() for the first instance, use refcount_set(). This can be used here because the refcount is zero at this point and can not change due to its protection by the mutex. Fixes: 23f61b9fc5cc ("EDAC/ghes: Fix locking and memory barrier issues") Reported-by: John Garry Signed-off-by: Robert Richter Signed-off-by: Borislav Petkov Tested-by: John Garry Cc: Cc: James Morse Cc: Cc: linux-edac Cc: Mauro Carvalho Chehab Cc: Cc: Tony Luck Cc: Link: https://lkml.kernel.org/r/20191121213628.21244-1-rrichter@marvell.com commit 7fdf6c6a0d0e032aac2aa4537a23af1e04a397ce Author: Marcel Holtmann Date: Fri Nov 22 00:33:45 2019 +0100 Bluetooth: Allow combination of BDADDR_PROPERTY and INVALID_BDADDR quirks When utilizing BDADDR_PROPERTY and INVALID_BDADDR quirks together it results in an unconfigured controller even if the bootloader provides a valid address. Fix this by allowing a bootloader provided address to mark the controller as configured. Signed-off-by: Marcel Holtmann Tested-by: Andre Heider Signed-off-by: Johan Hedberg commit def7bd940f8cceb41ec3d1383acd8ab937056dcb Author: Manish Narani Date: Fri Nov 22 12:45:57 2019 +0530 dt-bindings: mmc: Correct the type of the clk phase properties The clock phase properties are having two uint32 values. The minItems and maxItems are set to 2 for the same. So the property type should be 'uint32-array' and not 'uint32'. Modify it to correct the same. Reported-by: Rob Herring Signed-off-by: Manish Narani Signed-off-by: Ulf Hansson commit ce3cba788a1b7b8aed9380c3035d9e850884bd2d Author: Geoffrey D. Bennett Date: Mon Nov 11 00:13:56 2019 +1030 ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data The s6i6_gen2_info.ports[] array had the Mixer and PCM port type entries in the wrong place. Use designators to explicitly specify the array elements being set. Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") Signed-off-by: Geoffrey D. Bennett Tested-by: Alex Fellows Tested-by: Markus Schroetter Cc: Link: https://lore.kernel.org/r/20191110134356.GA31589@b4.vu Signed-off-by: Takashi Iwai commit bd9d6e0371d147b710f549b55d7b44008264aa06 Author: Dominik Brodowski Date: Thu Nov 21 07:54:28 2019 +0100 pcmcia: remove unused dprintk definition A recent cleanup patch removed the remaining users of dprintk() in i82092.c, so get rid of the definition of dprintk() as well. Fixes: 836e9494f448 ("pcmcia/i82092: Refactored dprintk macro for dev_dbg().") Signed-off-by: Dominik Brodowski commit e469edbb0613d4923836c3df3c14f9850fa548ae Author: Ben Dooks (Codethink) Date: Thu Oct 17 12:44:47 2019 +0100 pcmcia: include for pcmcia_parse_tuple Include for pcmcia_parse_tuple declaration to fix the following sparse warning: drivers/pcmcia/cistpl.c:1287:5: warning: symbol 'pcmcia_parse_tuple' was not declared. Should it be static? Signed-off-by: Ben Dooks Signed-off-by: Dominik Brodowski commit 990a1b506d3d3a0cb9a0e141d23e76b31b560288 Author: Ben Dooks (Codethink) Date: Thu Oct 17 12:40:59 2019 +0100 pcmcia: include cs_internal.h for missing declarations Include cs_internal.h (and pcmcia/cistpl.h as required by cs_internal.h) for the declearions of cb_alloc and cb_free to silence the following sparse warnings: drivers/pcmcia/cardbus.c:64:11: warning: symbol 'cb_alloc' was not declared. Should it be static? drivers/pcmcia/cardbus.c:103:6: warning: symbol 'cb_free' was not declared. Should it be static? Signed-off-by: Ben Dooks Signed-off-by: Dominik Brodowski commit 67805a4b3c924927d9e064bca235461941f89e4a Author: Krzysztof Kozlowski Date: Thu Nov 21 04:19:08 2019 +0100 dmaengine: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/1574306348-29212-1-git-send-email-krzk@kernel.org Signed-off-by: Vinod Koul commit 7d268a28ee336ae233b036057607fb73b844d512 Author: Green Wan Date: Mon Nov 18 22:35:53 2019 +0800 dmaengine: sf-pdma: move macro to header file The place where the macro, SF_PDMA_REG_BASE(), is cause kernel-doc using wrong function declaration. Move it to header file. Signed-off-by: Green Wan Link: https://lore.kernel.org/r/20191118143554.16129-2-green.wan@sifive.com Signed-off-by: Vinod Koul commit dd9c324a5e96bfdc4c5c965da6fbd680340cd3f2 Author: Green Wan Date: Mon Nov 18 22:35:52 2019 +0800 dmaengine: sf-pdma: replace /** with /* for non-function comment There are several comments starting from "/**" but not for function comment purpose. It causes kernel-doc parsing wrong string. Replace "/**" with "/*" to fix them. Signed-off-by: Green Wan Link: https://lore.kernel.org/r/20191118143554.16129-1-green.wan@sifive.com Signed-off-by: Vinod Koul commit 340049d453682a9fe8d91fe794dd091730f4bb25 Author: Chuhong Yuan Date: Mon Nov 18 15:38:02 2019 +0800 dmaengine: ti: edma: fix missed failure handling When devm_kcalloc fails, it forgets to call edma_free_slot. Replace direct return with failure handler to fix it. Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding") Signed-off-by: Chuhong Yuan Link: https://lore.kernel.org/r/20191118073802.28424-1-hslester96@gmail.com Signed-off-by: Vinod Koul commit 59dfa75e5d82a1e1b3d090a1d51fc14f66844576 Author: Eric Tremblay Date: Tue Nov 12 17:30:01 2019 -0500 hwmon: Add driver for Texas Instruments TMP512/513 sensor chips. TI's TMP512/513 are I2C/SMBus system monitor chips. These chips monitor the supply voltage, supply current, power consumption and provide one local and up to three (TMP513) remote temperature sensors. It has been tested using a TI TMP513 development kit (TMP513EVM) Signed-off-by: Eric Tremblay Link: https://lore.kernel.org/r/20191112223001.20844-3-etremblay@distech-controls.com Signed-off-by: Guenter Roeck commit 17fe2983e872810051934464ec5bcab80b714e65 Author: Eric Tremblay Date: Tue Nov 12 17:30:00 2019 -0500 dt-bindings: hwmon: Add TMP512/513 Document the TMP513/512 device devicetree bindings Signed-off-by: Eric Tremblay Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20191112223001.20844-2-etremblay@distech-controls.com Signed-off-by: Guenter Roeck commit 39716c560c75619e174221d72f850d44166ef3ae Author: Chuhong Yuan Date: Fri Nov 15 16:31:53 2019 +0800 dmaengine: mmp_pdma: add missed of_dma_controller_free The driver calls of_dma_controller_register in probe but does not free it in remove. Add the call to fix it. Signed-off-by: Chuhong Yuan Link: https://lore.kernel.org/r/20191115083153.12334-1-hslester96@gmail.com Signed-off-by: Vinod Koul commit c236ba4ae7183c1add8dbce91b27c700f7ef4168 Author: Chuhong Yuan Date: Fri Nov 15 16:31:00 2019 +0800 dmaengine: mmp_tdma: add missed of_dma_controller_free The driver calls of_dma_controller_register in probe but does not free it in remove. Add the call to fix it. Signed-off-by: Chuhong Yuan Link: https://lore.kernel.org/r/20191115083100.12220-1-hslester96@gmail.com Signed-off-by: Vinod Koul commit 13baf667fa8e23aed12516776de6e50f7617820a Author: Mao Wenan Date: Fri Nov 22 10:52:40 2019 +0800 enetc: make enetc_setup_tc_mqprio static While using ARCH=mips CROSS_COMPILE=mips-linux-gnu- command to compile, make C=2 drivers/net/ethernet/freescale/enetc/enetc.o one warning can be found: drivers/net/ethernet/freescale/enetc/enetc.c:1439:5: warning: symbol 'enetc_setup_tc_mqprio' was not declared. Should it be static? This patch make symbol enetc_setup_tc_mqprio static. Fixes: 34c6adf1977b ("enetc: Configure the Time-Aware Scheduler via tc-taprio offload") Signed-off-by: Mao Wenan Signed-off-by: David S. Miller commit 82ea3e0e129e2ab913dd6684bab7a6e5e9896dee Author: John Garry Date: Wed Nov 20 17:39:15 2019 +0800 scsi: scsi_transport_sas: Fix memory leak when removing devices Removing a non-host rphy causes a memory leak: root@(none)$ echo 0 > /sys/devices/platform/HISI0162:01/host0/port-0:0/expander-0:0/port-0:0:10/phy-0:0:10/sas_phy/phy-0:0:10/enable [ 79.857888] hisi_sas_v2_hw HISI0162:01: dev[7:1] is gone root@(none)$ echo scan > /sys/kernel/debug/kmemleak [ 131.656603] kmemleak: 3 new suspected memory leaks (see /sys/kernel/debug/kmemleak) root@(none)$ more /sys/kernel/debug/kmemleak unreferenced object 0xffff041da5c66000 (size 256): comm "kworker/u128:1", pid 549, jiffies 4294898543 (age 113.728s) hex dump (first 32 bytes): 00 5e c6 a5 1d 04 ff ff 01 00 00 00 00 00 00 00 .^.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<(____ptrval____)>] kmem_cache_alloc+0x188/0x260 [<(____ptrval____)>] bsg_setup_queue+0x48/0x1a8 [<(____ptrval____)>] sas_rphy_add+0x108/0x2d0 [<(____ptrval____)>] sas_probe_devices+0x168/0x208 [<(____ptrval____)>] sas_discover_domain+0x660/0x9c8 [<(____ptrval____)>] process_one_work+0x3f8/0x690 [<(____ptrval____)>] worker_thread+0x70/0x6a0 [<(____ptrval____)>] kthread+0x1b8/0x1c0 [<(____ptrval____)>] ret_from_fork+0x10/0x18 unreferenced object 0xffff041d8c075400 (size 128): comm "kworker/u128:1", pid 549, jiffies 4294898543 (age 113.728s) hex dump (first 32 bytes): 00 40 25 97 1d 00 ff ff 00 00 00 00 00 00 00 00 .@%............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<(____ptrval____)>] __kmalloc_node+0x1a8/0x2c8 [<(____ptrval____)>] blk_mq_realloc_tag_set_tags.part.70+0x48/0xd8 [<(____ptrval____)>] blk_mq_alloc_tag_set+0x1dc/0x530 [<(____ptrval____)>] bsg_setup_queue+0xe8/0x1a8 [<(____ptrval____)>] sas_rphy_add+0x108/0x2d0 [<(____ptrval____)>] sas_probe_devices+0x168/0x208 [<(____ptrval____)>] sas_discover_domain+0x660/0x9c8 [<(____ptrval____)>] process_one_work+0x3f8/0x690 [<(____ptrval____)>] worker_thread+0x70/0x6a0 [<(____ptrval____)>] kthread+0x1b8/0x1c0 [<(____ptrval____)>] ret_from_fork+0x10/0x18 unreferenced object 0xffff041da5c65e00 (size 256): comm "kworker/u128:1", pid 549, jiffies 4294898543 (age 113.728s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<(____ptrval____)>] __kmalloc_node+0x1a8/0x2c8 [<(____ptrval____)>] blk_mq_alloc_tag_set+0x254/0x530 [<(____ptrval____)>] bsg_setup_queue+0xe8/0x1a8 [<(____ptrval____)>] sas_rphy_add+0x108/0x2d0 [<(____ptrval____)>] sas_probe_devices+0x168/0x208 [<(____ptrval____)>] sas_discover_domain+0x660/0x9c8 [<(____ptrval____)>] process_one_work+0x3f8/0x690 [<(____ptrval____)>] worker_thread+0x70/0x6a0 [<(____ptrval____)>] kthread+0x1b8/0x1c0 [<(____ptrval____)>] ret_from_fork+0x10/0x18 root@(none)$ It turns out that we don't clean up the request queue fully for bsg devices, as the blk mq tags for the request queue are not freed. Fix by doing the queue removal in one place - in sas_rphy_remove() - instead of unregistering the queue in sas_rphy_remove() and finally cleaning up the queue in calling blk_cleanup_queue() from sas_end_device_release() or sas_expander_release(). Function bsg_remove_queue() can handle a NULL pointer q, so remove the precheck in sas_rphy_remove(). Fixes: 651a013649943 ("scsi: scsi_transport_sas: switch to bsg-lib for SMP passthrough") Link: https://lore.kernel.org/r/1574242755-94156-1-git-send-email-john.garry@huawei.com Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit eede4970fb6c29f2056d7d016a3764c90e9d8a65 Author: James Smart Date: Thu Nov 21 09:55:56 2019 -0800 scsi: lpfc: size cpu map by last cpu id set Currently the lpfc driver sizes its cpu_map array based on num_possible_cpus(). However, that can be a value that is less than the highest cpu id bit that is set. As such, if a thread runs on a cpu with a larger cpu id, or for_each_possible_cpu() is used, the driver could index off the end of the array and return garbage or GPF. The driver maintains its own internal copy of the "num_possible" cpu value and sizes arrays by it. Fix by setting the driver's value to the value of the last cpu id bit set in the possible_mask - plus 1. Thus cpu_map will be sized to allow access by any cpu id possible. Link: https://lore.kernel.org/r/20191121175556.18953-1-jsmart2021@gmail.com Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen commit 75d886a9938432364ef1051f4f3d22d6d9788d8c Author: Saurav Girepunje Date: Fri Nov 1 18:05:03 2019 +0530 scsi: ibmvscsi_tgt: Remove unneeded variable rc Variable rc is not modified in ibmvscsis_srp_i_logout function. So remove unneeded variable rc. Issue found using coccicheck tool. Link: https://lore.kernel.org/r/20191101120407.GA9369@saurav Signed-off-by: Saurav Girepunje Reviewed-by: Tyrel Datwyler Signed-off-by: Martin K. Petersen commit 7a1323b5dfe44a9013a2cc56ef2973034a00bf88 Author: Michael Kelley Date: Thu Nov 14 06:32:01 2019 +0000 Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic The crash handler calls hv_synic_cleanup() to shutdown the Hyper-V synthetic interrupt controller. But if the CPU that calls hv_synic_cleanup() has a VMbus channel interrupt assigned to it (which is likely the case in smaller VM sizes), hv_synic_cleanup() returns an error and the synthetic interrupt controller isn't shutdown. While the lack of being shutdown hasn't caused a known problem, it still should be fixed for highest reliability. So directly call hv_synic_disable_regs() instead of hv_synic_cleanup(), which ensures that the synic is always shutdown. Signed-off-by: Michael Kelley Reviewed-by: Vitaly Kuznetsov Reviewed-by: Dexuan Cui Signed-off-by: Sasha Levin commit 8aea7f82153d6f292add3eb4bd7ba8edcae5c7f7 Author: Davidlohr Bueso Date: Fri Nov 1 13:00:04 2019 -0700 drivers/hv: Replace binary semaphore with mutex At a slight footprint cost (24 vs 32 bytes), mutexes are more optimal than semaphores; it's also a nicer interface for mutual exclusion, which is why they are encouraged over binary semaphores, when possible. Replace the hyperv_mmio_lock, its semantics implies traditional lock ownership; that is, the lock owner is the same for both lock/unlock operations. Therefore it is safe to convert. Signed-off-by: Davidlohr Bueso Signed-off-by: Sasha Levin commit d7f0b2e450e94ad3811a812236529175ae86751e Author: Boqun Feng Date: Thu Oct 17 08:57:03 2019 +0800 drivers: iommu: hyperv: Make HYPERV_IOMMU only available on x86 Currently hyperv-iommu is implemented in a x86 specific way, for example, apic is used. So make the HYPERV_IOMMU Kconfig depend on X86 as a preparation for enabling HyperV on architecture other than x86. Cc: Lan Tianyu Cc: Michael Kelley Cc: linux-hyperv@vger.kernel.org Signed-off-by: Boqun Feng (Microsoft) Signed-off-by: Sasha Levin commit af13f9ed6f9aa6801d020c48aeb19dca9f0d4f97 Author: Dexuan Cui Date: Tue Nov 19 23:14:56 2019 -0800 HID: hyperv: Add the support of hibernation During the suspend process and resume process, if there is any mouse event, there is a small chance the suspend and the resume process can be aborted because of mousevsc_on_receive() -> pm_wakeup_hard_event(). This behavior can be avoided by disabling the Hyper-V mouse device as a wakeup source: echo disabled > /sys/bus/vmbus/drivers/hid_hyperv/XXX/power/wakeup (XXX is the device's GUID). Signed-off-by: Dexuan Cui Acked-by: Jiri Kosina Signed-off-by: Sasha Levin commit 25bd2b2f1f05347a4cd633138d0e4c2fd5788359 Author: Dexuan Cui Date: Tue Nov 19 23:16:05 2019 -0800 hv_balloon: Add the support of hibernation When hibernation is enabled, we must ignore the balloon up/down and hot-add requests from the host, if any. Signed-off-by: Dexuan Cui Acked-by: David Hildenbrand Signed-off-by: Sasha Levin commit b96f86534fa3102fd07246cf8b6cb5cc96788597 Author: Dexuan Cui Date: Tue Nov 19 23:16:04 2019 -0800 x86/hyperv: Implement hv_is_hibernation_supported() The API will be used by the hv_balloon and hv_vmbus drivers. Balloon up/down and hot-add of memory must not be active if the user wants the Linux VM to support hibernation, because they are incompatible with hibernation according to Hyper-V team, e.g. upon suspend the balloon VSP doesn't save any info about the ballooned-out pages (if any); so, after Linux resumes, Linux balloon VSC expects that the VSP will return the pages if Linux is under memory pressure, but the VSP will never do that, since the VSP thinks it never stole the pages from the VM. So, if the user wants Linux VM to support hibernation, Linux must forbid balloon up/down and hot-add, and the only functionality of the balloon VSC driver is reporting the VM's memory pressure to the host. Ideally, when Linux detects that the user wants it to support hibernation, the balloon VSC should tell the VSP that it does not support ballooning and hot-add. However, the current version of the VSP requires the VSC should support these capabilities, otherwise the capability negotiation fails and the VSC can not load at all, so with the later changes to the VSC driver, Linux VM still reports to the VSP that the VSC supports these capabilities, but the VSC ignores the VSP's requests of balloon up/down and hot add, and reports an error to the VSP, when applicable. BTW, in the future the balloon VSP driver will allow the VSC to not support the capabilities of balloon up/down and hot add. The ACPI S4 state is not a must for hibernation to work, because Linux is able to hibernate as long as the system can shut down. However in practice we decide to artificially use the presence of the virtual ACPI S4 state as an indicator of the user's intent of using hibernation, because Linux VM must find a way to know if the user wants to use the hibernation feature or not. By default, Hyper-V does not enable the virtual ACPI S4 state; on recent Hyper-V hosts (e.g. RS5, 19H1), the administrator is able to enable the state for a VM by WMI commands. Once all the vmbus and VSC patches for the hibernation feature are accepted, an extra patch will be submitted to forbid hibernation if the virtual ACPI S4 state is absent, i.e. hv_is_hibernation_supported() is false. Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Acked-by: Thomas Gleixner Signed-off-by: Sasha Levin commit 2af5e7b7b230f3c6dcc9d72bb7eeda6e1df1f5fa Author: Himadri Pandya Date: Sat Aug 17 04:08:50 2019 +0000 Drivers: hv: balloon: Remove dependencies on guest page size Hyper-V assumes page size to be 4K. This might not be the case for ARM64 architecture. Hence use hyper-v specific page size and page shift definitions to avoid conflicts between different host and guest page sizes on ARM64. Also, remove some old and incorrect comments and redefine ballooning granularities to handle larger page sizes correctly. Signed-off-by: Himadri Pandya Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 53edce00ceb7443b6f4615b5c8ad71671723d8f5 Author: Himadri Pandya Date: Tue Jul 30 09:49:44 2019 +0000 Drivers: hv: vmbus: Remove dependencies on guest page size Hyper-V assumes page size to be 4K. This might not be the case for ARM64 architecture. Hence use hyper-v page size and page allocation function to avoid conflicts between different host and guest page size on ARM64. Signed-off-by: Himadri Pandya Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit fa36dcdf8b200f4c175d0a00a8c99439ee0df95d Author: Himadri Pandya Date: Tue Jul 30 09:49:43 2019 +0000 x86: hv: Add function to allocate zeroed page for Hyper-V Hyper-V assumes page size to be 4K. While this assumption holds true on x86 architecture, it might not be true for ARM64 architecture. Hence define hyper-v specific function to allocate a zeroed page which can have a different implementation on ARM64 architecture to handle the conflict between hyper-v's assumed page size and actual guest page size. Signed-off-by: Himadri Pandya Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 0541a225945d5e0d650353f51614812aa820c6be Author: Himadri Pandya Date: Thu Jul 25 05:03:15 2019 +0000 Drivers: hv: util: Specify ring buffer size using Hyper-V page size VMbus ring buffers are sized based on the 4K page size used by Hyper-V. The Linux guest page size may not be 4K on all architectures so use the Hyper-V page size to specify the ring buffer size. Signed-off-by: Himadri Pandya Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit b14d749ac5abdf311321172ae11e6ad1be4293e9 Author: Himadri Pandya Date: Thu Jul 25 05:03:14 2019 +0000 Drivers: hv: Specify receive buffer size using Hyper-V page size The recv_buffer is used to retrieve data from the VMbus ring buffer. VMbus ring buffers are sized based on the guest page size which Hyper-V assumes to be 4KB. But it may be different on some architectures. So use the Hyper-V page size to allocate the recv_buffer and set the maximum size to receive. Signed-off-by: Himadri Pandya Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit c48d8b04893afe35fd6f5ccbf339493bba277d43 Author: Branden Bonaby Date: Thu Oct 3 17:02:05 2019 -0400 tools: hv: add vmbus testing tool This is a userspace tool to drive the testing. Currently it supports introducing user specified delay in the host to guest communication path on a per-channel basis. Signed-off-by: Branden Bonaby Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit af9ca6f9bb16e446a44393a797d0ae74d356a5c7 Author: Branden Bonaby Date: Thu Oct 3 17:01:49 2019 -0400 drivers: hv: vmbus: Introduce latency testing Introduce user specified latency in the packet reception path By exposing the test parameters as part of the debugfs channel attributes. We will control the testing state via these attributes. Signed-off-by: Branden Bonaby Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit d21987d709e807ba7bbf47044deb56a3c02e8be4 Author: Wei Hu Date: Wed Sep 18 06:03:20 2019 +0000 video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver Without deferred IO support, hyperv_fb driver informs the host to refresh the entire guest frame buffer at fixed rate, e.g. at 20Hz, no matter there is screen update or not. This patch supports deferred IO for screens in graphics mode and also enables the frame buffer on-demand refresh. The highest refresh rate is still set at 20Hz. Currently Hyper-V only takes a physical address from guest as the starting address of frame buffer. This implies the guest must allocate contiguous physical memory for frame buffer. In addition, Hyper-V Gen 2 VMs only accept address from MMIO region as frame buffer address. Due to these limitations on Hyper-V host, we keep a shadow copy of frame buffer in the guest. This means one more copy of the dirty rectangle inside guest when doing the on-demand refresh. This can be optimized in the future with help from host. For now the host performance gain from deferred IO outweighs the shadow copy impact in the guest. Signed-off-by: Wei Hu Reviewed-by: Dexuan Cui Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 67e7cdb4829d3246c98f2ec9b771303ebe162eab Author: Wei Hu Date: Thu Sep 5 09:11:53 2019 +0000 video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host Beginning from Windows 10 RS5+, VM screen resolution is obtained from host. The "video=hyperv_fb" boot time option is not needed, but still can be used to overwrite what the host specifies. The VM resolution on the host could be set by executing the powershell "set-vmvideo" command. Signed-off-by: Iouri Tarassov Signed-off-by: Wei Hu Reviewed-by: Michael Kelley Reviewed-by: Dexuan Cui Signed-off-by: Sasha Levin commit 0efeea5fb15357f0a582c89c02ef0b6ef58defb5 Author: Dexuan Cui Date: Wed Sep 25 22:04:04 2019 +0000 hv_netvsc: Add the support of hibernation The existing netvsc_detach() and netvsc_attach() APIs make it easy to implement the suspend/resume callbacks. Signed-off-by: Dexuan Cui Reviewed-by: Haiyang Zhang Signed-off-by: Sasha Levin commit 2194c2eb6717f2ea7dc793ad9cbf44d359a3f696 Author: Dexuan Cui Date: Wed Sep 25 21:34:13 2019 +0000 hv_sock: Add the support of hibernation Add the necessary dummy callbacks for hibernation. Signed-off-by: Dexuan Cui Acked-by: David S. Miller Signed-off-by: Sasha Levin commit 1ecf302021040194ae46cceefe33ab75577e356d Author: Dexuan Cui Date: Wed Sep 11 23:34:10 2019 +0000 video: hyperv_fb: Add the support of hibernation This patch depends on the vmbus side change of the definition of struct hv_driver. Signed-off-by: Dexuan Cui Signed-off-by: Sasha Levin commit 56fb105859345d65aed08ebbb0f6160c4f0777eb Author: Dexuan Cui Date: Wed Sep 11 23:35:16 2019 +0000 scsi: storvsc: Add the support of hibernation When we're in storvsc_suspend(), we're sure the SCSI layer has quiesced the scsi device by scsi_bus_suspend() -> ... -> scsi_device_quiesce(), so the low level SCSI adapter driver only needs to suspend/resume its own state. Signed-off-by: Dexuan Cui Acked-by: Martin K. Petersen Signed-off-by: Sasha Levin commit 931cccc967730d43bb6325506baf51c8f83a9a58 Author: Andrea Parri Date: Tue Oct 15 13:46:46 2019 +0200 Drivers: hv: vmbus: Add module parameter to cap the VMBus version Currently, Linux guests negotiate the VMBus version with Hyper-V and use the highest available VMBus version they can connect to. This has some drawbacks: by using the highest available version, certain code paths are never executed and can not be tested when the guest runs on the newest host. Add the module parameter "max_version", to upper-bound the VMBus versions guests can negotiate. Suggested-by: Dexuan Cui Signed-off-by: Andrea Parri Reviewed-by: Wei Liu Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 2d4f49b3e1e3a24ce16dfeeb2235688c8aba57ef Author: Andrea Parri Date: Tue Oct 15 13:46:45 2019 +0200 Drivers: hv: vmbus: Enable VMBus protocol versions 4.1, 5.1 and 5.2 Hyper-V has added VMBus protocol versions 5.1 and 5.2 in recent release versions. Allow Linux guests to negotiate these new protocol versions on versions of Hyper-V that support them. While on this, also allow guests to negotiate the VMBus protocol version 4.1 (which was missing). Signed-off-by: Andrea Parri Reviewed-by: Wei Liu Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit bedc61a922f9dbbe3bfb26ec2745f8cd63b57637 Author: Andrea Parri Date: Tue Oct 15 13:46:44 2019 +0200 Drivers: hv: vmbus: Introduce table of VMBus protocol versions The technique used to get the next VMBus version seems increasisly clumsy as the number of VMBus versions increases. Performance is not a concern since this is only done once during system boot; it's just that we'll end up with more lines of code than is really needed. As an alternative, introduce a table with the version numbers listed in order (from the most recent to the oldest). vmbus_connect() loops through the versions listed in the table until it gets an accepted connection or gets to the end of the table (invalid version). Suggested-by: Michael Kelley Signed-off-by: Andrea Parri Reviewed-by: Wei Liu Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 1a70cf0e7ee6e73aa29c2dd4dd8d3d38c48d5946 Author: Jisheng Zhang (syna) Date: Wed Nov 20 07:57:14 2019 +0100 ARM: 8940/1: ftrace: remove mcount(),ftrace_caller_old() and ftrace_call_old() Commit d3c61619568c ("ARM: 8788/1: ftrace: remove old mcount support") removed the old mcount support, but forget to remove these three declarations. This patch removes them. Signed-off-by: Jisheng Zhang Acked-by: Steven Rostedt (VMware) Signed-off-by: Russell King commit 29c623d64f0dcd6aa10e0eabd16233e77114090b Author: Dmitry Golovin Date: Tue Nov 19 16:39:42 2019 +0100 ARM: 8939/1: kbuild: use correct nm executable Since $(NM) variable can be easily overridden for the whole build, it's better to use it instead of $(CROSS_COMPILE)nm. The use of $(CROSS_COMPILE) prefixed variables where their calculated equivalents can be used is incorrect. This fixes issues with builds where $(NM) is set to llvm-nm. Link: https://github.com/ClangBuiltLinux/linux/issues/766 Signed-off-by: Dmitry Golovin Suggested-by: Nick Desaulniers Cc: Matthias Maennich Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Reviewed-by: Masahiro Yamada Reviewed-by: Nick Desaulniers Signed-off-by: Russell King commit 87e90283c94c76ee11d379ab5a0973382bbd0baf Author: Heiner Kallweit Date: Sat Oct 5 14:08:52 2019 +0200 PCI/ASPM: Remove PCIEASPM_DEBUG Kconfig option and related code Previously, CONFIG_PCIEASPM_DEBUG enabled "link_state" and "clk_ctl" sysfs files that controlled ASPM. We believe these files were rarely if ever used. We recently added sysfs ASPM controls that are always present, so the debug code is no longer needed. Removing this debug code has been discussed for quite some time, see e.g. [0]. Remove PCIEASPM_DEBUG and the related code. [0] https://lore.kernel.org/lkml/20180727202619.GD173328@bhelgaas-glaptop.roam.corp.google.com/ Link: https://lore.kernel.org/r/ec935d8e-c084-3938-f1d1-748617596b25@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 72ea91afbfb08619696ccde610ee4d0d29cf4a1d Author: Heiner Kallweit Date: Sat Oct 5 14:07:56 2019 +0200 PCI/ASPM: Add sysfs attributes for controlling ASPM link states Add sysfs attributes to Endpoints and other Upstream Ports to control ASPM, Clock PM, and L1 PM Substates. The new attributes are: /sys/devices/pci*/.../link/clkpm /sys/devices/pci*/.../link/l0s_aspm /sys/devices/pci*/.../link/l1_aspm /sys/devices/pci*/.../link/l1_1_aspm /sys/devices/pci*/.../link/l1_2_aspm /sys/devices/pci*/.../link/l1_1_pcipm /sys/devices/pci*/.../link/l1_2_pcipm An attribute is only visible if both ends of the Link leading to the device support the state. Writing y/1/on to the file enables the state; n/0/off disables it. These attributes can be used to tune the power/performance tradeoff for individual devices. [bhelgaas: commit log, rename directory to "link"] Link: https://lore.kernel.org/r/b1c83f8a-9bf6-eac5-82d0-cf5b90128fbf@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 7d75c0cb22b71837b376b68fa240c01d4a955fa4 Merge: 2c44713ed96d 02b24941619f Author: David S. Miller Date: Thu Nov 21 14:45:55 2019 -0800 Merge branch 'net-introduce-and-use-route-hint' Paolo Abeni says: ==================== net: introduce and use route hint This series leverages the listification infrastructure to avoid unnecessary route lookup on ingress packets. In absence of custom rules, packets with equal daddr will usually land on the same dst. When processing packet bursts (lists) we can easily reference the previous dst entry. When we hit the 'same destination' condition we can avoid the route lookup, coping the already available dst. Detailed performance numbers are available in the individual commit messages. v3 -> v4: - move helpers to their own patches (Eric D.) - enable hints for SUBTREE builds (David A.) - re-enable hints for ipv4 forward (David A.) v2 -> v3: - use fib*_has_custom_rules() helpers (David A.) - add ip*_extract_route_hint() helper (Edward C.) - use prev skb as hint instead of copying data (Willem ) v1 -> v2: - fix build issue with !CONFIG_IP*_MULTIPLE_TABLES - fix potential race in ip6_list_rcv_finish() ==================== Acked-by: Edward Cree Signed-off-by: David S. Miller commit 02b24941619fcce3d280311ac73b1e461552e9c8 Author: Paolo Abeni Date: Wed Nov 20 13:47:37 2019 +0100 ipv4: use dst hint for ipv4 list receive This is alike the previous change, with some additional ipv4 specific quirk. Even when using the route hint we still have to do perform additional per packet checks about source address validity: a new helper is added to wrap them. Hints are explicitly disabled if the destination is a local broadcast, that keeps the code simple and local broadcast are a slower path anyway. UDP flood performances vs recvmmsg() receiver: vanilla patched delta Kpps Kpps % 1683 1871 +11 In the worst case scenario - each packet has a different destination address - the performance delta is within noise range. v3 -> v4: - re-enable hints for forward v2 -> v3: - really fix build (sic) and hint usage check - use fib4_has_custom_rules() helpers (David A.) - add ip_extract_route_hint() helper (Edward C.) - use prev skb as hint instead of copying data (Willem) v1 -> v2: - fix build issue with !CONFIG_IP_MULTIPLE_TABLES Signed-off-by: Paolo Abeni Reviewed-by: David Ahern Signed-off-by: David S. Miller commit c43c3d76c021d8d654ff5cfaad381f14f6beaf1a Author: Paolo Abeni Date: Wed Nov 20 13:47:36 2019 +0100 ipv4: move fib4_has_custom_rules() helper to public header So that we can use it in the next patch. Additionally constify the helper argument. Suggested-by: David Ahern Signed-off-by: Paolo Abeni Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 197dbf24e360ed8dbbbe8ed17c2c496f501a0bda Author: Paolo Abeni Date: Wed Nov 20 13:47:35 2019 +0100 ipv6: introduce and uses route look hints for list input. When doing RX batch packet processing, we currently always repeat the route lookup for each ingress packet. When no custom rules are in place, and there aren't routes depending on source addresses, we know that packets with the same destination address will use the same dst. This change tries to avoid per packet route lookup caching the destination address of the latest successful lookup, and reusing it for the next packet when the above conditions are in place. Ingress traffic for most servers should fit. The measured performance delta under UDP flood vs a recvmmsg receiver is as follow: vanilla patched delta Kpps Kpps % 1431 1674 +17 In the worst-case scenario - each packet has a different destination address - the performance delta is within noise range. v3 -> v4: - support hints for SUBFLOW build, too (David A.) - several style fixes (Eric) v2 -> v3: - add fib6_has_custom_rules() helpers (David A.) - add ip6_extract_route_hint() helper (Edward C.) - use hint directly in ip6_list_rcv_finish() (Willem) v1 -> v2: - fix build issue with !CONFIG_IPV6_MULTIPLE_TABLES - fix potential race when fib6_has_custom_rules is set while processing a packet batch Signed-off-by: Paolo Abeni Reviewed-by: David Ahern Signed-off-by: David S. Miller commit b9b33e7c24af1cddc7697056f1664279a40d9a4a Author: Paolo Abeni Date: Wed Nov 20 13:47:34 2019 +0100 ipv6: keep track of routes using src Use a per namespace counter, increment it on successful creation of any route using the source address, decrement it on deletion of such routes. This allows us to check easily if the routing decision in the current namespace depends on the packet source. Will be used by the next patch. Suggested-by: David Ahern Signed-off-by: Paolo Abeni Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 1f8ac5703037fdd2e6c960cd35c2b14d18ef3933 Author: Paolo Abeni Date: Wed Nov 20 13:47:33 2019 +0100 ipv6: add fib6_has_custom_rules() helper It wraps the namespace field with the same name, to easily access it regardless of build options. Suggested-by: David Ahern Suggested-by: Eric Dumazet Signed-off-by: Paolo Abeni Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 2c44713ed96da04f5e25b0df4035074b844def04 Merge: 8163999db445 c0bcf537667c Author: David S. Miller Date: Thu Nov 21 14:39:03 2019 -0800 Merge branch 'DSA-Felix-PTP' Yangbo Lu says: ==================== Support PTP clock and hardware timestamping for DSA Felix driver This patch-set is to support PTP clock and hardware timestamping for DSA Felix driver. Some functions in ocelot.c/ocelot_board.c driver were reworked/exported, so that DSA Felix driver was able to reuse them as much as possible. On TX path, timestamping works on packet which requires timestamp. The injection header will be configured accordingly, and skb clone requires timestamp will be added into a list. The TX timestamp is final handled in threaded interrupt handler when PTP timestamp FIFO is ready. On RX path, timestamping is always working. The RX timestamp could be got from extraction header. ==================== Signed-off-by: David S. Miller commit c0bcf537667cf88bbcbb377d01d2b79c45265741 Author: Yangbo Lu Date: Wed Nov 20 16:23:18 2019 +0800 net: dsa: ocelot: add hardware timestamping support for Felix This patch is to reuse ocelot functions as possible to enable PTP clock and to support hardware timestamping on Felix. On TX path, timestamping works on packet which requires timestamp. The injection header will be configured accordingly, and skb clone requires timestamp will be added into a list. The TX timestamp is final handled in threaded interrupt handler when PTP timestamp FIFO is ready. On RX path, timestamping is always working. The RX timestamp could be got from extraction header. Signed-off-by: Yangbo Lu Signed-off-by: David S. Miller commit 5df66c48bc4e4019f92a8c62d0b74a97d102ba8d Author: Yangbo Lu Date: Wed Nov 20 16:23:17 2019 +0800 net: dsa: ocelot: define PTP registers for felix_vsc9959 This patch is to define PTP registers for felix_vsc9959. Signed-off-by: Yangbo Lu Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 400928bf928be153cddd76d9ac4e39978cb43fd3 Author: Yangbo Lu Date: Wed Nov 20 16:23:16 2019 +0800 net: mscc: ocelot: convert to use ocelot_port_add_txtstamp_skb() Convert to use ocelot_port_add_txtstamp_skb() for adding skbs which require TX timestamp into list. Export it so that DSA Felix driver could reuse it too. Signed-off-by: Yangbo Lu Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit e23a7b3e8daa4be3d91544d8ba210f96d2266de9 Author: Yangbo Lu Date: Wed Nov 20 16:23:15 2019 +0800 net: mscc: ocelot: convert to use ocelot_get_txtstamp() The method getting TX timestamp by reading timestamp FIFO and matching skbs list is common for DSA Felix driver too. So move code out of ocelot_board.c, convert to use ocelot_get_txtstamp() function and export it. Signed-off-by: Yangbo Lu Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit f145922ddcaa1cb9688b3d053622c98d9f9a7fff Author: Yangbo Lu Date: Wed Nov 20 16:23:14 2019 +0800 net: mscc: ocelot: export ocelot_hwstamp_get/set functions Export ocelot_hwstamp_get/set functions so that DSA driver is able to reuse them. Signed-off-by: Yangbo Lu Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 8729aaba74626c4ebce3abf1b9e96bb62d2958ca Author: Chuck Lever Date: Wed Nov 20 16:25:46 2019 -0500 SUNRPC: Fix backchannel latency metrics I noticed that for callback requests, the reported backlog latency is always zero, and the rtt value is crazy big. The problem was that rqst->rq_xtime is never set for backchannel requests. Fixes: 78215759e20d ("SUNRPC: Make RTT measurement more ... ") Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields commit 8163999db445021f2651a8a47b5632483e8722ea Author: John Fastabend Date: Thu Nov 21 08:25:09 2019 -0800 bpf: skmsg, fix potential psock NULL pointer dereference Report from Dan Carpenter, net/core/skmsg.c:792 sk_psock_write_space() error: we previously assumed 'psock' could be null (see line 790) net/core/skmsg.c 789 psock = sk_psock(sk); 790 if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))) Check for NULL 791 schedule_work(&psock->work); 792 write_space = psock->saved_write_space; ^^^^^^^^^^^^^^^^^^^^^^^^ 793 rcu_read_unlock(); 794 write_space(sk); Ensure psock dereference on line 792 only occurs if psock is not null. Reported-by: Dan Carpenter Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: John Fastabend Signed-off-by: David S. Miller commit 36533f355b1ad14ec4352f7e254a5bfd4f4923d5 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:40:36 2019 +0800 PCI: Fix indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig [bhelgaas: do same in vmd.c] Link: https://lore.kernel.org/r/20191120134036.14502-1-krzk@kernel.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Helgaas commit 4d2fa82d98d2d296043a04eb517d7dbade5b13b8 Author: Andy Lutomirski Date: Wed Nov 20 11:58:32 2019 -0800 selftests/x86/sigreturn/32: Invalidate DS and ES when abusing the kernel If the kernel accidentally uses DS or ES while the user values are loaded, it will work fine for sane userspace. In the interest of simulating maximally insane userspace, make sigreturn_32 zero out DS and ES for the nasty parts so that inadvertent use of these segments will crash. Signed-off-by: Andy Lutomirski Signed-off-by: Peter Zijlstra (Intel) Cc: stable@kernel.org commit 8caa016bfc129f2c925d52da43022171d1d1de91 Author: Andy Lutomirski Date: Wed Nov 20 12:59:13 2019 -0800 selftests/x86/mov_ss_trap: Fix the SYSENTER test For reasons that I haven't quite fully diagnosed, running mov_ss_trap_32 on a 32-bit kernel results in an infinite loop in userspace. This appears to be because the hacky SYSENTER test doesn't segfault as desired; instead it corrupts the program state such that it infinite loops. Fix it by explicitly clearing EBP before doing SYSENTER. This will give a more reliable segfault. Fixes: 59c2a7226fc5 ("x86/selftests: Add mov_to_ss test") Signed-off-by: Andy Lutomirski Signed-off-by: Peter Zijlstra (Intel) Cc: stable@kernel.org commit 4fe171bb81b13b40bf568330ec3716dfb304ced1 Author: zhengbin Date: Thu Nov 21 09:12:18 2019 +0000 afs: Remove set but not used variable 'ret' Fixes gcc '-Wunused-but-set-variable' warning: fs/afs/server.c: In function afs_install_server: fs/afs/server.c:157:6: warning: variable ret set but not used [-Wunused-but-set-variable] It is not used since commit d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation") Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: David Howells commit 51590df4f3306cb1f43dca54e3ccdd121ab89594 Author: zhengbin Date: Thu Nov 21 09:12:18 2019 +0000 afs: Remove set but not used variables 'before', 'after' Fixes gcc '-Wunused-but-set-variable' warning: fs/afs/dir_edit.c: In function afs_set_contig_bits: fs/afs/dir_edit.c:75:20: warning: variable after set but not used [-Wunused-but-set-variable] fs/afs/dir_edit.c: In function afs_set_contig_bits: fs/afs/dir_edit.c:75:12: warning: variable before set but not used [-Wunused-but-set-variable] fs/afs/dir_edit.c: In function afs_clear_contig_bits: fs/afs/dir_edit.c:100:20: warning: variable after set but not used [-Wunused-but-set-variable] fs/afs/dir_edit.c: In function afs_clear_contig_bits: fs/afs/dir_edit.c:100:12: warning: variable before set but not used [-Wunused-but-set-variable] They are never used since commit 63a4681ff39c. Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...") Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: David Howells commit 7599a896f2e46e9c072e02a8299a67d4d2f96675 Author: Jiri Olsa Date: Thu Nov 21 16:58:53 2019 +0100 audit: Move audit_log_task declaration under CONFIG_AUDITSYSCALL The 0-DAY found that audit_log_task is not declared under CONFIG_AUDITSYSCALL which causes compilation error when it is not defined: kernel/bpf/syscall.o: In function `bpf_audit_prog.isra.30': >> syscall.c:(.text+0x860): undefined reference to `audit_log_task' Adding the audit_log_task declaration and stub within CONFIG_AUDITSYSCALL ifdef. Fixes: 91e6015b082b ("bpf: Emit audit messages upon successful prog load and unload") Reported-by: kbuild test robot Signed-off-by: Jiri Olsa Signed-off-by: David S. Miller commit 43da14110cb4d20de0b4b097da88addefeab5f13 Author: Krzysztof Kozlowski Date: Thu Nov 21 21:28:35 2019 +0800 net: Fix Kconfig indentation, continued Adjust indentation from spaces to tab (+optional two spaces) as in coding style. This fixes various indentation mixups (seven spaces, tab+one space, etc). Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit f33dabf59d6cf6b4ce48e1552ae84092a4f753df Author: Alain Volmat Date: Thu Nov 21 14:27:46 2019 +0100 dt-bindings: i2c: stm32: Migrate i2c-stm32 documentation to yaml The document was migrated to Yaml format and renamed st,stm32-i2c.yaml Signed-off-by: Alain Volmat Signed-off-by: Rob Herring commit 1e25c5f5333a9ca482312c8a4c33e251887d2d82 Author: Benjamin Gaignard Date: Thu Nov 21 14:06:15 2019 +0100 dt-bindings: mtd: Convert stm32 fmc2-nand bindings to json-schema Convert the STM32 fmc2-nand binding to DT schema format using json-schema Signed-off-by: Benjamin Gaignard CC: Christophe Kerello Signed-off-by: Rob Herring commit 5421cf84af69a94ebb179fec252f3772c4681cca Author: Krzysztof Kozlowski Date: Thu Nov 21 21:28:28 2019 +0800 drivers: net: Fix Kconfig indentation, continued Adjust indentation from spaces to tab (+optional two spaces) as in coding style. This fixes various indentation mixups (seven spaces, tab+one space, etc). Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 1841b9829903c82e0445032ad4a7556fcc44a497 Author: Xin Long Date: Thu Nov 21 18:14:50 2019 +0800 lwtunnel: check erspan options before allocating tun_info As Jakub suggested on another patch, it's better to do the check on erspan options before allocating memory. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 7b6a70f7376479ee0a185b7c2e57b26243f1052d Author: Xin Long Date: Thu Nov 21 18:11:27 2019 +0800 lwtunnel: be STRICT to validate the new LWTUNNEL_IP(6)_OPTS LWTUNNEL_IP(6)_OPTS are the new items in ip(6)_tun_policy, which are parsed by nla_parse_nested_deprecated(). We should check it strictly by setting .strict_start_type = LWTUNNEL_IP(6)_OPTS. This patch also adds missing LWTUNNEL_IP6_OPTS in ip6_tun_policy. Fixes: 4ece47787077 ("lwtunnel: add options setting and dumping for geneve") Signed-off-by: Xin Long Signed-off-by: David S. Miller commit f3bed7f8f93d60df11f94be14542682c905b5c3e Author: Xin Long Date: Thu Nov 21 18:08:38 2019 +0800 net: remove the unnecessary strict_start_type in some policies ct_policy and mpls_policy are parsed with nla_parse_nested(), which does NL_VALIDATE_STRICT validation, strict_start_type is not needed to set as it is actually trying to make some attributes parsed with NL_VALIDATE_STRICT. This patch is to remove it, and do the same on rtm_nh_policy which is parsed by nlmsg_parse(). Suggested-by: Jakub Kicinski Signed-off-by: Xin Long Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit ff998a80c359581dc5126897e953aa9ad3d65ae1 Merge: 0617aa988dac 79b1011cb33d Author: David S. Miller Date: Thu Nov 21 11:44:06 2019 -0800 Merge branch 'net-sched-support-vxlan-and-erspan-options' Xin Long says: ==================== net: sched: support vxlan and erspan options This patchset is to add vxlan and erspan options support in cls_flower and act_tunnel_key. The form is pretty much like geneve_opts in: https://patchwork.ozlabs.org/patch/935272/ https://patchwork.ozlabs.org/patch/954564/ but only one option is allowed for vxlan and erspan. v1->v2: - see each patch changelog. ==================== Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 79b1011cb33d166f531a1347a17e6602954e4eb1 Author: Xin Long Date: Thu Nov 21 18:03:29 2019 +0800 net: sched: allow flower to match erspan options This patch is to allow matching options in erspan. The options can be described in the form: VER:INDEX:DIR:HWID/VER:INDEX_MASK:DIR_MASK:HWID_MASK. When ver is set to 1, index will be applied while dir and hwid will be ignored, and when ver is set to 2, dir and hwid will be used while index will be ignored. Different from geneve, only one option can be set. And also, geneve options, vxlan options or erspan options can't be set at the same time. # ip link add name erspan1 type erspan external # tc qdisc add dev erspan1 ingress # tc filter add dev erspan1 protocol ip parent ffff: \ flower \ enc_src_ip 10.0.99.192 \ enc_dst_ip 10.0.99.193 \ enc_key_id 11 \ erspan_opts 1:12:0:0/1:ffff:0:0 \ ip_proto udp \ action mirred egress redirect dev eth0 v1->v2: - improve some err msgs of extack. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit d8f9dfae49ce4ffb772dc10dd6578dc815b34c12 Author: Xin Long Date: Thu Nov 21 18:03:28 2019 +0800 net: sched: allow flower to match vxlan options This patch is to allow matching gbp option in vxlan. The options can be described in the form GBP/GBP_MASK, where GBP is represented as a 32bit hexadecimal value. Different from geneve, only one option can be set. And also, geneve options and vxlan options can't be set at the same time. # ip link add name vxlan0 type vxlan dstport 0 external # tc qdisc add dev vxlan0 ingress # tc filter add dev vxlan0 protocol ip parent ffff: \ flower \ enc_src_ip 10.0.99.192 \ enc_dst_ip 10.0.99.193 \ enc_key_id 11 \ vxlan_opts 01020304/ffffffff \ ip_proto udp \ action mirred egress redirect dev eth0 v1->v2: - add .strict_start_type for enc_opts_policy as Jakub noticed. - use Duplicate instead of Wrong in err msg for extack as Jakub suggested. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit e20d4ff2acd7db2ffce64a6ddbdaeec43a8eec19 Author: Xin Long Date: Thu Nov 21 18:03:27 2019 +0800 net: sched: add erspan option support to act_tunnel_key This patch is to allow setting erspan options using the act_tunnel_key action. Different from geneve options, only one option can be set. And also, geneve options, vxlan options or erspan options can't be set at the same time. Options are expressed as ver:index:dir:hwid, when ver is set to 1, index will be applied while dir and hwid will be ignored, and when ver is set to 2, dir and hwid will be used while index will be ignored. # ip link add name erspan1 type erspan external # tc qdisc add dev eth0 ingress # tc filter add dev eth0 protocol ip parent ffff: \ flower indev eth0 \ ip_proto udp \ action tunnel_key \ set src_ip 10.0.99.192 \ dst_ip 10.0.99.193 \ dst_port 6081 \ id 11 \ erspan_opts 1:2:0:0 \ action mirred egress redirect dev erspan1 v1->v2: - do the validation when dst is not yet allocated as Jakub suggested. - use Duplicate instead of Wrong in err msg for extack. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit fca3f91cc38ad866c995fb099d961b31cd687849 Author: Xin Long Date: Thu Nov 21 18:03:26 2019 +0800 net: sched: add vxlan option support to act_tunnel_key This patch is to allow setting vxlan options using the act_tunnel_key action. Different from geneve options, only one option can be set. And also, geneve options and vxlan options can't be set at the same time. gbp is the only param for vxlan options: # ip link add name vxlan0 type vxlan dstport 0 external # tc qdisc add dev eth0 ingress # tc filter add dev eth0 protocol ip parent ffff: \ flower indev eth0 \ ip_proto udp \ action tunnel_key \ set src_ip 10.0.99.192 \ dst_ip 10.0.99.193 \ dst_port 6081 \ id 11 \ vxlan_opts 01020304 \ action mirred egress redirect dev vxlan0 v1->v2: - add .strict_start_type for enc_opts_policy as Jakub noticed. - use Duplicate instead of Wrong in err msg for extack as Jakub suggested. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 0617aa988dacb9d8c1cb42fbb6c79896c7507e08 Author: Dan Carpenter Date: Thu Nov 21 12:21:46 2019 +0300 octeontx2-af: Fix uninitialized variable in debugfs If rvu_get_blkaddr() fails, then this rvu_cgx_nix_cuml_stats() returns zero and we write some uninitialized data into the debugfs output. On the error paths, the use of the uninitialized "*stat" is harmless, but it will lead to a Smatch warning (static analysis) and a UBSan warning (runtime analysis) so we should prevent that as well. Fixes: f967488d095e ("octeontx2-af: Add per CGX port level NIX Rx/Tx counters") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit 039fcccaed338b2ff6587178c1219c1ef383a1d9 Author: Stefano Garzarella Date: Thu Nov 21 10:06:09 2019 +0100 vsock: avoid to assign transport if its initialization fails If transport->init() fails, we can't assign the transport to the socket, because it's not initialized correctly, and any future calls to the transport callbacks would have an unexpected behavior. Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") Reported-and-tested-by: syzbot+e2e5c07bf353b2f79daa@syzkaller.appspotmail.com Signed-off-by: Stefano Garzarella Reviewed-by: Jorgen Hansen Signed-off-by: David S. Miller commit de29fe308de7e0c5c94af0dd30e825fcc98293fa Author: Krzysztof Kozlowski Date: Thu Nov 21 04:20:57 2019 +0100 riscv: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Reviewed-by: Palmer Dabbelt [paul.walmsley@sifive.com: use two leading spaces for help text to align with common arch/ practice] Signed-off-by: Paul Walmsley commit 05d6c8cfdbd6cefac6b373bad72775fcc4193c80 Author: Markus Theil Date: Wed Nov 20 21:05:31 2019 +0100 mt76: fix fix ampdu locking The current ampdu locking code does not unlock its mutex in the early return case. This patch fixes it. Signed-off-by: Markus Theil Acked-by: Felix Fietkau Signed-off-by: Kalle Valo commit 895429076512e9d1cf5428181076299c90713159 Author: Peter Zijlstra Date: Wed Nov 20 15:02:26 2019 +0100 x86/entry/32: Fix NMI vs ESPFIX When the NMI lands on an ESPFIX_SS, we are on the entry stack and must swizzle, otherwise we'll run do_nmi() on the entry stack, which is BAD. Also, similar to the normal exception path, we need to correct the ESPFIX magic before leaving the entry stack, otherwise pt_regs will present a non-flat stack pointer. Tested by running sigreturn_32 concurrent with perf-record. Fixes: e5862d0515ad ("x86/entry/32: Leave the kernel via trampoline stack") Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andy Lutomirski Cc: stable@kernel.org commit a1a338e5b6fe9e0a39c57c232dc96c198bb53e47 Author: Andy Lutomirski Date: Wed Nov 20 10:10:49 2019 +0100 x86/entry/32: Unwind the ESPFIX stack earlier on exception entry Right now, we do some fancy parts of the exception entry path while SS might have a nonzero base: we fill in regs->ss and regs->sp, and we consider switching to the kernel stack. This results in regs->ss and regs->sp referring to a non-flat stack and it may result in overflowing the entry stack. The former issue means that we can try to call iret_exc on a non-flat stack, which doesn't work. Tested with selftests/x86/sigreturn_32. Fixes: 45d7b255747c ("x86/entry/32: Enter the kernel via trampoline stack") Signed-off-by: Andy Lutomirski Signed-off-by: Peter Zijlstra (Intel) Cc: stable@kernel.org commit 82cb8a0b1d8d07817b5d59f7fa1438e1fceafab2 Author: Andy Lutomirski Date: Wed Nov 20 09:56:36 2019 +0100 x86/entry/32: Move FIXUP_FRAME after pushing %fs in SAVE_ALL This will allow us to get percpu access working before FIXUP_FRAME, which will allow us to unwind ESPFIX earlier. Signed-off-by: Andy Lutomirski Signed-off-by: Peter Zijlstra (Intel) Cc: stable@kernel.org commit 4c4fd55d3d59a41ddfa6ecba7e76928921759f43 Author: Andy Lutomirski Date: Wed Nov 20 09:49:33 2019 +0100 x86/entry/32: Use %ss segment where required When re-building the IRET frame we use %eax as an destination %esp, make sure to then also match the segment for when there is a nonzero SS base (ESPFIX). [peterz: Changelog and minor edits] Fixes: 3c88c692c287 ("x86/stackframe/32: Provide consistent pt_regs") Signed-off-by: Andy Lutomirski Signed-off-by: Peter Zijlstra (Intel) Cc: stable@kernel.org commit 40ad2199580e248dce2a2ebb722854180c334b9e Author: Peter Zijlstra Date: Wed Nov 20 13:05:06 2019 +0100 x86/entry/32: Fix IRET exception As reported by Lai, the commit 3c88c692c287 ("x86/stackframe/32: Provide consistent pt_regs") wrecked the IRET EXTABLE entry by making .Lirq_return not point at IRET. Fix this by placing IRET_FRAME in RESTORE_REGS, to mirror how FIXUP_FRAME is part of SAVE_ALL. Fixes: 3c88c692c287 ("x86/stackframe/32: Provide consistent pt_regs") Reported-by: Lai Jiangshan Signed-off-by: Peter Zijlstra (Intel) Acked-by: Andy Lutomirski Cc: stable@kernel.org commit 880a98c339961eaa074393e3a2117cbe9125b8bb Author: Thomas Gleixner Date: Thu Nov 21 00:40:24 2019 +0100 x86/cpu_entry_area: Add guard page for entry stack on 32bit The entry stack in the cpu entry area is protected against overflow by the readonly GDT on 64-bit, but on 32-bit the GDT needs to be writeable and therefore does not trigger a fault on stack overflow. Add a guard page. Fixes: c482feefe1ae ("x86/entry/64: Make cpu_entry_area.tss read-only") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Cc: stable@kernel.org commit f490e07c53d66045d9d739e134145ec9b38653d3 Author: Thomas Gleixner Date: Thu Nov 21 00:40:23 2019 +0100 x86/pti/32: Size initial_page_table correctly Commit 945fd17ab6ba ("x86/cpu_entry_area: Sync cpu_entry_area to initial_page_table") introduced the sync for the initial page table for 32bit. sync_initial_page_table() uses clone_pgd_range() which does the update for the kernel page table. If PTI is enabled it also updates the user space page table counterpart, which is assumed to be in the next page after the target PGD. At this point in time 32-bit did not have PTI support, so the user space page table update was not taking place. The support for PTI on 32-bit which was introduced later on, did not take that into account and missed to add the user space counter part for the initial page table. As a consequence sync_initial_page_table() overwrites any data which is located in the page behing initial_page_table causing random failures, e.g. by corrupting doublefault_tss and wreckaging the doublefault handler on 32bit. Fix it by adding a "user" page table right after initial_page_table. Fixes: 7757d607c6b3 ("x86/pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Joerg Roedel Cc: stable@kernel.org commit 3580d0b29cab08483f84a16ce6a1151a1013695f Author: Andy Lutomirski Date: Thu Nov 21 11:50:12 2019 +0100 x86/doublefault/32: Fix stack canaries in the double fault handler The double fault TSS was missing GS setup, which is needed for stack canaries to work. Signed-off-by: Andy Lutomirski Signed-off-by: Peter Zijlstra (Intel) Cc: stable@kernel.org commit 03bf73c315edca28f47451913177e14cd040a216 Author: Navid Emamdoost Date: Mon Sep 23 15:09:58 2019 -0500 nbd: prevent memory leak In nbd_add_socket when krealloc succeeds, if nsock's allocation fail the reallocted memory is leak. The correct behaviour should be assigning the reallocted memory to config->socks right after success. Reviewed-by: Josef Bacik Signed-off-by: Navid Emamdoost Signed-off-by: Jens Axboe commit 8cf9b615653e40debdcf3b6f1d69e6b580d71173 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:39:44 2019 +0800 rpmsg: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133945.13938-1-krzk@kernel.org Signed-off-by: Bjorn Andersson commit 866ca95da5e5c4fad59f1b08254168284bd6a911 Merge: ad512f2023b3 6c6aa2f26c68 Author: Jens Axboe Date: Thu Nov 21 10:53:47 2019 -0700 Merge branch 'nvme-5.5' of git://git.infradead.org/nvme into for-5.5/drivers-post Pull NVMe changes from Keith: "- The only new feature is the optional hwmon support for nvme (Guenter and Akinobu) - A universal work-around for controllers reading discard payloads beyond the range boundary (Eduard) - Chaitanya graciously agreed to share the target driver maintenance" * 'nvme-5.5' of git://git.infradead.org/nvme: nvme: hwmon: add quirk to avoid changing temperature threshold nvme: hwmon: provide temperature min and max values for each sensor nvmet: add another maintainer nvme: Discard workaround for non-conformant devices nvme: Add hardware monitoring support commit 7f264dab5b60343358e788d4c939c166c22ea4a2 Author: Davidlohr Bueso Date: Wed Nov 20 17:16:01 2019 -0800 x86/mm/pat: Rename pat_rbtree.c to pat_interval.c Considering the previous changes, this is a more proper name. Signed-off-by: Davidlohr Bueso Cc: Peter Zijlstra Cc: Borislav Petkov Cc: Linus Torvalds Link: https://lkml.kernel.org/r/20191121011601.20611-5-dave@stgolabs.net Signed-off-by: Ingo Molnar commit 511aaca834fe2dc0b652406bda6283842fdc70ce Author: Davidlohr Bueso Date: Wed Nov 20 17:16:00 2019 -0800 x86/mm/pat: Drop the rbt_ prefix from external memtype calls Drop the rbt_memtype_*() call rbt_ prefix, as we no longer use an rbtree directly. Signed-off-by: Davidlohr Bueso Reviewed-by: Thomas Gleixner Cc: Peter Zijlstra Cc: Borislav Petkov Cc: Linus Torvalds Link: https://lkml.kernel.org/r/20191121011601.20611-4-dave@stgolabs.net Signed-off-by: Ingo Molnar commit 6a9930b1c50d83facfa0f78e4f2f9ba0364f43f3 Author: Davidlohr Bueso Date: Wed Nov 20 17:15:59 2019 -0800 x86/mm/pat: Do not pass 'rb_root' down the memtype tree helper functions Get rid of the passing the rb_root down the helper calls; there is only one: &memtype_rbroot. No change in functionality. [ mingo: Fixed the changelog which described a different version of the patch. ] Signed-off-by: Davidlohr Bueso Reviewed-by: Thomas Gleixner Cc: Peter Zijlstra Cc: Borislav Petkov Cc: Linus Torvalds Link: https://lkml.kernel.org/r/20191121011601.20611-3-dave@stgolabs.net Signed-off-by: Ingo Molnar commit 8d04a5f97a5fa9d7afdf46eda3a5ceaa973a1bcc Author: Davidlohr Bueso Date: Wed Nov 20 17:15:58 2019 -0800 x86/mm/pat: Convert the PAT tree to a generic interval tree With some considerations, the custom pat_rbtree implementation can be simplified to use most of the generic interval_tree machinery: - The tree inorder traversal can slightly differ when there are key ('start') collisions in the tree due to one going left and another right. This, however, only affects the output of debugfs' pat_memtype_list file. - Generic interval trees are now fully closed [a, b], for which we need to adjust the last endpoint (ie: end - 1). - Erasing logic must remain untouched as well. - In order for the types to remain u64, the 'memtype_interval' calls are introduced, as opposed to simply using struct interval_tree. In addition, the PAT tree might potentially also benefit by the fast overlap detection for the insertion case when looking up the first overlapping node in the tree. No change in behavior is intended. Finally, I've tested this on various servers, via sanity warnings, running side by side with the current version and so far see no differences in the returned pointer node when doing memtype_rb_lowest_match() lookups. Signed-off-by: Davidlohr Bueso Reviewed-by: Thomas Gleixner Cc: Peter Zijlstra Cc: Borislav Petkov Cc: Linus Torvalds Link: https://lkml.kernel.org/r/20191121011601.20611-2-dave@stgolabs.net Signed-off-by: Ingo Molnar commit 1250ed7114a977cdc2a67a0c09d6cdda63970eb9 Author: Fabrice Gasnier Date: Thu Nov 21 09:10:49 2019 +0100 serial: stm32: fix clearing interrupt error flags The interrupt clear flag register is a "write 1 to clear" register. So, only writing ones allows to clear flags: - Replace buggy stm32_clr_bits() by a simple write to clear error flags - Replace useless read/modify/write stm32_set_bits() routine by a simple write to clear TC (transfer complete) flag. Fixes: 4f01d833fdcd ("serial: stm32: fix rx error handling") Signed-off-by: Fabrice Gasnier Cc: stable Link: https://lore.kernel.org/r/1574323849-1909-1-git-send-email-fabrice.gasnier@st.com Signed-off-by: Greg Kroah-Hartman commit 6c6aa2f26c6813af38d88718881c0307bb9a54c0 Author: Akinobu Mita Date: Fri Nov 15 00:40:01 2019 +0900 nvme: hwmon: add quirk to avoid changing temperature threshold This adds a new quirk NVME_QUIRK_NO_TEMP_THRESH_CHANGE to avoid changing the value of the temperature threshold feature for specific devices that show undesirable behavior. Guenter reported: "On my Intel NVME drive (SSDPEKKW512G7), writing any minimum limit on the Composite temperature sensor results in a temperature warning, and that warning is sticky until I reset the controller. It doesn't seem to matter which temperature I write; writing -273000 has the same result." The Intel NVMe has the latest firmware version installed, so this isn't a problem that was ever fixed. Reported-by: Guenter Roeck Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Jean Delvare Reviewed-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Akinobu Mita Signed-off-by: Keith Busch commit 52deba0f02a98c150677a9c381cc1991a928bcff Author: Akinobu Mita Date: Fri Nov 15 00:40:00 2019 +0900 nvme: hwmon: provide temperature min and max values for each sensor According to the NVMe specification, the over temperature threshold and under temperature threshold features shall be implemented for Composite Temperature if a non-zero WCTEMP field value is reported in the Identify Controller data structure. The features are also implemented for all implemented temperature sensors (i.e., all Temperature Sensor fields that report a non-zero value). This provides the over temperature threshold and under temperature threshold for each sensor as temperature min and max values of hwmon sysfs attributes. The WCTEMP is already provided as a temperature max value for Composite Temperature, but this change isn't incompatible. Because the default value of the over temperature threshold for Composite Temperature is the WCTEMP. Now the alarm attribute for Composite Temperature indicates one of the temperature is outside of a temperature threshold. Because there is only a single bit in Critical Warning field that indicates a temperature is outside of a threshold. Example output from the "sensors" command: nvme-pci-0100 Adapter: PCI adapter Composite: +33.9°C (low = -273.1°C, high = +69.8°C) (crit = +79.8°C) Sensor 1: +34.9°C (low = -273.1°C, high = +65261.8°C) Sensor 2: +31.9°C (low = -273.1°C, high = +65261.8°C) Sensor 5: +47.9°C (low = -273.1°C, high = +65261.8°C) This also adds helper macros for kelvin from/to milli Celsius conversion, and replaces the repeated code in hwmon.c. Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Jean Delvare Reviewed-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Akinobu Mita Signed-off-by: Keith Busch commit 3aeb6a24f171f0000c81117b4b8b2ac2858b2f27 Author: Christoph Hellwig Date: Sat Nov 16 18:50:38 2019 +0100 nvmet: add another maintainer Sagi and I have been pretty busy lately, and Chaitanya has been helping a lot with target work and agreed to share the load. Signed-off-by: Christoph Hellwig Signed-off-by: Keith Busch commit 91a9f2d3f9762e59cca251d2c6cef8cda1a4e62b Author: Chunfeng Yun Date: Wed Nov 20 14:43:03 2019 +0800 usb: gadget: udc: gr_udc: create debugfs directory under usb root Now the USB gadget subsystem can use the USB debugfs root directory, so move it's directory from the root of the debugfs filesystem into the root of usb Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1574232183-5760-3-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit f5b7f7c838216826072c92c8a26aeb2707d707a8 Author: Chunfeng Yun Date: Wed Nov 20 14:43:02 2019 +0800 usb: gadget: atmel: create debugfs directory under usb root Now the USB gadget subsystem can use the USB debugfs root directory, so move it's directory from the root of the debugfs filesystem into the root of usb Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1574232183-5760-2-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit d4836b69d9352ffbf2a2fea9735b0c7f3388a579 Author: Chunfeng Yun Date: Wed Nov 20 14:43:01 2019 +0800 usb: musb: create debugfs directory under usb root Now the USB gadget subsystem can use the USB debugfs root directory, so move musb's directory from the root of the debugfs filesystem into the root of usb Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1574232183-5760-1-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 1e279153dfd53e76006720df804d5935a6cbc6d5 Author: Jens Axboe Date: Thu Nov 21 10:16:12 2019 -0700 Revert "block: split bio if the only bvec's length is > SZ_4K" We really don't need this, as the slow path will do the right thing anyway. This reverts commit 6952a7f8446ee85ea9d10ab87b64797a031eaae3. Signed-off-by: Jens Axboe commit 3d581b11e34a92350983e5d3ecf469b5c677e295 Author: Frederick Lawler Date: Sun Nov 17 18:35:13 2019 -0600 drm/radeon: Prefer pcie_capability_read_word() Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability") added accessors for the PCI Express Capability so that drivers didn't need to be aware of differences between v1 and v2 of the PCI Express Capability. Replace pci_read_config_word() and pci_write_config_word() calls with pcie_capability_read_word() and pcie_capability_write_word(). Link: https://lore.kernel.org/r/20191118003513.10852-1-fred@fredlawl.com Signed-off-by: Frederick Lawler Signed-off-by: Bjorn Helgaas Reviewed-by: Alex Deucher commit ca56f99c18cafdeae6961ce9d87fc978506152ca Author: Bjorn Helgaas Date: Thu Nov 21 07:24:24 2019 -0600 drm/radeon: Replace numbers with PCI_EXP_LNKCTL2 definitions Replace hard-coded magic numbers with the descriptive PCI_EXP_LNKCTL2 definitions. No functional change intended. Link: https://lore.kernel.org/r/20191112173503.176611-4-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Alex Deucher commit 40bd4be5a652ce56068a8273b68caa38cb0d8f4b Author: Bjorn Helgaas Date: Wed Nov 20 17:54:13 2019 -0600 drm/radeon: Correct Transmit Margin masks Previously we masked PCIe Link Control 2 register values with "7 << 9", which was apparently intended to be the Transmit Margin field, but instead was the high order bit of Transmit Margin, the Enter Modified Compliance bit, and the Compliance SOS bit. Correct the mask to "7 << 7", which is the Transmit Margin field. Link: https://lore.kernel.org/r/20191112173503.176611-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Alex Deucher commit 88027c89ea146e32485251f1c2dddcde43c8d04e Author: Frederick Lawler Date: Sun Nov 17 18:35:13 2019 -0600 drm/amdgpu: Prefer pcie_capability_read_word() Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability") added accessors for the PCI Express Capability so that drivers didn't need to be aware of differences between v1 and v2 of the PCI Express Capability. Replace pci_read_config_word() and pci_write_config_word() calls with pcie_capability_read_word() and pcie_capability_write_word(). [bhelgaas: fix a couple remaining instances in cik.c] Link: https://lore.kernel.org/r/20191118003513.10852-1-fred@fredlawl.com Signed-off-by: Frederick Lawler Signed-off-by: Bjorn Helgaas Reviewed-by: Alex Deucher commit a7ba70f1787f977f970cd116076c6fce4b9e01cc Author: Nicolas Saenz Julienne Date: Thu Nov 21 10:26:44 2019 +0100 dma-mapping: treat dev->bus_dma_mask as a DMA limit Using a mask to represent bus DMA constraints has a set of limitations. The biggest one being it can only hold a power of two (minus one). The DMA mapping code is already aware of this and treats dev->bus_dma_mask as a limit. This quirk is already used by some architectures although still rare. With the introduction of the Raspberry Pi 4 we've found a new contender for the use of bus DMA limits, as its PCIe bus can only address the lower 3GB of memory (of a total of 4GB). This is impossible to represent with a mask. To make things worse the device-tree code rounds non power of two bus DMA limits to the next power of two, which is unacceptable in this case. In the light of this, rename dev->bus_dma_mask to dev->bus_dma_limit all over the tree and treat it as such. Note that dev->bus_dma_limit should contain the higher accessible DMA address. Signed-off-by: Nicolas Saenz Julienne Reviewed-by: Robin Murphy Signed-off-by: Christoph Hellwig commit d7293f79caea45c50c0ab4294847e7af96501ced Merge: 68a33b179466 bff3b04460a8 Author: Christoph Hellwig Date: Thu Nov 21 18:13:03 2019 +0100 Merge branch 'for-next/zone-dma' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux into dma-mapping-for-next Pull in a stable branch from the arm64 tree that adds the zone_dma_bits variable to avoid creating hard to resolve conflicts with that addition. commit b78cda795ac83333293f1bfa3165572a47e550c2 Merge: 599ea01ce0b3 5feccddcf992 Author: Greg Kroah-Hartman Date: Thu Nov 21 17:35:28 2019 +0100 Merge tag 'misc-habanalabs-next-2019-11-21' of git://people.freedesktop.org/~gabbayo/linux into char-misc-next Oded writes: This tag contains the following changes for kernel 5.5: - MMU code improvements that includes: - Distinguish between "normal" unmapping and unmapping that is done as part of the tear-down of a user process. This improves performance of unmapping during reset of the device. - Add future ASIC support in generic MMU code. - Improve device reset code by adding more protection around accessing the device during the reset process. - Add new H/W queue type for future ASIC support - Add more information to be retrieved by users through INFO IOCTL: - clock rate - board name - reset counters - Small bug fixes and minor improvements to code. * tag 'misc-habanalabs-next-2019-11-21' of git://people.freedesktop.org/~gabbayo/linux: (31 commits) habanalabs: add more protection of device during reset habanalabs: flush EQ workers in hard reset habanalabs: make the reset code more consistent habanalabs: expose reset counters via existing INFO IOCTL habanalabs: make code more concise habanalabs: use defines for F/W files habanalabs: remove prints on successful device initialization habanalabs: remove unnecessary checks habanalabs: invalidate MMU cache only once habanalabs: skip VA block list update in reset flow habanalabs: optimize MMU unmap habanalabs: prevent read/write from/to the device during hard reset habanalabs: split MMU properties to PCI/DRAM habanalabs: re-factor MMU masks and documentation habanalabs: type specific MMU cache invalidation habanalabs: re-factor memory module code habanalabs: export uapi defines to user-space habanalabs: don't print error when queues are full habanalabs: increase max jobs number to 512 habanalabs: set ETR as non-secured ... commit 34376eb1b0840c916a9d0b703fb2efefb2f46fd6 Author: Arnaud Pouliquen Date: Thu Nov 21 10:52:25 2019 +0100 dt-bindings: remoteproc: convert stm32-rproc to json-schema Convert the STM32 remoteproc bindings to DT schema format using json-schema Signed-off-by: Arnaud Pouliquen [robh: Drop mbox-consumer.yaml reference] Signed-off-by: Rob Herring commit 4360bf7244839c6780e25160089104244e0a15c3 Author: Arnaud Pouliquen Date: Thu Nov 21 10:51:02 2019 +0100 dt-bindings: mailbox: convert stm32-ipcc to json-schema Convert the STM32 IPCC bindings to DT schema format using json-schema Signed-off-by: Arnaud Pouliquen Signed-off-by: Rob Herring commit 4b1140ade8f5c1ced640286cce79371ade2bd2d1 Author: Kunihiko Hayashi Date: Thu Nov 7 13:58:14 2019 +0900 PCI: uniphier: Set mode register to host mode Set the mode register to host(RC) mode so that the host controller mode is set-up consistently across SoCs. Signed-off-by: Kunihiko Hayashi [lorenzo.pieralisi@arm.com: updated log] Signed-off-by: Lorenzo Pieralisi Reviewed-by: Andrew Murray commit b6866318657717c8914673a6394894d12bc9ff5e Author: Konstantin Khlebnikov Date: Thu Nov 21 13:40:26 2019 +0300 block: add iostat counters for flush requests Requests that triggers flushing volatile writeback cache to disk (barriers) have significant effect to overall performance. Block layer has sophisticated engine for combining several flush requests into one. But there is no statistics for actual flushes executed by disk. Requests which trigger flushes usually are barriers - zero-size writes. This patch adds two iostat counters into /sys/class/block/$dev/stat and /proc/diskstats - count of completed flush requests and their total time. Signed-off-by: Konstantin Khlebnikov Signed-off-by: Jens Axboe commit ddb52945999dcf35787bf221b62108806182578d Author: Tony Lindgren Date: Tue Nov 19 19:50:30 2019 -0800 ARM: dts: Fix vcsi regulator to be always-on for droid4 to prevent hangs In addition to using vcsi regulator for the display, looks like droid4 is using vcsi regulator to trigger off mode internally with the PMIC firmware when the SoC enters deeper idle states. This is configured in the Motorola Mapphone Linux kernel sources as "zerov_regulator". As we currently don't support off mode during idle for omap4, we must prevent vcsi from being disabled when the display is blanked to prevent the PMIC change to off mode. Otherwise the device will hang on entering idle when the display is blanked. Before commit 089b3f61ecfc ("regulator: core: Let boot-on regulators be powered off"), the boot-on regulators never got disabled like they should and vcsi did not get turned off on idle. Let's fix the issue by setting vcsi to always-on for now. Later on we may want to claim the vcsi regulator also in the PM code if needed. Fixes: 089b3f61ecfc ("regulator: core: Let boot-on regulators be powered off") Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Signed-off-by: Tony Lindgren commit b88091f5d84a5a5bf9c0583c693373ab8a2ee425 Author: Benjamin Gaignard Date: Mon Nov 18 10:48:42 2019 +0100 dt-bindings: mfd: Convert stm32 low power timers bindings to json-schema Convert the STM32 low power timers binding to DT schema format using json-schema Signed-off-by: Benjamin Gaignard Signed-off-by: Rob Herring commit b9da2fcc5ed97136e94a6d96b7ac0f18d832618f Author: Alexandre Torgue Date: Fri Nov 15 19:12:39 2019 +0100 dt-bindings: interrupt-controller: Convert stm32-exti to json-schema Convert the STM32 external interrupt controller (EXTI) binding to DT schema format using json-schema. Signed-off-by: Alexandre Torgue Signed-off-by: Rob Herring commit ceced4acb01ab73b941f940061a2be4cdcfa2468 Author: Benjamin Gaignard Date: Fri Nov 15 11:24:27 2019 +0100 dt-bindings: crypto: Convert stm32 HASH bindings to json-schema Convert the STM32 HASH binding to DT schema format using json-schema Signed-off-by: Benjamin Gaignard Signed-off-by: Rob Herring commit 5059791efc73a628fcda8d0dec79d98a8a66c454 Author: Benjamin Gaignard Date: Fri Nov 15 11:08:54 2019 +0100 dt-bindings: rng: Convert stm32 RNG bindings to json-schema Convert the STM32 RNG binding to DT schema format using json-schema Remove interrupt from the json-schema because it is not used by the driver. Signed-off-by: Benjamin Gaignard Signed-off-by: Rob Herring commit 1c11ca7a0584ddede5b8c93057b40d31e8a96d3d Author: Arnd Bergmann Date: Thu Nov 21 15:19:49 2019 +0100 y2038: fix typo in powerpc vdso "LOPART" The earlier patch introduced a typo, change LOWPART back to LOPART. Fixes: 176ed98c8a76 ("y2038: vdso: powerpc: avoid timespec references") Reported-by: Ben Hutchings Signed-off-by: Arnd Bergmann commit ae75b53e08b95cd189879b00f6a47cbdaab1f0eb Author: Paul Cercueil Date: Tue Nov 19 16:52:11 2019 +0100 pinctrl: ingenic: Add OTG VBUS pin for the JZ4770 Add pin mux configuration for the OTG VBUS pin of the JZ4770. Signed-off-by: Paul Cercueil Link: https://lore.kernel.org/r/20191119155211.102527-2-paul@crapouillou.net Signed-off-by: Linus Walleij commit 7009d046a60116a4066ee2c9b005b43f0972c9b2 Author: Paul Cercueil Date: Tue Nov 19 16:52:10 2019 +0100 pinctrl: ingenic: Handle PIN_CONFIG_OUTPUT config This makes the driver support the 'output-low' and 'output-high' devicetree properties in gpio-hog sub-nodes. Signed-off-by: Paul Cercueil Link: https://lore.kernel.org/r/20191119155211.102527-1-paul@crapouillou.net Signed-off-by: Linus Walleij commit 2635adb48bd517343a163ccc1f7ee126eb24bd90 Author: Krzysztof Kozlowski Date: Thu Nov 21 04:19:41 2019 +0100 pinctrl: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/1574306382-32516-1-git-send-email-krzk@kernel.org Signed-off-by: Linus Walleij commit e66ff71fd0dba36a53f91f39e4da6c7b84764f2e Author: Andy Shevchenko Date: Wed Nov 20 15:37:39 2019 +0200 pinctrl: lewisburg: Update pin list according to v1.1v6 Version 1.1v6 of pin list has some changes in pin names for Intel Lewisburg. Update the driver accordingly. Note, it reveals the bug in the driver that misses two pins in GPP_L and has rather two extra ones. That's why the ordering of some groups is changed. Fixes: e480b745386e ("pinctrl: intel: Add Intel Lewisburg GPIO support") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191120133739.54332-1-andriy.shevchenko@linux.intel.com Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit e272f7ec070d212b9301d5a465bc8952f8dcf908 Author: Andy Shevchenko Date: Mon Nov 18 20:02:51 2019 +0200 gpio: lynxpoint: Setup correct IRQ handlers When commit 75e99bf5ed8f ("gpio: lynxpoint: set default handler to be handle_bad_irq()") switched default handler to be handle_bad_irq() the lp_irq_type() function remained untouched. It means that even request_irq() can't change the handler and we are not able to handle IRQs properly anymore. Fix it by setting correct handlers in the lp_irq_type() callback. Fixes: 75e99bf5ed8f ("gpio: lynxpoint: set default handler to be handle_bad_irq()") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191118180251.31439-1-andriy.shevchenko@linux.intel.com Signed-off-by: Linus Walleij commit 3d2dcd946b3aeac078fd1baf42c7a10312cd9254 Author: Andy Shevchenko Date: Mon Nov 18 15:52:58 2019 +0200 MAINTAINERS: Replace my email by one @kernel.org For the repositories we keep on git.kernel.org replace my email to be on the same domain for sake of consistency. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191118135258.37574-1-andriy.shevchenko@linux.intel.com Signed-off-by: Linus Walleij commit 20e5a163b8df0e1fc02c574008e3a6e0d21849bc Author: Andy Shevchenko Date: Mon Nov 18 15:49:26 2019 +0200 MAINTAINERS: Replace my email by one @kernel.org For the repositories we keep on git.kernel.org replace my email to be on the same domain for sake of consistency. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191118134926.37337-1-andriy.shevchenko@linux.intel.com Signed-off-by: Linus Walleij commit 04fb02757ae5188031eb71b2f6f189edb1caf5dc Author: Gregory CLEMENT Date: Fri Nov 15 16:57:52 2019 +0100 pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type() As explained in the following commit a9a1a4833613 ("pinctrl: armada-37xx: Fix gpio interrupt setup") the armada_37xx_irq_set_type() function can be called before the initialization of the mask field. That means that we can't use this field in this function and need to workaround it using hwirq. Fixes: 30ac0d3b0702 ("pinctrl: armada-37xx: Add edge both type gpio irq support") Cc: stable@vger.kernel.org Reported-by: Russell King Signed-off-by: Gregory CLEMENT Link: https://lore.kernel.org/r/20191115155752.2562-1-gregory.clement@bootlin.com Signed-off-by: Linus Walleij commit 98dcf14d7f9c9482144b9015d481bf6b63bce965 Author: Adrian Hunter Date: Fri Nov 15 14:42:11 2019 +0200 perf tools: Add kernel AUX area sampling definitions Add kernel AUX area sampling definitions, which brings perf_event.h into line with the kernel version. New sample type PERF_SAMPLE_AUX requests a sample of the AUX area buffer. New perf_event_attr member 'aux_sample_size' specifies the desired size of the sample. Also add support for parsing samples containing AUX area data i.e. PERF_SAMPLE_AUX. Committer notes: I squashed the first two patches in this series to avoid breaking automatic bisection, i.e. after applying only the original first patch in this series we would have: # perf test -v parsing 26: Sample parsing : --- start --- test child forked, pid 17018 sample format has changed, some new PERF_SAMPLE_ bit was introduced - test needs updating test child finished with -1 ---- end ---- Sample parsing: FAILED! # With the two paches combined: # perf test parsing 26: Sample parsing : Ok # Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191115124225.5247-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 35e768e296729ac96a8c33b7810b6cb1673ae961 Author: Bjorn Helgaas Date: Thu Nov 21 07:23:41 2019 -0600 drm/amdgpu: Replace numbers with PCI_EXP_LNKCTL2 definitions Replace hard-coded magic numbers with the descriptive PCI_EXP_LNKCTL2 definitions. No functional change intended. Link: https://lore.kernel.org/r/20191112173503.176611-4-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Alex Deucher commit 19d7a95a8ba66b198f759cf610cc935ce9840d5b Author: Bjorn Helgaas Date: Wed Nov 20 17:52:48 2019 -0600 drm/amdgpu: Correct Transmit Margin masks Previously we masked PCIe Link Control 2 register values with "7 << 9", which was apparently intended to be the Transmit Margin field, but instead was the high order bit of Transmit Margin, the Enter Modified Compliance bit, and the Compliance SOS bit. Correct the mask to "7 << 7", which is the Transmit Margin field. Link: https://lore.kernel.org/r/20191112173503.176611-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Alex Deucher commit bbdb2f5ecdf1e66b2f09710134db3c2e5c43a958 Author: Bjorn Helgaas Date: Tue Nov 12 11:07:36 2019 -0600 PCI: Add #defines for Enter Compliance, Transmit Margin Add definitions for the Enter Compliance and Transmit Margin fields of the PCIe Link Control 2 register. Link: https://lore.kernel.org/r/20191112173503.176611-2-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Alex Deucher commit b7da3d4df05232d637eff1c0874d20996b98769c Author: Bjorn Helgaas Date: Wed Nov 6 16:13:43 2019 -0600 PCI: Allow building PCIe things without PCIEPORTBUS Some things in drivers/pci/pcie (aspm.c and ptm.c) do not depend on the PCIe portdrv, so we should be able to build them even if PCIEPORTBUS is not selected. Remove the PCIEPORTBUS guard from building pcie/. Link: https://lore.kernel.org/r/20191106222420.10216-6-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Andrew Murray commit b6479581e6823239c3e03b1d006f160c6c491ba0 Author: Bjorn Helgaas Date: Wed Nov 6 16:09:40 2019 -0600 PCI: Remove PCIe Kconfig dependencies on PCI drivers/pci/pcie/Kconfig is only sourced by drivers/pci/Kconfig, and only when PCI is defined, so there's no need to depend on PCI again. Remove the unnecessary dependencies. Link: https://lore.kernel.org/r/20191106222420.10216-5-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Andrew Murray commit 33ce09ef17329be407fc238a214d6f49fdc8a007 Author: Bjorn Helgaas Date: Wed Nov 6 16:07:36 2019 -0600 PCI/ASPM: Remove dependency on PCIEPORTBUS The ASPM support does not depend on the portdrv, so remove the Kconfig dependency. Link: https://lore.kernel.org/r/20191106222420.10216-4-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Andrew Murray commit 97a0ac8a4678fb6340f6b2646e7c46e9c2872e02 Author: Bjorn Helgaas Date: Wed Nov 6 16:01:15 2019 -0600 PCI/PTM: Remove dependency on PCIEPORTBUS The PTM support does not depend on the portdrv, so remove the Kconfig dependency. Link: https://lore.kernel.org/r/20191106222420.10216-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Andrew Murray Cc: Jonathan Yong commit 127a7709495db52a41012deaebbb7afc231dad91 Author: Bjorn Helgaas Date: Wed Nov 6 15:30:48 2019 -0600 PCI/PTM: Remove spurious "d" from granularity message The granularity message has an extra "d": pci 0000:02:00.0: PTM enabled, 4dns granularity Remove the "d" so the message is simply "PTM enabled, 4ns granularity". Fixes: 8b2ec318eece ("PCI: Add PTM clock granularity information") Link: https://lore.kernel.org/r/20191106222420.10216-2-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Andrew Murray Cc: Jonathan Yong commit ca22d1f5474a7278d317bb86296723e9e563c44d Author: Ben Dooks Date: Wed Oct 16 09:03:24 2019 +0100 PCI: sysfs: Remove unused attribute groups 56c1af4606f0 ("PCI: Add sysfs max_link_speed/width, current_link_speed/width, etc") added the following objects, but they are unused, so remove them: pci_bridge_group pci_bridge_groups pcie_dev_group pcie_dev_groups This fixes the following warnings from sparse: drivers/pci/pci-sysfs.c:1546:30: warning: symbol 'pci_bridge_groups' was not declared. Should it be static? drivers/pci/pci-sysfs.c:1555:30: warning: symbol 'pcie_dev_groups' was not declared. Should it be static? Link: https://lore.kernel.org/r/20191016080324.12864-1-ben.dooks@codethink.co.uk Signed-off-by: Ben Dooks Signed-off-by: Bjorn Helgaas commit 7e8ce0e2b036dbc6617184317983aea4f2c52099 Author: Kai-Heng Feng Date: Mon Sep 2 22:52:52 2019 +0800 x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect The AMD FCH USB XHCI Controller advertises support for generating PME# while in D0. When in D0, it does signal PME# for USB 3.0 connect events, but not for USB 2.0 or USB 1.1 connect events, which means the controller doesn't wake correctly for those events. 00:10.0 USB controller [0c03]: Advanced Micro Devices, Inc. [AMD] FCH USB XHCI Controller [1022:7914] (rev 20) (prog-if 30 [XHCI]) Subsystem: Dell FCH USB XHCI Controller [1028:087e] Capabilities: [50] Power Management version 3 Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+) Clear PCI_PM_CAP_PME_D0 in dev->pme_support to indicate the device will not assert PME# from D0 so we don't rely on it. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203673 Link: https://lore.kernel.org/r/20190902145252.32111-1-kai.heng.feng@canonical.com Signed-off-by: Kai-Heng Feng Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org commit bbd8810d399812f2016713565e4d8ff8f1508aa6 Author: Krzysztof Wilczynski Date: Tue Sep 3 13:30:59 2019 +0200 PCI: Remove unused includes and superfluous struct declaration Remove and from being included directly as part of the include/linux/of_pci.h, and remove superfluous declaration of struct of_phandle_args. Move users of include to include and directly rather than rely on both being included transitively through . Link: https://lore.kernel.org/r/20190903113059.2901-1-kw@linux.com Signed-off-by: Krzysztof Wilczynski Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring commit 0d2f4d62ff4164df5611df53ae5546421d40cfb4 Author: Krzysztof Wilczynski Date: Mon Aug 19 08:05:32 2019 +0200 x86/PCI: Replace deprecated EXTRA_CFLAGS with ccflags-y Update arch/x86/pci/Makefile replacing the deprecated EXTRA_CFLAGS with the ccflags-y matching recommendation per section 3.7 of Documentation/kbuild/makefiles.txt. Link: https://lore.kernel.org/r/20190819060532.17093-1-kw@linux.com Signed-off-by: Krzysztof Wilczynski Signed-off-by: Bjorn Helgaas commit 65e3c803e7a49bea983c63d145e15bdb274faf27 Author: Krzysztof Wilczynski Date: Wed Aug 28 15:53:22 2019 +0200 x86/PCI: Correct SPDX comment style Change: drivers/pci/controller/pcie-cadence.h drivers/pci/controller/pcie-rockchip.h to use the correct SPDX comment style per section 2 of Documentation/process/license-rules.rst. These resolve the following checkpatch.pl warning: WARNING: Missing or malformed SPDX-License-Identifier tag in line 1 [bhelgaas: split to separate patch] Link: https://lore.kernel.org/r/20190828135322.10370-1-kw@linux.com Signed-off-by: Krzysztof Wilczynski Signed-off-by: Bjorn Helgaas commit 4257ac5acdee880ed2251278199b3569dfa3dc49 Author: Krzysztof Wilczynski Date: Mon Sep 30 17:48:09 2019 -0500 x86/PCI: Add NumaChip SPDX GPL-2.0 to replace COPYING boilerplate Add SPDX GPL-2.0 to numachip.c, which referred to the kernel default "COPYING" file, which specifies GPL version 2. Remove the boilerplate language referring to the GPL and "COPYING", relying on the assertion in b24413180f56 ("License cleanup: add SPDX GPL-2.0 license identifier to files with no license") that the SPDX identifier may be used instead of the full boilerplate text. [bhelgaas: split to separate patch] Link: https://lore.kernel.org/r/20190828135322.10370-1-kw@linux.com Signed-off-by: Krzysztof Wilczynski Signed-off-by: Bjorn Helgaas commit 3fab296a98c939c85837c8a7a16c9c56cb9959cb Author: Rahul Tanwar Date: Fri Nov 15 17:25:08 2019 +0800 dt-bindings: pinctrl: intel: Add for new SoC Add dt bindings document for pinmux & GPIO controller driver of Intel Lightning Mountain SoC. Signed-off-by: Rahul Tanwar Link: https://lore.kernel.org/r/b59afc497e41404fea06aa48d633cba183ee944d.1573797249.git.rahul.tanwar@linux.intel.com Signed-off-by: Linus Walleij commit 1948d5c51dba4e4e2652a5687991a6460d78b5d0 Author: Rahul Tanwar Date: Fri Nov 15 17:25:07 2019 +0800 pinctrl: Add pinmux & GPIO controller driver for a new SoC Intel Lightning Mountain SoC has a pinmux controller & GPIO controller IP which controls pin multiplexing & configuration including GPIO functions selection & GPIO attributes configuration. This IP is not based on & does not have anything in common with Chassis specification. The pinctrl drivers under pinctrl/intel/* are all based upon Chassis spec compliant pinctrl IPs. So this driver doesn't fit & can not use pinctrl framework under pinctrl/intel/* and it requires a separate new driver. Add a new GPIO & pin control framework based driver for this IP. Signed-off-by: Rahul Tanwar Link: https://lore.kernel.org/r/33e649758b70490f01724a887c490d5008c7656d.1573797249.git.rahul.tanwar@linux.intel.com Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 0b2c26fb1144a671d462195d4514a0453f55ebd1 Author: Krzysztof Kozlowski Date: Thu Nov 21 21:28:56 2019 +0800 usb: serial: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191121132856.29130-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6aad39f63949901de57f4c78aa3da79625df4bad Author: Krzysztof Kozlowski Date: Thu Nov 21 21:29:01 2019 +0800 usb: misc: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191121132901.29186-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit b14f8b90341bb3258e536914ad0b1ad1a076233f Author: Krzysztof Kozlowski Date: Thu Nov 21 21:29:05 2019 +0800 usb: gadget: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191121132905.29248-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2f8b6e9a2b5ee23e5a14eed6a294f05dc669757b Author: Krzysztof Kozlowski Date: Thu Nov 21 21:29:10 2019 +0800 usb: host: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191121132910.29310-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit c3afa22243453d7a09694bd2975074a8db53d4bc Author: Krzysztof Kozlowski Date: Thu Nov 21 21:29:14 2019 +0800 usb: dwc3: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191121132914.29368-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit da88ac0bd683c13a80b2e55939f2465a25d7cdd4 Author: Krzysztof Kozlowski Date: Thu Nov 21 21:28:47 2019 +0800 tty: Fix Kconfig indentation, continued Adjust indentation from seven spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191121132847.29015-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit 599ea01ce0b322cc3eba5b2ce67bb9972edfeb52 Author: Krzysztof Kozlowski Date: Thu Nov 21 21:28:41 2019 +0800 char: Fix Kconfig indentation, continued Adjust indentation from seven spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191121132842.28942-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit d4fc46f1739d2e1a5c2a92a7b3e65f2426c9e9b5 Author: Hans de Goede Date: Thu Nov 14 11:26:00 2019 +0100 gpiolib: acpi: Make acpi_gpiochip_alloc_event always return AE_OK acpi_gpiochip_alloc_event is used to loop over all _AEI resources, if we fail to bind an event handler to one of them, that is not a reason to not try the other resources. This commit modifies acpi_gpiochip_alloc_event to always return AE_OK, so that we will always try to add an event handler for all _AEI resources. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20191114102600.34558-2-hdegoede@redhat.com Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 54787d7c14a4a324d746499a7bed8de6866010c9 Author: Matti Vaittinen Date: Wed Nov 13 09:10:45 2019 +0200 pinctrl: rza1: remove unnecessary static inline function Having static inline oneliner does not benefit too much when it is only called from another oneliner function. Remove some of the 'onion'. This simplifies also the coming usage of the gpiolib defines. We can do conversion from chip bits to gpiolib direction defines as last step in the get_direction callback. Drivers can use chip specific values in driver internal functions and do conversion only once. Signed-off-by: Matti Vaittinen Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20191113071045.GA22110@localhost.localdomain Signed-off-by: Linus Walleij commit 787b64a43f7acacf8099329ea08872e663f1e74f Author: Russell King Date: Tue Nov 19 13:10:38 2019 +0000 gpio/mpc8xxx: fix qoriq GPIO reading Qoriq requires the IBE register to be set to enable GPIO inputs to be read. Set it. Signed-off-by: Russell King Link: https://lore.kernel.org/r/E1iX3HC-00069N-0T@rmk-PC.armlinux.org.uk Signed-off-by: Linus Walleij commit 4250b047039d324e0ff65267c8beb5bad5052a86 Author: Kusanagi Kouichi Date: Thu Nov 21 19:20:21 2019 +0900 debugfs: Fix !DEBUG_FS debugfs_create_automount If DEBUG_FS=n, compile fails with the following error: kernel/trace/trace.c: In function 'tracing_init_dentry': kernel/trace/trace.c:8658:9: error: passing argument 3 of 'debugfs_create_automount' from incompatible pointer type [-Werror=incompatible-pointer-types] 8658 | trace_automount, NULL); | ^~~~~~~~~~~~~~~ | | | struct vfsmount * (*)(struct dentry *, void *) In file included from kernel/trace/trace.c:24: ./include/linux/debugfs.h:206:25: note: expected 'struct vfsmount * (*)(void *)' but argument is of type 'struct vfsmount * (*)(struct dentry *, void *)' 206 | struct vfsmount *(*f)(void *), | ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~ Signed-off-by: Kusanagi Kouichi Link: https://lore.kernel.org/r/20191121102021787.MLMY.25002.ppp.dion.ne.jp@dmta0003.auone-net.jp Signed-off-by: Greg Kroah-Hartman commit 4e50573f39229d5e9c985fa3b4923a8b29619ade Author: Vladimir Oltean Date: Fri Nov 15 14:55:51 2019 +0200 gpio: mpc8xxx: Don't overwrite default irq_set_type callback The per-SoC devtype structures can contain their own callbacks that overwrite mpc8xxx_gpio_devtype_default. The clear intention is that mpc8xxx_irq_set_type is used in case the SoC does not specify a more specific callback. But what happens is that if the SoC doesn't specify one, its .irq_set_type is de-facto NULL, and this overwrites mpc8xxx_irq_set_type to a no-op. This means that the following SoCs are affected: - fsl,mpc8572-gpio - fsl,ls1028a-gpio - fsl,ls1088a-gpio On these boards, the irq_set_type does exactly nothing, and the GPIO controller keeps its GPICR register in the hardware-default state. On the LS1028A, that is ACTIVE_BOTH, which means 2 interrupts are raised even if the IRQ client requests LEVEL_HIGH. Another implication is that the IRQs are not checked (e.g. level-triggered interrupts are not rejected, although they are not supported). Fixes: 82e39b0d8566 ("gpio: mpc8xxx: handle differences between incarnations at a single place") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20191115125551.31061-1-olteanv@gmail.com Tested-by: Michael Walle Signed-off-by: Linus Walleij commit 5406327d43edd9a171bd260f49c752d148727eaf Author: Gayatri Kammela Date: Mon Nov 18 11:05:41 2019 -0800 platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support to intel_pmc_core driver Add Comet Lake to the list of the platforms that intel_pmc_core driver supports for pmc_core device. Just like Ice Lake, Comet Lake can also reuse all the Cannon Lake PCH IPs. No additional effort is needed to enable but to simply reuse them. Cc: Mario Limonciello Cc: Peter Zijlstra Cc: Srinivas Pandruvada Cc: Andy Shevchenko Cc: Kan Liang Cc: David E. Box Cc: Rajneesh Bhardwaj Cc: Tony Luck Signed-off-by: Gayatri Kammela Signed-off-by: Andy Shevchenko commit 43e82d8aa92503d264309fb648b251b2d85caf1a Author: Gayatri Kammela Date: Mon Nov 18 11:05:40 2019 -0800 platform/x86: intel_pmc_core: Fix the SoC naming inconsistency Intel's SoCs follow a naming convention which spells out the SoC name as two words instead of one word (E.g: Cannon Lake vs Cannonlake). Thus fix the naming inconsistency across the intel_pmc_core driver, so future SoCs can follow the naming consistency as below. Cometlake -> Comet Lake Tigerlake -> Tiger Lake Elkhartlake -> Elkhart Lake Cc: Mario Limonciello Cc: Peter Zijlstra Cc: Srinivas Pandruvada Cc: Andy Shevchenko Cc: Kan Liang Cc: David E. Box Cc: Rajneesh Bhardwaj Cc: Tony Luck Suggested-by: Andy Shevchenko Signed-off-by: Gayatri Kammela Signed-off-by: Andy Shevchenko commit e5caebdddc0572cd3aed9f859f4f7d1dcd808fbb Author: Krzysztof Kozlowski Date: Wed Nov 20 21:40:09 2019 +0800 platform/mellanox: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Andy Shevchenko commit 1434a3d357d656d4b11fcbdc9b6c35dc673292a0 Author: Srinivas Pandruvada Date: Tue Nov 19 16:22:54 2019 -0800 tools/power/x86/intel-speed-select: Display TRL buckets for just base config level When only base config level is present, this tool is displaying TRL (Turbo-ratio-limits) by reading legacy MSR. In this case, also present core count for TRL by reading MSR 0x1AE. Signed-off-by: Srinivas Pandruvada Signed-off-by: Andy Shevchenko commit 20183ccd3e4d01d23b0a01fe9f3ee73fbae312fa Author: Srinivas Pandruvada Date: Fri Nov 15 12:35:22 2019 -0800 tools/power/x86/intel-speed-select: Ignore missing config level It is possible that certain config levels are not available, even if the max level includes the level. There can be missing levels in some platforms. So ignore the level when called for information dump for all levels and fail if specifically ask for the missing level. Here the changes is to continue reading information about other levels even if we fail to get information for the current level. But use the "processed" flag to indicate the failure. When the "processed" flag is not set, don't dump information about that level. Signed-off-by: Srinivas Pandruvada Signed-off-by: Andy Shevchenko commit e149573b2f84d0517648dafc0db625afa681ed54 Author: Will Deacon Date: Wed Nov 20 19:00:28 2019 +0000 of: property: Add device link support for "iommu-map" Commit 8e12257dead7 ("of: property: Add device link support for iommus, mboxes and io-channels") added device link support for IOMMU linkages described using the "iommus" property. For PCI devices, this property is not present and instead the "iommu-map" property is used on the host bridge node to map the endpoint RequesterIDs to their corresponding IOMMU instance. Add support for "iommu-map" to the device link supplier bindings so that probing of PCI devices can be deferred until after the IOMMU is available. Cc: Rob Herring Cc: Robin Murphy Signed-off-by: Will Deacon Acked-by: Saravana Kannan Link: https://lore.kernel.org/r/20191120190028.4722-1-will@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3883539140b8ce67ad000938c3cd3b3e59498520 Author: Saravana Kannan Date: Wed Nov 20 00:02:29 2019 -0800 of: property: Fix the semantics of of_is_ancestor_of() The of_is_ancestor_of() function was renamed from of_link_is_valid() based on review feedback. The rename meant the semantics of the function had to be inverted, but this was missed in the earlier patch. So, fix the semantics of of_is_ancestor_of() and invert the conditional expressions where it is used. Fixes: a3e1d1a7f5fc ("of: property: Add functional dependency link from DT bindings") Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20191120080230.16007-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 478c60cea1c1e57f91d8c3f6dfe3d35784ea7eea Author: Wolfram Sang Date: Thu Nov 21 12:17:33 2019 +0100 Revert "mmc: tmio: remove workaround for NON_REMOVABLE" This reverts commit 7a7dab237027939cb95dc07c4647b80bad5fbbde. We found out that there is still a race with RuntimePM. This can lead to a hang when accessing the eMMC in some situations. Revert this change until the RPM issue is fixed. Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Signed-off-by: Ulf Hansson commit 1696d96890fcc567264fd7f66216e0087818bb70 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:41:01 2019 +0800 memstick: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit c50d8ae3a1274f32c9033bbb0e1c5b3115da2112 Author: Paolo Bonzini Date: Thu Nov 21 10:45:07 2019 +0100 KVM: x86: create mmu/ subdirectory Preparatory work for shattering mmu.c into multiple files. Besides making it easier to follow, this will also make it possible to write unit tests for various parts. Signed-off-by: Paolo Bonzini commit 0155b2b91b263248fb5dd01c238439d4ab3731c5 Author: Liran Alon Date: Wed Nov 20 16:33:07 2019 +0200 KVM: nVMX: Remove unnecessary TLB flushes on L1<->L2 switches when L1 use apic-access-page According to Intel SDM section 28.3.3.3/28.3.3.4 Guidelines for Use of the INVVPID/INVEPT Instruction, the hypervisor needs to execute INVVPID/INVEPT X in case CPU executes VMEntry with VPID/EPTP X and either: "Virtualize APIC accesses" VM-execution control was changed from 0 to 1, OR the value of apic_access_page was changed. In the nested case, the burden falls on L1, unless L0 enables EPT in vmcs02 but L1 enables neither EPT nor VPID in vmcs12. For this reason prepare_vmcs02() and load_vmcs12_host_state() have special code to request a TLB flush in case L1 does not use EPT but it uses "virtualize APIC accesses". This special case however is not necessary. On a nested vmentry the physical TLB will already be flushed except if all the following apply: * L0 uses VPID * L1 uses VPID * L0 can guarantee TLB entries populated while running L1 are tagged differently than TLB entries populated while running L2. If the first condition is false, the processor will flush the TLB on vmentry to L2. If the second or third condition are false, prepare_vmcs02() will request KVM_REQ_TLB_FLUSH. However, even if both are true, no extra TLB flush is needed to handle the APIC access page: * if L1 doesn't use VPID, the second condition doesn't hold and the TLB will be flushed anyway. * if L1 uses VPID, it has to flush the TLB itself with INVVPID and section 28.3.3.3 doesn't apply to L0. * even INVEPT is not needed because, if L0 uses EPT, it uses different EPTP when running L2 than L1 (because guest_mode is part of mmu-role). In this case SDM section 28.3.3.4 doesn't apply. Similarly, examining nested_vmx_vmexit()->load_vmcs12_host_state(), one could note that L0 won't flush TLB only in cases where SDM sections 28.3.3.3 and 28.3.3.4 don't apply. In particular, if L0 uses different VPIDs for L1 and L2 (i.e. vmx->vpid != vmx->nested.vpid02), section 28.3.3.3 doesn't apply. Thus, remove this flush from prepare_vmcs02() and nested_vmx_vmexit(). Side-note: This patch can be viewed as removing parts of commit fb6c81984313 ("kvm: vmx: Flush TLB when the APIC-access address changes”) that is not relevant anymore since commit 1313cc2bd8f6 ("kvm: mmu: Add guest_mode to kvm_mmu_page_role”). i.e. The first commit assumes that if L0 use EPT and L1 doesn’t use EPT, then L0 will use same EPTP for both L0 and L1. Which indeed required L0 to execute INVEPT before entering L2 guest. This assumption is not true anymore since when guest_mode was added to mmu-role. Reviewed-by: Joao Martins Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit db5a95ec166f3fd3eecbd07ebdf56986a3e9f43f Author: Mao Wenan Date: Tue Nov 19 11:06:40 2019 +0800 KVM: x86: remove set but not used variable 'called' Fixes gcc '-Wunused-but-set-variable' warning: arch/x86/kvm/x86.c: In function kvm_make_scan_ioapic_request_mask: arch/x86/kvm/x86.c:7911:7: warning: variable called set but not used [-Wunused-but-set-variable] It is not used since commit 7ee30bc132c6 ("KVM: x86: deliver KVM IOAPIC scan request to target vCPUs") Signed-off-by: Mao Wenan Fixes: 7ee30bc132c6 ("KVM: x86: deliver KVM IOAPIC scan request to target vCPUs") Signed-off-by: Paolo Bonzini commit b11494bcabba7383c9db65132f6f73d64fb1407d Author: Liran Alon Date: Thu Nov 21 00:31:47 2019 +0200 KVM: nVMX: Do not mark vmcs02->apic_access_page as dirty when unpinning vmcs->apic_access_page is simply a token that the hypervisor puts into the PFN of a 4KB EPTE (or PTE if using shadow-paging) that triggers APIC-access VMExit or APIC virtualization logic whenever a CPU running in VMX non-root mode read/write from/to this PFN. As every write either triggers an APIC-access VMExit or write is performed on vmcs->virtual_apic_page, the PFN pointed to by vmcs->apic_access_page should never actually be touched by CPU. Therefore, there is no need to mark vmcs02->apic_access_page as dirty after unpin it on L2->L1 emulated VMExit or when L1 exit VMX operation. Reviewed-by: Krish Sadhukhan Reviewed-by: Joao Martins Reviewed-by: Jim Mattson Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit 46f4f0aabc61bfd365e1eb3c8a6d766d1a49cf32 Merge: 14edff88315a b07a5c53d42a Author: Paolo Bonzini Date: Thu Nov 21 10:01:51 2019 +0100 Merge branch 'kvm-tsx-ctrl' into HEAD Conflicts: arch/x86/kvm/vmx/vmx.c commit 5ec966dbcc1935cfd429ffba22b837b88219cfcb Merge: c2ce4d23299f 99cdb2472bb0 Author: Enric Balletbo i Serra Date: Thu Nov 21 11:52:51 2019 +0100 Merge tag 'tag-ib-chrome-mfd-iio-input-5.5' into chrome-platform-5.5 IB between mfd, iio, input and chrome platform for cros-ec-sensorhub Signed-off-by: Enric Balletbo i Serra commit ade48088937f53fe0467162177726176813b9564 Author: Bob Peterson Date: Wed Nov 20 08:53:14 2019 -0500 gfs2: Don't write log headers after file system withdraw Before this patch, when a node withdrew a gfs2 file system, it wrote a (clean) unmount log header. That's wrong. You don't want to write anything to the journal once you're withdrawn because that's acknowledging that the transaction is complete and the journal is in good shape, neither of which may be a valid assumption when the file system is withdrawn. This is especially true if the withdraw was caused due to io errors writing to the journal in the first place. The best course of action is to leave the journal "as is" until it may be safely replayed during journal recovery, regardless of whether it's done by this node or another. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 8f81180ac1837233a98a4e5b108df5874cf97836 Author: Andreas Gruenbacher Date: Thu Nov 21 11:30:47 2019 +0100 gfs2: Remove duplicate call from gfs2_create_inode In gfs2_create_inode, gfs2_set_inode_blocks is called twice for no good reason. Remove the unnecessary call. Signed-off-by: Andreas Gruenbacher commit 99cdb2472bb0466b9e73e27bc4ac769999313af8 Author: Gwendal Grignou Date: Tue Nov 19 13:45:46 2019 +0100 Revert "Input: cros_ec_keyb: mask out extra flags in event_type" This reverts commit d096aa3eb6045a6a475a0239f3471c59eedf3d61. This patch is not needed anymore since we clear EC_MKBP_HAS_MORE_EVENTS flag before calling the notifiers in patch "9d9518f5b52a (platform: chrome: cros_ec: handle MKBP more events flag)" Signed-off-by: Gwendal Grignou Acked-by: Dmitry Torokhov Signed-off-by: Enric Balletbo i Serra commit 3bcce2e8052d5b099d267be8c9087e6dba9deff8 Author: Gwendal Grignou Date: Tue Nov 19 13:45:46 2019 +0100 Revert "Input: cros_ec_keyb - add back missing mask for event_type" This reverts commit 62c3801619e16b68a37ea899b76572145dfe41c9. This patch is not needed anymore since we clear EC_MKBP_HAS_MORE_EVENTS flag before calling the notifiers in patch "9d9518f5b52a (platform: chrome: cros_ec: handle MKBP more events flag)" Signed-off-by: Gwendal Grignou Acked-by: Dmitry Torokhov Signed-off-by: Enric Balletbo i Serra commit 3300fdd630d4d3d96e3ba9af63a740d3a4e8fc61 Author: Enrico Granata Date: Tue Nov 19 13:45:46 2019 +0100 platform/chrome: cros_ec: handle MKBP more events flag The ChromeOS EC has support for signaling to the host that a single IRQ can serve multiple MKBP (Matrix KeyBoard Protocol) events. Doing this serves an optimization purpose, as it minimizes the number of round-trips into the interrupt handling machinery, and it proves beneficial to sensor timestamping as it keeps the desired synchronization of event times between the two processors. This patch adds kernel support for this EC feature, allowing the ec_irq to loop until all events have been served. Signed-off-by: Enrico Granata Signed-off-by: Gwendal Grignou Reviewed-by: Jonathan Cameron Acked-by: Lee Jones Signed-off-by: Enric Balletbo i Serra commit da946589b1b9b643c538e6c977ac0f963362ee3c Author: Gwendal Grignou Date: Tue Nov 19 13:45:46 2019 +0100 platform/chrome: cros_ec: Do not attempt to register a non-positive IRQ number Add a layer of sanity checking to cros_ec_register against attempting to register IRQ values that are not strictly greater than 0. Signed-off-by: Enrico Granata Signed-off-by: Gwendal Grignou Acked-by: Jonathan Cameron Acked-by: Lee Jones Signed-off-by: Enric Balletbo i Serra commit 05a3c420eaa6857cb20afe7e3a3c39ed94a3b2c1 Author: Gwendal Grignou Date: Tue Nov 19 13:45:46 2019 +0100 platform/chrome: cros-ec: Record event timestamp in the hard irq To improve sensor timestamp precision, given EC and AP are in different time domains, the AP needs to try to record the exact moment an event was signalled to the AP by the EC as soon as possible after it happens. First thing in the hard irq is the best place for this. Signed-off-by: Gwendal Grignou Acked-by: Jonathan Cameron Acked-by: Lee Jones Signed-off-by: Enric Balletbo i Serra commit d60ac88a62df71cb12b2d60d2dae5658fb4eab43 Author: Gwendal Grignou Date: Tue Nov 19 13:45:45 2019 +0100 mfd / platform / iio: cros_ec: Register sensor through sensorhub Remove the duplicated code in MFD, since MFD just registers cros-ec-sensorhub if at least one sensor is present. Change IIO cros-ec driver to get the pointer to the cros-ec-dev through cros-ec-sensorhub. Signed-off-by: Gwendal Grignou Acked-by: Jonathan Cameron Acked-by: Lee Jones Signed-off-by: Enric Balletbo i Serra commit 53067471188c4066fc393ab892d0a74482eac000 Author: Gwendal Grignou Date: Tue Nov 19 13:45:45 2019 +0100 iio / platform: cros_ec: Add cros-ec-sensorhub driver Similar to HID sensor stack, the new driver sits between cros-ec-dev and the IIO device drivers: The EC based IIO device topology would be: iio:device1 -> ...0/0000:00:1f.0/PNP0C09:00/GOOG0004:00/cros-ec-dev.6.auto/ cros-ec-sensorhub.7.auto/ cros-ec-accel.15.auto/ iio:device1 It will be expanded to control EC sensor FIFO. Signed-off-by: Gwendal Grignou Reviewed-by: Jonathan Cameron [Fix "unknown type name 'uint32_t'" type errors] Reported-by: kbuild test robot Signed-off-by: Enric Balletbo i Serra commit a16b2e28190255a0729c27902fa88fb8fff39bb0 Author: Gwendal Grignou Date: Tue Nov 19 13:45:45 2019 +0100 mfd / platform: cros_ec: Add sensor_count and make check_features public Add a new function to return the number of MEMS sensors available in a ChromeOS Embedded Controller. It uses MOTIONSENSE_CMD_DUMP if available or a specific memory map ACPI registers to find out. Also, make check_features public as it can be useful for other drivers to know what the Embedded Controller supports. Signed-off-by: Gwendal Grignou Acked-by: Lee Jones Signed-off-by: Enric Balletbo i Serra commit c9b465683a554212c3dd92915ed2088849c513bf Author: Gwendal Grignou Date: Tue Nov 19 13:45:45 2019 +0100 platform/chrome: cros_ec: Put docs with the code To avoid doc rot, put function documentations with code, not header. Use kernel-doc style comments for exported functions. Signed-off-by: Gwendal Grignou Acked-by: Jonathan Cameron Signed-off-by: Enric Balletbo i Serra commit a7f96fce201c4969178c8709a49e005d9792186b Author: Greentime Hu Date: Thu Nov 21 15:45:40 2019 +0800 MAINTAINERS: add nds32 maintainer Nick implements many features of nds32 such as perf, power management and unaligned access handler. Let's add him as a maintainer. Signed-off-by: Greentime Hu commit 5feccddcf9922ee3c25587d5e609bf58503ad93e Author: Oded Gabbay Date: Mon Nov 18 09:41:08 2019 +0200 habanalabs: add more protection of device during reset Prevent accesses to the device (register read/write) from debugfs entries during reset as that can cause the device to get stuck. Signed-off-by: Oded Gabbay Reviewed-by: Tomer Tayar commit 55f6d680970ea922d4ee23d5ac88d3a8046221fb Author: Oded Gabbay Date: Sun Nov 17 17:41:57 2019 +0200 habanalabs: flush EQ workers in hard reset During hard-reset, there can be multiple events received from the H/W. For each event, the driver opens a worker thread to handle it. For some of the events, the driver will read/write registers in the code that handles the event. In case of hard-reset, we must prevent reads/writes to the registers during the reset operation because the device might get stuck if that happens. Therefore, flush the EQ workers before resetting the device (in hard-reset only). Additional events won't arrive as we synced and disabled the interrupts. Signed-off-by: Oded Gabbay Reviewed-by: Tomer Tayar commit 1af69d30c41d0b0f15d8be80c100cefaa909816c Author: Oded Gabbay Date: Sun Nov 17 17:35:49 2019 +0200 habanalabs: make the reset code more consistent In the hl_device_reset we ask about the hard_reset argument when we want to differentiate between soft and hard reset, except for three places where we use "from_hard_reset_thread". Replace one of those locations with the hard_reset argument as it is guaranteed that if we reached to that line in the code during hard_reset, it is from a kernel thread. Signed-off-by: Oded Gabbay Reviewed-by: Tomer Tayar commit 52c01b0137193ab0c9282ec8d09c6338446e6e9f Author: Moti Haimovski Date: Sun Nov 3 16:26:44 2019 +0200 habanalabs: expose reset counters via existing INFO IOCTL Expose both soft and hard reset counts via INFO IOCTL. This will allow system management applications to easily check if the device has undergone reset. Signed-off-by: Moti Haimovski Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit e16ee4103770acf365372886eac7c750017c918e Author: Oded Gabbay Date: Sat Nov 16 12:29:50 2019 +0200 habanalabs: make code more concise Instead of doing if inside if, just write them with && operator. Signed-off-by: Oded Gabbay Reviewed-by: Omer Shpigelman commit da1342a0eec038dc466742e662218f6be349d1b7 Author: Oded Gabbay Date: Sat Nov 16 12:26:30 2019 +0200 habanalabs: use defines for F/W files Make the code more concise and maintainable by using defines for the F/W files. Signed-off-by: Oded Gabbay Reviewed-by: Omer Shpigelman commit 7fbdc12b91110d21e15b84d5acf8402ae608d8c1 Author: Oded Gabbay Date: Sat Nov 16 12:24:19 2019 +0200 habanalabs: remove prints on successful device initialization Successful device initialization is mentioned in kernel log with the message "Successfully added device to habanalabs driver". There is no point of spamming the log with additional messages about successful queue testing, which are implied by the above mentioned message. Signed-off-by: Oded Gabbay Reviewed-by: Omer Shpigelman commit e604f551cdce07e45b6ca34eab58648185b3fba0 Author: Omer Shpigelman Date: Thu Nov 14 18:23:59 2019 +0000 habanalabs: remove unnecessary checks Now that the VA block free list is not updated on context close in order to optimize this flow, no need in the sanity checks of the list contents as these will fail for sure. In addition, remove the "context closing with VA in use" print during hard reset as this situation is a side effect of the failure that caused the hard reset. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit bea84c4d67e5efd1078ef234ef1304a4d1788008 Author: Omer Shpigelman Date: Thu Nov 14 18:23:58 2019 +0000 habanalabs: invalidate MMU cache only once Reduce context close time by performing MMU cache invalidation once at the end of the unmap loop rather in each iteration, in order to avoid hard reset with open contexts. Reset with open contexts can potentially lead to a kernel crash as the generic pool of the MMU hops is destroyed while it is not empty because some unmap operations are not done. The commit affect mainly when running on simulator. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 71c5e55e7c077fa17c42fbda91a8d14322825c44 Author: Omer Shpigelman Date: Thu Nov 14 18:23:57 2019 +0000 habanalabs: skip VA block list update in reset flow Reduce context close time by skipping the VA block free list update in order to avoid hard reset with open contexts. Reset with open contexts can potentially lead to a kernel crash as the generic pool of the MMU hops is destroyed while it is not empty because some unmap operations are not done. The commit affect mainly when running on simulator. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 1b98d8b23f29e5ff82fe84ca0c8acffaa971b9d6 Author: Omer Shpigelman Date: Thu Nov 14 18:23:57 2019 +0000 habanalabs: optimize MMU unmap Reduce context close time by skipping hash table lookup if possible in order to avoid hard reset with open contexts. Reset with open contexts can potentially lead to a kernel crash as the generic pool of the MMU hops is destroyed while it is not empty because some unmap operations are not done. This commit affect mainly when running on simulator. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit bc75d799f9531fe112f7d78a5547ad549293fb7e Author: Omer Shpigelman Date: Thu Nov 14 18:23:56 2019 +0000 habanalabs: prevent read/write from/to the device during hard reset During hard reset we should not access the device except of necessary reset operations because the device might be stuck or unresponsive. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 54bb67444ea3f388756c5955db52ef62eb4ba3b9 Author: Omer Shpigelman Date: Thu Nov 14 18:23:55 2019 +0000 habanalabs: split MMU properties to PCI/DRAM Split the properties used for MMU mappings to DRAM and PCI (host) types. This is a prerequisite for future ASICs support. Note that in Goya ASIC, the PMMU and DMMU are the same (except of page sizes) as only one MMU mechanism is used for both of the mapping types. Hence this patch should not have any effect on current behavior. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 30919edef243e9dc91a3c65e5b1059d481e597e9 Author: Omer Shpigelman Date: Thu Nov 14 18:23:54 2019 +0000 habanalabs: re-factor MMU masks and documentation Some cosmetics around the MMU code to make it more self-explanatory. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 7b6e4ea0f7b16ab292df5e67f5d847929f8e4d3e Author: Omer Shpigelman Date: Thu Nov 14 18:23:53 2019 +0000 habanalabs: type specific MMU cache invalidation Add the ability to invalidate the necessary MMU cache only. This ability is a prerequisite for future ASICs support. Note that in Goya ASIC, a single cache is used for both host/DRAM mappings and hence this patch should not have any effect on current behavior. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 7f74d4d335f1bdcb51fca584d5ad065c4ff996ac Author: Omer Shpigelman Date: Mon Aug 12 11:48:46 2019 +0300 habanalabs: re-factor memory module code Some of the functions in the memory module code were too long and/or contained multiple operations that are not always done together. Re-factor the code by dividing those functions to smaller functions which are more readable and maintainable. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 5d1012576d20dd7cb70e00ea1b4c2af11a6c9156 Author: Oded Gabbay Date: Sun Nov 10 16:08:26 2019 +0200 habanalabs: export uapi defines to user-space The two defines that control the maximum size of a command buffer and the maximum number of JOBS per CS need to be exported to the user as they are part of the API towards user-space. Signed-off-by: Oded Gabbay Reviewed-by: Omer Shpigelman commit eda58bf7860a028f207e8d4201d86191b898bbee Author: Oded Gabbay Date: Sun Nov 10 18:48:06 2019 +0200 habanalabs: don't print error when queues are full If the queues are full and we return -EAGAIN to the user, there is no need to print an error, as that case isn't an error and the user is expected to re-submit the work. Signed-off-by: Oded Gabbay Reviewed-by: Omer Shpigelman commit bd4c8cb17d4e8f9e01ce48e3f2009307a58e60d2 Author: Oded Gabbay Date: Sat Nov 9 23:16:33 2019 +0200 habanalabs: increase max jobs number to 512 In training, there is a need for a large amount of patching to the recipe. This results in many command buffers contains a lot of DMA packets. The number of command buffers per CS is larger than the current maximum of 64, which is an arbitrary number that is enough for inference, but it has no real affect on the code and/or resources of the host machine. Signed-off-by: Oded Gabbay Reviewed-by: Omer Shpigelman commit 6476b472437de2c41dc8873134c60d2928f806ce Author: Oded Gabbay Date: Thu Oct 24 10:12:35 2019 +0300 habanalabs: set ETR as non-secured ETR should always be non-secured as it is used by the users to record profiling/trace data. Signed-off-by: Oded Gabbay Reviewed-by: Omer Shpigelman commit e1a84d56fcb92d4551692cbec4bada1cec00e620 Author: Oded Gabbay Date: Thu Oct 24 09:52:25 2019 +0300 habanalabs: use registers name defines for ETR block We have a single ETR block in the SOC, so use explicit register name defines for initializing this block. This makes it more readable and maintainable. Signed-off-by: Oded Gabbay Reviewed-by: Omer Shpigelman commit f05912d8f16bf303e293d4add2caecb8a9231c41 Author: Oded Gabbay Date: Sun Oct 20 11:07:11 2019 +0300 habanalabs: read F/W versions before failure Move the read of the F/W boot versions before exiting on possible failures of the F/W boot. This will help debug boot failures as we will be able to know the F/W boot version. Signed-off-by: Oded Gabbay Reviewed-by: Omer Shpigelman commit 91edbf2cf8f0416b854674e891d7a5274f4b1702 Author: Oded Gabbay Date: Wed Oct 16 11:53:52 2019 +0300 habanalabs: expose card name in INFO IOCTL To enable userspace processes, e.g. management utilities, to display the card name to the user, add the card name property to the HW_IP structure that is copied to the user in the INFO IOCTL. Signed-off-by: Oded Gabbay commit 8d6de52866dcf1d6cbdec9aa10f722dd43b2431f Author: YueHaibing Date: Wed Oct 16 16:46:32 2019 +0800 habanalabs: remove set but not used variable 'qman_base_addr' Fixes gcc '-Wunused-but-set-variable' warning: drivers/misc/habanalabs/goya/goya.c: In function 'goya_init_mme_cmdq': drivers/misc/habanalabs/goya/goya.c:1536:6: warning: variable 'qman_base_addr' set but not used [-Wunused-but-set-variable] It is never used, so can be removed. Reported-by: Hulk Robot Signed-off-by: YueHaibing Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 62c1e124a9e03ccb8bb39efe1d092c2376967528 Author: Oded Gabbay Date: Thu Oct 10 15:48:59 2019 +0300 habanalabs: add opcode to INFO IOCTL to return clock rate Add a new opcode to the INFO IOCTL to allow the user application to retrieve the ASIC's current and maximum clock rate. The rate is returned in MHz. Signed-off-by: Oded Gabbay Reviewed-by: Tomer Tayar commit 8fdacf2a530f36f6f0621a95ef0e37d8db2d2f89 Author: Oded Gabbay Date: Wed Oct 2 14:14:08 2019 +0300 habanalabs: set TPC Icache to 16 cache lines Reduce latency to memory during TPC kernel execution. Signed-off-by: Oded Gabbay Reviewed-by: Tomer Tayar commit cb596aee8842c87605ea1a9062af2ab435a742d4 Author: Tomer Tayar Date: Thu Oct 3 15:22:36 2019 +0000 habanalabs: Add a new H/W queue type This patch adds a support for a new H/W queue type. This type of queue is for DMA and compute engines jobs, for which completion notification are sent by H/W. Command buffer for this queue can be created either through the CB IOCTL and using the retrieved CB handle, or by preparing a buffer on the host or device SRAM/DRAM, and using the device address to that buffer. The patch includes the handling of the 2 options, as well as the initialization of the H/W queue and its jobs scheduling. Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit df762375f17e1765bc3a0b345378e1726d85ca75 Author: Tomer Tayar Date: Thu Oct 3 15:22:35 2019 +0000 habanalabs: Mark queue as expecting CB handle or address Jobs on some queues must be provided with a handle to a driver command buffer object, while for other queues, jobs must be provided with an address to a command buffer. Currently the distinction is done based on the queue type, which is less flexible if the same queue type behaves differently on different types of ASICs. This patch adds a new queue property for this target, which is configured per queue type per ASIC type. Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit f435614ff55c6783919028cb914ffd7422e0b03b Author: Tomer Tayar Date: Wed Oct 2 13:53:52 2019 +0000 habanalabs: Fix typos s/paerser/parser/ s/requeusted/requested/ s/an JOB/a JOB/ Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 1e295d4dd5b2e3d9dab68bfcab1f5666cde3804d Author: YueHaibing Date: Sat Sep 28 12:18:04 2019 +0800 habanalabs: remove set but not used variable 'ctx' Fixes gcc '-Wunused-but-set-variable' warning: drivers/misc/habanalabs/device.c: In function hpriv_release: drivers/misc/habanalabs/device.c:45:17: warning: variable ctx set but not used [-Wunused-but-set-variable] It is never used since commit eb7caf84b029 ("habanalabs: maintain a list of file private data objects") Reported-by: Hulk Robot Signed-off-by: YueHaibing Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit abb7e16fb6dfc32d0c0e63787409fdb4c348915c Author: Oded Gabbay Date: Mon Sep 16 09:16:29 2019 +0300 habanalabs: handle F/W failure for sensor initialization In case the F/W fails to initialize the thermal sensors, print an appropriate error message to kernel log and fail the device initialization. Reviewed-by: Tomer Tayar Signed-off-by: Oded Gabbay commit 2e2fae99d1f308742b9b05dfd749e64b11960732 Author: Mark Salyzyn Date: Thu Nov 21 09:12:17 2019 +0000 afs: xattr: use scnprintf sprintf and snprintf are fragile in future maintenance, switch to using scnprintf to ensure no accidental Use After Free conditions are introduced. Signed-off-by: Mark Salyzyn Cc: linux-kernel@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: David Howells Cc: linux-afs@lists.infradead.org Cc: Jan Kara Signed-off-by: David Howells commit d4438a25295d87d189e1925e0f7de2edcfe66582 Author: David Howells Date: Thu Nov 21 09:12:17 2019 +0000 afs: Introduce an afs_get_read() refcount helper Introduce an afs_get_read() helper to get a reference on an afs_read object. Signed-off-by: David Howells commit 0b9c0174d6b611356038e26d9434ad873f58e270 Author: David Howells Date: Thu Nov 21 09:12:17 2019 +0000 afs: Rename desc -> req in afs_fetch_data() Rename the desc parameter to req in afs_fetch_data() for consistency with other functions. Signed-off-by: David Howells commit fc276122496df13341c1429fbd430d02462815c8 Author: David Howells Date: Thu Nov 21 09:12:17 2019 +0000 afs: Switch the naming of call->iter and call->_iter Change the name of call->iter to call->def_iter to represent the default iterator. Change the name of call->_iter to call->iter to represent the iterator actually being used. Signed-off-by: David Howells commit 1b87b025b4cdae7851cbb0f1111543ffc49a0d48 Author: David Howells Date: Thu Nov 21 09:12:16 2019 +0000 afs: Use call->_iter not &call->iter in debugging statements Use call->_iter not &call->iter in debugging statements as the latter is a convenience iter whereas the former represents we're actually doing at the moment. Signed-off-by: David Howells commit b07a5c53d42a8c87b208614129e947dd2338ff9c Author: Paolo Bonzini Date: Mon Nov 18 12:23:01 2019 -0500 KVM: vmx: use MSR_IA32_TSX_CTRL to hard-disable TSX on guest that lack it If X86_FEATURE_RTM is disabled, the guest should not be able to access MSR_IA32_TSX_CTRL. We can therefore use it in KVM to force all transactions from the guest to abort. Tested-by: Jim Mattson Signed-off-by: Paolo Bonzini commit c11f83e0626bdc2b6c550fc8b9b6eeefbd8cefaa Author: Paolo Bonzini Date: Mon Nov 18 12:23:00 2019 -0500 KVM: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality The current guest mitigation of TAA is both too heavy and not really sufficient. It is too heavy because it will cause some affected CPUs (those that have MDS_NO but lack TAA_NO) to fall back to VERW and get the corresponding slowdown. It is not really sufficient because it will cause the MDS_NO bit to disappear upon microcode update, so that VMs started before the microcode update will not be runnable anymore afterwards, even with tsx=on. Instead, if tsx=on on the host, we can emulate MSR_IA32_TSX_CTRL for the guest and let it run without the VERW mitigation. Even though MSR_IA32_TSX_CTRL is quite heavyweight, and we do not want to write it on every vmentry, we can use the shared MSR functionality because the host kernel need not protect itself from TSX-based side-channels. Tested-by: Jim Mattson Signed-off-by: Paolo Bonzini commit edef5c36b0c7f07ab4926f6c9e50731f3772c79d Author: Paolo Bonzini Date: Mon Nov 18 12:23:00 2019 -0500 KVM: x86: implement MSR_IA32_TSX_CTRL effect on CPUID Because KVM always emulates CPUID, the CPUID clear bit (bit 1) of MSR_IA32_TSX_CTRL must be emulated "manually" by the hypervisor when performing said emulation. Right now neither kvm-intel.ko nor kvm-amd.ko implement MSR_IA32_TSX_CTRL but this will change in the next patch. Reviewed-by: Jim Mattson Tested-by: Jim Mattson Signed-off-by: Paolo Bonzini commit de1fca5d6e0105c9d33924e1247e2f386efc3ece Author: Paolo Bonzini Date: Mon Nov 18 12:23:00 2019 -0500 KVM: x86: do not modify masked bits of shared MSRs "Shared MSRs" are guest MSRs that are written to the host MSRs but keep their value until the next return to userspace. They support a mask, so that some bits keep the host value, but this mask is only used to skip an unnecessary MSR write and the value written to the MSR is always the guest MSR. Fix this and, while at it, do not update smsr->values[slot].curr if for whatever reason the wrmsr fails. This should only happen due to reserved bits, so the value written to smsr->values[slot].curr will not match when the user-return notifier and the host value will always be restored. However, it is untidy and in rare cases this can actually avoid spurious WRMSRs on return to userspace. Cc: stable@vger.kernel.org Reviewed-by: Jim Mattson Tested-by: Jim Mattson Signed-off-by: Paolo Bonzini commit cbbaa2727aa3ae9e0a844803da7cef7fd3b94f2b Author: Paolo Bonzini Date: Mon Nov 18 18:58:26 2019 +0100 KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES KVM does not implement MSR_IA32_TSX_CTRL, so it must not be presented to the guests. It is also confusing to have !ARCH_CAP_TSX_CTRL_MSR && !RTM && ARCH_CAP_TAA_NO: lack of MSR_IA32_TSX_CTRL suggests TSX was not hidden (it actually was), yet the value says that TSX is not vulnerable to microarchitectural data sampling. Fix both. Cc: stable@vger.kernel.org Tested-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 14edff88315add29099fd8eebb9ef989c2e47c18 Merge: 992edeaefed6 cd7056ae34af Author: Paolo Bonzini Date: Thu Nov 21 09:58:35 2019 +0100 Merge tag 'kvmarm-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm updates for Linux 5.5: - Allow non-ISV data aborts to be reported to userspace - Allow injection of data aborts from userspace - Expose stolen time to guests - GICv4 performance improvements - vgic ITS emulation fixes - Simplify FWB handling - Enable halt pool counters - Make the emulated timer PREEMPT_RT compliant Conflicts: include/uapi/linux/kvm.h commit b6378caf829e9e3b4d61c0901f4d6c1e6819716f Author: Krzysztof Wilczynski Date: Thu Sep 5 01:52:16 2019 +0200 nds32: Move static keyword to the front of declaration Move the static keyword to the front of declaration of cpu_pmu_of_device_ids, and resolve the following compiler warning that can be seen when building with warnings enabled (W=1): arch/nds32/kernel/perf_event_cpu.c:1122:1: warning: ‘static’ is not at beginning of declaration [-Wold-style-declaration] Signed-off-by: Krzysztof Wilczynski Acked-by: Greentime Hu Signed-off-by: Greentime Hu commit 1b78375c3789cb89912e4a5a47070841211888af Author: Masanari Iida Date: Wed Aug 14 12:45:21 2019 +0900 nds32: Fix typo in Kconfig.cpu This patch fixes some spelling typo in Kconfig.cpu Signed-off-by: Masanari Iida Acked-by: Greentime Hu Signed-off-by: Greentime Hu commit 9e5183ee416d34b76a31fa086ba3f18218be02e4 Author: Masahiro Yamada Date: Fri Aug 9 02:30:28 2019 +0900 nds32: remove unneeded clean-files for DTB These patterns are cleaned-up by the top-level Makefile Signed-off-by: Masahiro Yamada Acked-by: Greentime Hu Signed-off-by: Greentime Hu commit 7d73170e1c282576419f8b50a771f1fcd2b81a94 Author: Jiangfeng Xiao Date: Wed Nov 20 23:18:53 2019 +0800 serial: serial_core: Perform NULL checks for break_ctl ops Doing fuzz test on sbsa uart device, causes a kernel crash due to NULL pointer dereference: ------------[ cut here ]------------ Unable to handle kernel paging request at virtual address fffffffffffffffc pgd = ffffffe331723000 [fffffffffffffffc] *pgd=0000002333595003, *pud=0000002333595003, *pmd=00000 Internal error: Oops: 96000005 [#1] PREEMPT SMP Modules linked in: ping(O) jffs2 rtos_snapshot(O) pramdisk(O) hisi_sfc(O) Drv_Nandc_K(O) Drv_SysCtl_K(O) Drv_SysClk_K(O) bsp_reg(O) hns3(O) hns3_uio_enet(O) hclgevf(O) hclge(O) hnae3(O) mdio_factory(O) mdio_registry(O) mdio_dev(O) mdio(O) hns3_info(O) rtos_kbox_panic(O) uart_suspend(O) rsm(O) stp llc tunnel4 xt_tcpudp ipt_REJECT nf_reject_ipv4 iptable_filter ip_tables x_tables sd_mod xhci_plat_hcd xhci_pci xhci_hcd usbmon usbhid usb_storage ohci_platform ohci_pci ohci_hcd hid_generic hid ehci_platform ehci_pci ehci_hcd vfat fat usbcore usb_common scsi_mod yaffs2multi(O) ext4 jbd2 ext2 mbcache ofpart i2c_dev i2c_core uio ubi nand nand_ecc nand_ids cfi_cmdset_0002 cfi_cmdset_0001 cfi_probe gen_probe cmdlinepart chipreg mtdblock mtd_blkdevs mtd nfsd auth_rpcgss oid_registry nfsv3 nfs nfs_acl lockd sunrpc grace autofs4 CPU: 2 PID: 2385 Comm: tty_fuzz_test Tainted: G O 4.4.193 #1 task: ffffffe32b23f110 task.stack: ffffffe32bda4000 PC is at uart_break_ctl+0x44/0x84 LR is at uart_break_ctl+0x34/0x84 pc : [] lr : [] pstate: 80000005 sp : ffffffe32bda7cc0 x29: ffffffe32bda7cc0 x28: ffffffe32b23f110 x27: ffffff8393402000 x26: 0000000000000000 x25: ffffffe32b233f40 x24: ffffffc07a8ec680 x23: 0000000000005425 x22: 00000000ffffffff x21: ffffffe33ed73c98 x20: 0000000000000000 x19: ffffffe33ed94168 x18: 0000000000000004 x17: 0000007f92ae9d30 x16: ffffff8392fa6064 x15: 0000000000000010 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000020 x10: 0000007ffdac1708 x9 : 0000000000000078 x8 : 000000000000001d x7 : 0000000052a64887 x6 : ffffffe32bda7e08 x5 : ffffffe32b23c000 x4 : 0000005fbc5b0000 x3 : ffffff83938d5018 x2 : 0000000000000080 x1 : ffffffe32b23c040 x0 : ffffff83934428f8 virtual start addr offset is 38ac00000 module base offset is 2cd4cf1000 linear region base offset is : 0 Process tty_fuzz_test (pid: 2385, stack limit = 0xffffffe32bda4000) Stack: (0xffffffe32bda7cc0 to 0xffffffe32bda8000) 7cc0: ffffffe32bda7cf0 ffffff8393177718 ffffffc07a8ec680 ffffff8393196054 7ce0: 000000001739f2e0 0000007ffdac1978 ffffffe32bda7d20 ffffff8393179a1c 7d00: 0000000000000000 ffffff8393c0a000 ffffffc07a8ec680 cb88537fdc8ba600 7d20: ffffffe32bda7df0 ffffff8392fa5a40 ffffff8393c0a000 0000000000005425 7d40: 0000007ffdac1978 ffffffe32b233f40 ffffff8393178dcc 0000000000000003 7d60: 000000000000011d 000000000000001d ffffffe32b23f110 000000000000029e 7d80: ffffffe34fe8d5d0 0000000000000000 ffffffe32bda7e14 cb88537fdc8ba600 7da0: ffffffe32bda7e30 ffffff8393042cfc ffffff8393c41720 ffffff8393c46410 7dc0: ffffff839304fa68 ffffffe32b233f40 0000000000005425 0000007ffdac1978 7de0: 000000000000011d cb88537fdc8ba600 ffffffe32bda7e70 ffffff8392fa60cc 7e00: 0000000000000000 ffffffe32b233f40 ffffffe32b233f40 0000000000000003 7e20: 0000000000005425 0000007ffdac1978 ffffffe32bda7e70 ffffff8392fa60b0 7e40: 0000000000000280 ffffffe32b233f40 ffffffe32b233f40 0000000000000003 7e60: 0000000000005425 cb88537fdc8ba600 0000000000000000 ffffff8392e02e78 7e80: 0000000000000280 0000005fbc5b0000 ffffffffffffffff 0000007f92ae9d3c 7ea0: 0000000060000000 0000000000000015 0000000000000003 0000000000005425 7ec0: 0000007ffdac1978 0000000000000000 00000000a54c910e 0000007f92b95014 7ee0: 0000007f92b95090 0000000052a64887 000000000000001d 0000000000000078 7f00: 0000007ffdac1708 0000000000000020 0000000000000000 0000000000000000 7f20: 0000000000000000 0000000000000010 000000556acf0090 0000007f92ae9d30 7f40: 0000000000000004 000000556acdef10 0000000000000000 000000556acdebd0 7f60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7f80: 0000000000000000 0000000000000000 0000000000000000 0000007ffdac1840 7fa0: 000000556acdedcc 0000007ffdac1840 0000007f92ae9d3c 0000000060000000 7fc0: 0000000000000000 0000000000000000 0000000000000003 000000000000001d 7fe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 Call trace: Exception stack(0xffffffe32bda7ab0 to 0xffffffe32bda7bf0) 7aa0: 0000000000001000 0000007fffffffff 7ac0: ffffffe32bda7cc0 ffffff8393196098 0000000080000005 0000000000000025 7ae0: ffffffe32b233f40 ffffff83930d777c ffffffe32bda7b30 ffffff83930d777c 7b00: ffffffe32bda7be0 ffffff83938d5000 ffffffe32bda7be0 ffffffe32bda7c20 7b20: ffffffe32bda7b60 ffffff83930d777c ffffffe32bda7c10 ffffff83938d5000 7b40: ffffffe32bda7c10 ffffffe32bda7c50 ffffff8393c0a000 ffffffe32b23f110 7b60: ffffffe32bda7b70 ffffff8392e09df4 ffffffe32bda7bb0 cb88537fdc8ba600 7b80: ffffff83934428f8 ffffffe32b23c040 0000000000000080 ffffff83938d5018 7ba0: 0000005fbc5b0000 ffffffe32b23c000 ffffffe32bda7e08 0000000052a64887 7bc0: 000000000000001d 0000000000000078 0000007ffdac1708 0000000000000020 7be0: 0000000000000000 0000000000000000 [] uart_break_ctl+0x44/0x84 [] send_break+0xa0/0x114 [] tty_ioctl+0xc50/0xe84 [] do_vfs_ioctl+0xc4/0x6e8 [] SyS_ioctl+0x68/0x9c [] __sys_trace_return+0x0/0x4 Code: b9410ea0 34000160 f9408aa0 f9402814 (b85fc280) ---[ end trace 8606094f1960c5e0 ]--- Kernel panic - not syncing: Fatal exception Fix this problem by adding NULL checks prior to calling break_ctl ops. Signed-off-by: Jiangfeng Xiao Cc: stable Link: https://lore.kernel.org/r/1574263133-28259-1-git-send-email-xiaojiangfeng@huawei.com Signed-off-by: Greg Kroah-Hartman commit 1199ab4c9e1d4cdfbabd70b4aadbc8e72c691f65 Author: Mohammad Rasim Date: Wed Nov 20 14:02:35 2019 +0300 Bluetooth: btbcm: Add entry for BCM4335A0 UART bluetooth This patch adds the device ID for the BCM4335A0 module (part of the AMPAK AP6335 WIFI/Bluetooth combo) hciconfig output: ``` hci1: Type: Primary Bus: UART BD Address: 43:35:B0:07:1F:AC ACL MTU: 1021:8 SCO MTU: 64:1 UP RUNNING RX bytes:5079 acl:0 sco:0 events:567 errors:0 TX bytes:69065 acl:0 sco:0 commands:567 errors:0 Features: 0xbf 0xfe 0xcf 0xff 0xdf 0xff 0x7b 0x87 Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3 Link policy: RSWITCH SNIFF Link mode: SLAVE ACCEPT Name: 'alarm' Class: 0x000000 Service Classes: Unspecified Device Class: Miscellaneous, HCI Version: 4.0 (0x6) Revision: 0x161 LMP Version: 4.0 (0x6) Subversion: 0x4106 Manufacturer: Broadcom Corporation (15) ``` Signed-off-by: Mohammad Rasim Signed-off-by: Marcel Holtmann commit e32ec8ea0d79fac75171980f2df5d0af87a08838 Author: Mohammad Rasim Date: Wed Nov 20 14:02:34 2019 +0300 dt-bindings: net: Add compatible for BCM4335A0 bluetooth Available in the Ampak AP6335 WiFi/Bluetooth combo Signed-off-by: Mohammad Rasim Signed-off-by: Marcel Holtmann commit 8392853e964c025b0616bd54c0cdf9cbc3c9a769 Author: Frederic Weisbecker Date: Thu Nov 21 03:44:30 2019 +0100 rackmeter: Use vtime aware kcpustat accessor Now that we have a vtime safe kcpustat accessor, use it to fetch CPUTIME_NICE and fix frozen kcpustat values on nohz_full CPUs. Reported-by: Yauheni Kaliuta Signed-off-by: Frederic Weisbecker Cc: Benjamin Herrenschmidt Cc: Peter Zijlstra Cc: Wanpeng Li Link: https://lkml.kernel.org/r/20191121024430.19938-7-frederic@kernel.org Signed-off-by: Ingo Molnar commit 8688f2fb671b2ed59b1b16083136b6edc3750435 Author: Frederic Weisbecker Date: Thu Nov 21 03:44:29 2019 +0100 leds: Use all-in-one vtime aware kcpustat accessor We can now safely read user kcpustat fields on nohz_full CPUs. Use the appropriate accessor. [ mingo: Fixed build failure. ] Reported-by: Yauheni Kaliuta Signed-off-by: Frederic Weisbecker Cc: Jacek Anaszewski (maintainer:LED SUBSYSTEM) Cc: Pavel Machek (maintainer:LED SUBSYSTEM) Cc: Dan Murphy (reviewer:LED SUBSYSTEM) Cc: Peter Zijlstra Cc: Wanpeng Li Link: https://lkml.kernel.org/r/20191121024430.19938-6-frederic@kernel.org Signed-off-by: Ingo Molnar commit e2c05675979707b337b7af6319a9053bd286ed50 Author: Chuhong Yuan Date: Wed Jul 24 20:23:08 2019 +0800 pcmcia: Use dev_get_drvdata where possible Instead of using to_pci_dev + pci_get_drvdata, use dev_get_drvdata to make code simpler. Signed-off-by: Chuhong Yuan Signed-off-by: Dominik Brodowski commit 84182fc7c16f3e882977879c464fa14f2561bfad Author: Colin Ian King Date: Wed Oct 31 16:46:02 2018 +0000 pcmcia: clean an indentation issues, remove extraneous spaces Trivial fix to clean up indentation issues, remove spaces Signed-off-by: Colin Ian King Signed-off-by: Dominik Brodowski commit c4b75479741c9c3a4f0abff5baa5013d27640ac1 Author: Alexander Shishkin Date: Wed Nov 20 19:06:40 2019 +0200 perf/core: Make the mlock accounting simple again Commit: d44248a41337 ("perf/core: Rework memory accounting in perf_mmap()") does a lot of things to the mlock accounting arithmetics, while the only thing that actually needed to happen is subtracting the part that is charged to the mm from the part that is charged to the user, so that the former isn't charged twice. Signed-off-by: Alexander Shishkin Acked-by: Song Liu Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Wanpeng Li Cc: Yauheni Kaliuta Cc: songliubraving@fb.com Link: https://lkml.kernel.org/r/20191120170640.54123-1-alexander.shishkin@linux.intel.com Signed-off-by: Ingo Molnar commit 5720821ba1d845f0b91a9278137e9005c5f6931d Author: Frederic Weisbecker Date: Thu Nov 21 03:44:28 2019 +0100 cpufreq: Use vtime aware kcpustat accessors for user time We can now safely read user and guest kcpustat fields on nohz_full CPUs. Use the appropriate accessors. Reported-by: Yauheni Kaliuta Signed-off-by: Frederic Weisbecker Cc: Rafael J. Wysocki Cc: Viresh Kumar Cc: Peter Zijlstra Cc: Wanpeng Li Link: https://lkml.kernel.org/r/20191121024430.19938-5-frederic@kernel.org Signed-off-by: Ingo Molnar commit 26dae145a76c3615588f263885904c6e567ff116 Author: Frederic Weisbecker Date: Thu Nov 21 03:44:27 2019 +0100 procfs: Use all-in-one vtime aware kcpustat accessor Now that we can read also user and guest time safely under vtime, use the relevant accessor to fix frozen kcpustat values on nohz_full CPUs. Reported-by: Yauheni Kaliuta Signed-off-by: Frederic Weisbecker Cc: Al Viro Cc: Peter Zijlstra Cc: Wanpeng Li Link: https://lkml.kernel.org/r/20191121024430.19938-4-frederic@kernel.org Signed-off-by: Ingo Molnar commit 74722bb223d0f236303b60c9509ff924a9713780 Author: Frederic Weisbecker Date: Thu Nov 21 03:44:26 2019 +0100 sched/vtime: Bring up complete kcpustat accessor Many callsites want to fetch the values of system, user, user_nice, guest or guest_nice kcpustat fields altogether or at least a pair of these. In that case calling kcpustat_field() for each requested field brings unecessary overhead when we could fetch all of them in a row. So provide kcpustat_cpu_fetch() that fetches the whole kcpustat array in a vtime safe way under the same RCU and seqcount block. Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Wanpeng Li Cc: Yauheni Kaliuta Link: https://lkml.kernel.org/r/20191121024430.19938-3-frederic@kernel.org Signed-off-by: Ingo Molnar commit 5a1c95580f1d89c8a736bb02ecd82a8858388b8a Author: Frederic Weisbecker Date: Thu Nov 21 03:44:25 2019 +0100 sched/cputime: Support other fields on kcpustat_field() Provide support for user, nice, guest and guest_nice fields through kcpustat_field(). Whether we account the delta to a nice or not nice field is decided on top of the nice value snapshot taken at the time we call kcpustat_field(). If the nice value of the task has been changed since the last vtime update, we may have inacurrate distribution of the nice VS unnice cputime. However this is considered as a minor issue compared to the proper fix that would involve interrupting the target on nice updates, which is undesired on nohz_full CPUs. Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Wanpeng Li Cc: Yauheni Kaliuta Link: https://lkml.kernel.org/r/20191121024430.19938-2-frederic@kernel.org Signed-off-by: Ingo Molnar commit f3c9a666b28572b1a0ae691a47d9a7de4d9cefb3 Author: Russell King Date: Wed Nov 20 12:29:59 2019 +0000 net: sfp: soft status and control support Add support for the soft status and control register, which allows TX_FAULT and RX_LOS to be monitored and TX_DISABLE to be set. We make use of this when the board does not support GPIOs for these signals. Signed-off-by: Russell King Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 9ce33351bd552f712b349f3c1b756c9bb0ea234f Merge: 9bb59a21f53e b0eae33b2583 Author: David S. Miller Date: Wed Nov 20 22:28:53 2019 -0800 Merge branch 'sfp-quirks' Russell King says: ==================== Add rudimentary SFP module quirk support The SFP module EEPROM describes the capabilities of the module, but doesn't describe the host interface. We have a certain amount of guess-work to work out how to configure the host - which works most of the time. However, there are some (such as GPON) modules which are able to support different host interfaces, such as 1000BASE-X and 2500BASE-X. The module will switch between each mode until it achieves link with the host. There is no defined way to describe this in the SFP EEPROM, so we can only recognise the module and handle it appropriately. This series adds the necessary recognition of the modules using a quirk system, and tweaks the support mask to allow them to link with the host at 2500BASE-X, thereby allowing the user to achieve full line rate. ==================== Signed-off-by: David S. Miller commit b0eae33b2583dceb36224619f9fd85e6140ae594 Author: Russell King Date: Wed Nov 20 11:42:47 2019 +0000 net: sfp: add some quirks for GPON modules Marc Micalizzi reports that Huawei MA5671A and Alcatel/Lucent G-010S-P modules are capable of 2500base-X, but incorrectly report their capabilities in the EEPROM. It seems rather common that GPON modules mis-report. Let's fix these modules by adding some quirks. Signed-off-by: Russell King Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit b34bb2cb5b62c7397c28fcc335e8047a687eada4 Author: Russell King Date: Wed Nov 20 11:42:42 2019 +0000 net: sfp: add support for module quirks Add support for applying module quirks to the list of supported ethtool link modes. Signed-off-by: Russell King Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 9bb59a21f53e7231696257d5e6283a4fbacfb43f Author: Hangbin Liu Date: Wed Nov 20 16:38:08 2019 +0800 tcp: warn if offset reach the maxlen limit when using snprintf snprintf returns the number of chars that would be written, not number of chars that were actually written. As such, 'offs' may get larger than 'tbl.maxlen', causing the 'tbl.maxlen - offs' being < 0, and since the parameter is size_t, it would overflow. Since using scnprintf may hide the limit error, while the buffer is still enough now, let's just add a WARN_ON_ONCE in case it reach the limit in future. v2: Use WARN_ON_ONCE as Jiri and Eric suggested. Suggested-by: Jiri Benc Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit c0d59da79534e85eb550d863e35eccc8c3fd8ceb Author: wenxu Date: Wed Nov 20 10:59:39 2019 +0800 ip_gre: Make none-tun-dst gre tunnel store tunnel info as metadat_dst in recv Currently collect_md gre tunnel will store the tunnel info(metadata_dst) to skb_dst. And now the non-tun-dst gre tunnel already can add tunnel header through lwtunnel. When received a arp_request on the non-tun-dst gre tunnel. The packet of arp response will send through the non-tun-dst tunnel without tunnel info which will lead the arp response packet to be dropped. If the non-tun-dst gre tunnel also store the tunnel info as metadata_dst, The arp response packet will set the releted tunnel info in the iptunnel_metadata_reply. The following is the test script: ip netns add cl ip l add dev vethc type veth peer name eth0 netns cl ifconfig vethc 172.168.0.7/24 up ip l add dev tun1000 type gretap key 1000 ip link add user1000 type vrf table 1 ip l set user1000 up ip l set dev tun1000 master user1000 ifconfig tun1000 10.0.1.1/24 up ip netns exec cl ifconfig eth0 172.168.0.17/24 up ip netns exec cl ip l add dev tun type gretap local 172.168.0.17 remote 172.168.0.7 key 1000 ip netns exec cl ifconfig tun 10.0.1.7/24 up ip r r 10.0.1.7 encap ip id 1000 dst 172.168.0.17 key dev tun1000 table 1 With this patch ip netns exec cl ping 10.0.1.1 can success Signed-off-by: wenxu Signed-off-by: David S. Miller commit 695d1ec3994f9de2cefae80ee2087c95d2e5a2f3 Author: Hui Wang Date: Thu Nov 21 10:54:27 2019 +0800 ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop The headset on this machine is not defined, after applying the quirk ALC256_FIXUP_ASUS_HEADSET_MIC, the headset-mic works well BugLink: https://bugs.launchpad.net/bugs/1846148 Cc: Signed-off-by: Hui Wang Link: https://lore.kernel.org/r/20191121025427.8856-1-hui.wang@canonical.com Signed-off-by: Takashi Iwai commit d64ebdbfd4f71406f58210f5ccb16977b4cd31d2 Author: Hui Wang Date: Thu Nov 21 10:26:44 2019 +0800 ALSA: hda/realtek - Move some alc236 pintbls to fallback table We have a new Dell machine which needs to apply the quirk ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, try to use the fallback table to fix it this time. And we could remove all pintbls of alc236 for applying DELL1_MIC_NO_PRESENCE on Dell machines. Signed-off-by: Hui Wang Link: https://lore.kernel.org/r/20191121022644.8078-2-hui.wang@canonical.com Signed-off-by: Takashi Iwai commit aed8c7f40882015aad45088256231babcbc24482 Author: Hui Wang Date: Thu Nov 21 10:26:43 2019 +0800 ALSA: hda/realtek - Move some alc256 pintbls to fallback table We have a new Dell machine which needs to apply the quirk ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, try to use the fallback table to fix it this time. And we could remove all pintbls of alc256 for applying DELL1_MIC_NO_PRESENCE on Dell machines. Signed-off-by: Hui Wang Link: https://lore.kernel.org/r/20191121022644.8078-1-hui.wang@canonical.com Signed-off-by: Takashi Iwai commit 30486e72093ea2e594f44876b7a445c219449bce Author: Greg Kurz Date: Wed Nov 13 17:46:19 2019 +0100 KVM: PPC: Book3S HV: XIVE: Fix potential page leak on error path We need to check the host page size is big enough to accomodate the EQ. Let's do this before taking a reference on the EQ page to avoid a potential leak if the check fails. Cc: stable@vger.kernel.org # v5.2 Fixes: 13ce3297c576 ("KVM: PPC: Book3S HV: XIVE: Add controls for the EQ configuration") Signed-off-by: Greg Kurz Reviewed-by: Cédric Le Goater Signed-off-by: Paul Mackerras commit 31a88c82b466d2f31a44e21c479f45b4732ccfd0 Author: Greg Kurz Date: Wed Nov 13 17:46:13 2019 +0100 KVM: PPC: Book3S HV: XIVE: Free previous EQ page when setting up a new one The EQ page is allocated by the guest and then passed to the hypervisor with the H_INT_SET_QUEUE_CONFIG hcall. A reference is taken on the page before handing it over to the HW. This reference is dropped either when the guest issues the H_INT_RESET hcall or when the KVM device is released. But, the guest can legitimately call H_INT_SET_QUEUE_CONFIG several times, either to reset the EQ (vCPU hot unplug) or to set a new EQ (guest reboot). In both cases the existing EQ page reference is leaked because we simply overwrite it in the XIVE queue structure without calling put_page(). This is especially visible when the guest memory is backed with huge pages: start a VM up to the guest userspace, either reboot it or unplug a vCPU, quit QEMU. The leak is observed by comparing the value of HugePages_Free in /proc/meminfo before and after the VM is run. Ideally we'd want the XIVE code to handle the EQ page de-allocation at the platform level. This isn't the case right now because the various XIVE drivers have different allocation needs. It could maybe worth introducing hooks for this purpose instead of exposing XIVE internals to the drivers, but this is certainly a huge work to be done later. In the meantime, for easier backport, fix both vCPU unplug and guest reboot leaks by introducing a wrapper around xive_native_configure_queue() that does the necessary cleanup. Reported-by: Satheesh Rajendran Cc: stable@vger.kernel.org # v5.2 Fixes: 13ce3297c576 ("KVM: PPC: Book3S HV: XIVE: Add controls for the EQ configuration") Signed-off-by: Cédric Le Goater Signed-off-by: Greg Kurz Tested-by: Lijun Pan Signed-off-by: Paul Mackerras commit bf9c95e23324cbaf2e58fc3f0cbdc73137f2d1ca Author: Michael Ellerman Date: Wed Nov 20 13:37:23 2019 +1100 selftests/powerpc: spectre_v2 test must be built 64-bit The spectre_v2 test must be built 64-bit, it includes hand-written asm that is 64-bit only, and segfaults if built 32-bit. Fixes: c790c3d2b0ec ("selftests/powerpc: Add a test of spectre_v2 mitigations") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191120023924.13130-1-mpe@ellerman.id.au commit 9d72dcef891030545f39ad386a30cf91df517fb2 Author: Oliver O'Halloran Date: Mon Nov 18 17:55:53 2019 +1100 powerpc/powernv: Disable native PCIe port management On PowerNV the PCIe topology is (currently) managed by the powernv platform code in Linux in cooperation with the platform firmware. Linux's native PCIe port service drivers operate independently of both and this can cause problems. The main issue is that the portbus driver will conflict with the platform specific hotplug driver (pnv_php) over ownership of the MSI used to notify the host when a hotplug event occurs. The portbus driver claims this MSI on behalf of the individual port services because the same interrupt is used for hotplug events, PMEs (on root ports), and link bandwidth change notifications. The portbus driver will always claim the interrupt even if the individual port service drivers, such as pciehp, are compiled out. The second, bigger, problem is that the hotplug port service driver fundamentally does not work on PowerNV. The platform assumes that all PCI devices have a corresponding arch-specific handle derived from the DT node for the device (pci_dn) and without one the platform will not allow a PCI device to be enabled. This problem is largely due to historical baggage, but it can't be resolved without significant re-factoring of the platform PCI support. We can fix these problems in the interim by setting the "pcie_ports_disabled" flag during platform initialisation. The flag indicates the platform owns the PCIe ports which stops the portbus driver from being registered. This does have the side effect of disabling all port services drivers that is: AER, PME, BW notifications, hotplug, and DPC. However, this is not a huge disadvantage on PowerNV since these services are either unused or handled through other means. Fixes: 66725152fb9f ("PCI/hotplug: PowerPC PowerNV PCI hotplug driver") Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20191118065553.30362-1-oohall@gmail.com commit 793b08e2efff3ec020c5c5861d00ed394fcdd488 Author: Christophe Leroy Date: Tue Oct 29 12:13:58 2019 +0000 powerpc/kexec: Move kexec files into a dedicated subdir. arch/powerpc/kernel/ contains 8 files dedicated to kexec. Move them into a dedicated subdirectory. Signed-off-by: Christophe Leroy [mpe: Move to a/p/kexec, drop the 'machine' naming and use 'core' instead] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/afbef97ec6a978574a5cf91a4441000e0a9da42a.1572351221.git.christophe.leroy@c-s.fr commit 9f7bd9201521b3ad11e96887550dd3e835ba01cb Author: Christophe Leroy Date: Tue Oct 29 12:13:57 2019 +0000 powerpc/32: Split kexec low level code out of misc_32.S Almost half of misc_32.S is dedicated to kexec. That's the relocation function for kexec. Drop it into a dedicated kexec_relocate_32.S Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/e235973a1198195763afd3b6baffa548a83f4611.1572351221.git.christophe.leroy@c-s.fr commit 8795a739e5c72abeec51caf36b6df2b37e5720c5 Author: Christophe Leroy Date: Thu Oct 31 13:47:30 2019 +0000 powerpc/sysdev: drop simple gpio There is a config item CONFIG_SIMPLE_GPIO which provides simple memory mapped GPIOs specific to powerpc. However, the only platform which selects this option is mpc5200, and this platform doesn't use it. There are three boards calling simple_gpiochip_init(), but as they don't select CONFIG_SIMPLE_GPIO, this is just a nop. Simple_gpio is just redundant with the generic MMIO GPIO driver which can be found in driver/gpio/ and selected via CONFIG_GPIO_GENERIC_PLATFORM, so drop simple_gpio driver. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/bf930402613b41b42d0441b784e0cc43fc18d1fb.1572529632.git.christophe.leroy@c-s.fr commit ee5a489fd9645104925e5cdf8f8e455d833730b9 Merge: e2193c933429 196e8ca74886 Author: David S. Miller Date: Wed Nov 20 18:11:23 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2019-11-20 The following pull-request contains BPF updates for your *net-next* tree. We've added 81 non-merge commits during the last 17 day(s) which contain a total of 120 files changed, 4958 insertions(+), 1081 deletions(-). There are 3 trivial conflicts, resolve it by always taking the chunk from 196e8ca74886c433: <<<<<<< HEAD ======= void *bpf_map_area_mmapable_alloc(u64 size, int numa_node); >>>>>>> 196e8ca74886c433dcfc64a809707074b936aaf5 <<<<<<< HEAD void *bpf_map_area_alloc(u64 size, int numa_node) ======= static void *__bpf_map_area_alloc(u64 size, int numa_node, bool mmapable) >>>>>>> 196e8ca74886c433dcfc64a809707074b936aaf5 <<<<<<< HEAD if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) { ======= /* kmalloc()'ed memory can't be mmap()'ed */ if (!mmapable && size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) { >>>>>>> 196e8ca74886c433dcfc64a809707074b936aaf5 The main changes are: 1) Addition of BPF trampoline which works as a bridge between kernel functions, BPF programs and other BPF programs along with two new use cases: i) fentry/fexit BPF programs for tracing with practically zero overhead to call into BPF (as opposed to k[ret]probes) and ii) attachment of the former to networking related programs to see input/output of networking programs (covering xdpdump use case), from Alexei Starovoitov. 2) BPF array map mmap support and use in libbpf for global data maps; also a big batch of libbpf improvements, among others, support for reading bitfields in a relocatable manner (via libbpf's CO-RE helper API), from Andrii Nakryiko. 3) Extend s390x JIT with usage of relative long jumps and loads in order to lift the current 64/512k size limits on JITed BPF programs there, from Ilya Leoshkevich. 4) Add BPF audit support and emit messages upon successful prog load and unload in order to have a timeline of events, from Daniel Borkmann and Jiri Olsa. 5) Extension to libbpf and xdpsock sample programs to demo the shared umem mode (XDP_SHARED_UMEM) as well as RX-only and TX-only sockets, from Magnus Karlsson. 6) Several follow-up bug fixes for libbpf's auto-pinning code and a new API call named bpf_get_link_xdp_info() for retrieving the full set of prog IDs attached to XDP, from Toke Høiland-Jørgensen. 7) Add BTF support for array of int, array of struct and multidimensional arrays and enable it for skb->cb[] access in kfree_skb test, from Martin KaFai Lau. 8) Fix AF_XDP by using the correct number of channels from ethtool, from Luigi Rizzo. 9) Two fixes for BPF selftest to get rid of a hang in test_tc_tunnel and to avoid xdping to be run as standalone, from Jiri Benc. 10) Various BPF selftest fixes when run with latest LLVM trunk, from Yonghong Song. 11) Fix a memory leak in BPF fentry test run data, from Colin Ian King. 12) Various smaller misc cleanups and improvements mostly all over BPF selftests and samples, from Daniel T. Lee, Andre Guedes, Anders Roxell, Mao Wenan, Yue Haibing. ==================== Signed-off-by: David S. Miller commit 17eee668b3cad423a47c090fe2275733c55db910 Merge: 30c185da7692 9786b65bc61a Author: Dave Airlie Date: Thu Nov 21 10:19:38 2019 +1000 Merge tag 'drm-misc-next-fixes-2019-11-20' of git://anongit.freedesktop.org/drm/drm-misc into drm-next - Fix ttm bo refcnt when using the new gem obj mmap hook (Thomas) Cc: Gerd Hoffmann Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20191120204946.GA120328@art_vandelay commit 7b8474466ed97be458c825f34a85f2c2b84c3f95 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Thu Nov 21 00:03:03 2019 +0000 time: Zero the upper 32-bits in __kernel_timespec on 32-bit On compat interfaces, the high order bits of nanoseconds should be zeroed out. This is because the application code or the libc do not guarantee zeroing of these. If used without zeroing, kernel might be at risk of using timespec values incorrectly. Originally it was handled correctly, but lost during is_compat_syscall() cleanup. Revert the condition back to check CONFIG_64BIT. Fixes: 98f76206b335 ("compat: Cleanup in_compat_syscall() callers") Reported-by: Ben Hutchings Signed-off-by: Dmitry Safonov Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191121000303.126523-1-dima@arista.com commit eb01fedc3d539f9443082aa2384c5d1ca26ed5c1 Author: Alexei Starovoitov Date: Wed Nov 20 18:32:25 2019 -0500 ftrace: Return ENOTSUPP when DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not configured When CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not set it's best to have the stub functions return ENOTSUPP instead of ENODEV, otherwise ENODEV is a valid error when ip is incorrect which is indistinguishable from ftrace not compiled in. Link: http://lkml.kernel.org/r/CAADnVQ+OzTikM9EhrfsC7NFsVYhATW1SVHxK64w3xn9qpk81pg@mail.gmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Steven Rostedt (VMware) commit bae26849372b83c65da73d19ff58e987d70e6600 Author: Vidya Sagar Date: Wed Nov 20 10:47:42 2019 +0530 PCI/PM: Move pci_dev_wait() definition earlier Move the definition of pci_dev_wait() above pci_power_up() so that it can be called from the latter with no change in functionality. This is a pure code move with no functional change. Link: https://lore.kernel.org/r/20191120051743.23124-1-vidyas@nvidia.com Signed-off-by: Vidya Sagar Signed-off-by: Bjorn Helgaas commit ad9001f2f41198784b0423646450ba2cb24793a3 Author: Mika Westerberg Date: Tue Nov 12 12:16:17 2019 +0300 PCI/PM: Add missing link delays required by the PCIe spec Currently Linux does not follow PCIe spec regarding the required delays after reset. A concrete example is a Thunderbolt add-in-card that consists of a PCIe switch and two PCIe endpoints: +-1b.0-[01-6b]----00.0-[02-6b]--+-00.0-[03]----00.0 TBT controller +-01.0-[04-36]-- DS hotplug port +-02.0-[37]----00.0 xHCI controller \-04.0-[38-6b]-- DS hotplug port The root port (1b.0) and the PCIe switch downstream ports are all PCIe Gen3 so they support 8GT/s link speeds. We wait for the PCIe hierarchy to enter D3cold (runtime): pcieport 0000:00:1b.0: power state changed by ACPI to D3cold When it wakes up from D3cold, according to the PCIe 5.0 section 5.8 the PCIe switch is put to reset and its power is re-applied. This means that we must follow the rules in PCIe 5.0 section 6.6.1. For the PCIe Gen3 ports we are dealing with here, the following applies: With a Downstream Port that supports Link speeds greater than 5.0 GT/s, software must wait a minimum of 100 ms after Link training completes before sending a Configuration Request to the device immediately below that Port. Software can determine when Link training completes by polling the Data Link Layer Link Active bit or by setting up an associated interrupt (see Section 6.7.3.3). Translating this into the above topology we would need to do this (DLLLA stands for Data Link Layer Link Active): 0000:00:1b.0: wait for 100 ms after DLLLA is set before access to 0000:01:00.0 0000:02:00.0: wait for 100 ms after DLLLA is set before access to 0000:03:00.0 0000:02:02.0: wait for 100 ms after DLLLA is set before access to 0000:37:00.0 I've instrumented the kernel with some additional logging so we can see the actual delays performed: pcieport 0000:00:1b.0: power state changed by ACPI to D0 pcieport 0000:00:1b.0: waiting for D3cold delay of 100 ms pcieport 0000:00:1b.0: waiting for D3hot delay of 10 ms pcieport 0000:02:01.0: waiting for D3hot delay of 10 ms pcieport 0000:02:04.0: waiting for D3hot delay of 10 ms For the switch upstream port (01:00.0 reachable through 00:1b.0 root port) we wait for 100 ms but not taking into account the DLLLA requirement. We then wait 10 ms for D3hot -> D0 transition of the root port and the two downstream hotplug ports. This means that we deviate from what the spec requires. Performing the same check for system sleep (s2idle) transitions it turns out to be even worse. None of the mandatory delays are performed. If this would be S3 instead of s2idle then according to PCI FW spec 3.2 section 4.6.8. there is a specific _DSM that allows the OS to skip the delays but this platform does not provide the _DSM and does not go to S3 anyway so no firmware is involved that could already handle these delays. On this particular platform these delays are not actually needed because there is an additional delay as part of the ACPI power resource that is used to turn on power to the hierarchy but since that additional delay is not required by any of standards (PCIe, ACPI) it is not present in the Intel Ice Lake, for example where missing the mandatory delays causes pciehp to start tearing down the stack too early (links are not yet trained). Below is an example how it looks like when this happens: pcieport 0000:83:04.0: pciehp: Slot(4): Card not present pcieport 0000:87:04.0: PME# disabled pcieport 0000:83:04.0: pciehp: pciehp_unconfigure_device: domain:bus:dev = 0000:86:00 pcieport 0000:86:00.0: Refused to change power state, currently in D3 pcieport 0000:86:00.0: restoring config space at offset 0x3c (was 0xffffffff, writing 0x201ff) pcieport 0000:86:00.0: restoring config space at offset 0x38 (was 0xffffffff, writing 0x0) ... There is also one reported case (see the bugzilla link below) where the missing delay causes xHCI on a Titan Ridge controller fail to runtime resume when USB-C dock is plugged. This does not involve pciehp but instead the PCI core fails to runtime resume the xHCI device: pcieport 0000:04:02.0: restoring config space at offset 0xc (was 0x10000, writing 0x10020) pcieport 0000:04:02.0: restoring config space at offset 0x4 (was 0x100000, writing 0x100406) xhci_hcd 0000:39:00.0: Refused to change power state, currently in D3 xhci_hcd 0000:39:00.0: restoring config space at offset 0x3c (was 0xffffffff, writing 0x1ff) xhci_hcd 0000:39:00.0: restoring config space at offset 0x38 (was 0xffffffff, writing 0x0) ... Add a new function pci_bridge_wait_for_secondary_bus() that is called on PCI core resume and runtime resume paths accordingly if the bridge entered D3cold (and thus went through reset). This is second attempt to add the missing delays. The previous solution in c2bf1fc212f7 ("PCI: Add missing link delays required by the PCIe spec") was reverted because of two issues it caused: 1. One system become unresponsive after S3 resume due to PME service spinning in pcie_pme_work_fn(). The root port in question reports that the xHCI sent PME but the xHCI device itself does not have PME status set. The PME status bit is never cleared in the root port resulting the indefinite loop in pcie_pme_work_fn(). 2. Slows down resume if the root/downstream port does not support Data Link Layer Active Reporting because pcie_wait_for_link_delay() waits 1100 ms in that case. This version should avoid the above issues because we restrict the delay to happen only if the port went into D3cold. Link: https://lore.kernel.org/linux-pci/SL2P216MB01878BBCD75F21D882AEEA2880C60@SL2P216MB0187.KORP216.PROD.OUTLOOK.COM/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=203885 Link: https://lore.kernel.org/r/20191112091617.70282-3-mika.westerberg@linux.intel.com Reported-by: Kai-Heng Feng Tested-by: Kai-Heng Feng Signed-off-by: Mika Westerberg Signed-off-by: Bjorn Helgaas commit 4827d63891b6a839dac49c6ab62e61c4b011c4f2 Author: Mika Westerberg Date: Tue Nov 12 12:16:16 2019 +0300 PCI/PM: Add pcie_wait_for_link_delay() Add pcie_wait_for_link_delay(). Similar to pcie_wait_for_link() but allows passing custom activation delay in milliseconds. Link: https://lore.kernel.org/r/20191112091617.70282-2-mika.westerberg@linux.intel.com Signed-off-by: Mika Westerberg Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 327ccbbcc1497bff6d6f543c1f37c43a1653671f Author: Bjorn Helgaas Date: Thu Aug 1 11:50:56 2019 -0500 PCI/PM: Return error when changing power state from D3cold pci_raw_set_power_state() uses the Power Management capability to change a device's power state. The capability is in config space, which is accessible in D0, D1, D2, and D3hot, but not in D3cold. If we call pci_raw_set_power_state() on a device that's in D3cold, config reads fail and return ~0 data, which we erroneously interpreted as "the device is in D3hot", leading to messages like this: pcieport 0000:03:00.0: Refused to change power state, currently in D3 The PCI_PM_CTRL has several RsvdP fields, so ~0 is never a valid register value. If we get that value, print a more informative message and return an error. Changing the power state of a device from D3cold must be done by a platform power management method or some other non-config space mechanism. Link: https://lore.kernel.org/r/20190822200551.129039-4-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki Reviewed-by: Keith Busch Reviewed-by: Mika Westerberg commit e43f15ea2f6d6858675fa1baa5cb624f17269af0 Author: Bjorn Helgaas Date: Fri Aug 2 18:47:22 2019 -0500 PCI/PM: Decode D3cold power state correctly Use pci_power_name() to print pci_power_t correctly. This changes: "state 0" or "D0" to "D0" "state 1" or "D1" to "D1" "state 2" or "D2" to "D2" "state 3" or "D3" to "D3hot" "state 4" or "D4" to "D3cold" Changes dmesg logging only, no other functional change intended. Link: https://lore.kernel.org/r/20190822200551.129039-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki Reviewed-by: Keith Busch Reviewed-by: Mika Westerberg commit 9c77e63bd8dcbb3b59294e9176c00c5fcab3c9c6 Author: Rafael J. Wysocki Date: Tue Nov 5 17:32:08 2019 +0100 PCI/PM: Fold __pci_complete_power_transition() into its caller Because pci_set_power_state() has become the only caller of __pci_complete_power_transition(), there is no need for the latter to be a separate function any more, so fold it into the former, drop a redundant check and reduce the number of lines of code somewhat. Code rearrangement, no intentional functional impact. Link: https://lore.kernel.org/r/15576968.k611qn3UU0@kreacher Signed-off-by: Rafael J. Wysocki Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit d6aa37cd04fdafaf31ae89691e537535df43ca78 Author: Rafael J. Wysocki Date: Tue Nov 5 11:30:36 2019 +0100 PCI/PM: Avoid exporting __pci_complete_power_transition() Notice that radeon_set_suspend(), which is the only caller of __pci_complete_power_transition() outside of pci.c, really only cares about the pci_platform_power_transition() invoked by it, so export the latter instead of it, update the radeon driver to call pci_platform_power_transition() directly and make __pci_complete_power_transition() static. Code rearrangement, no intentional functional impact. Link: https://lore.kernel.org/r/1731661.ykamz2Tiuf@kreacher Signed-off-by: Rafael J. Wysocki Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit dc2256b0735d03664a92a6cb94ea4e564dfa237b Author: Rafael J. Wysocki Date: Tue Nov 5 11:29:16 2019 +0100 PCI/PM: Fold __pci_start_power_transition() into its caller Because pci_power_up() has become the only caller of __pci_start_power_transition(), there is no need for the latter to be a separate function any more, so fold it into the former, drop a redundant check and reduce the number of lines of code somewhat. Code rearrangement, no intentional functional impact. Link: https://lore.kernel.org/r/3458080.lsoDbfkST9@kreacher Signed-off-by: Rafael J. Wysocki Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit adfac8f6b7396b408fa9a8f40ea41112bebb980f Author: Rafael J. Wysocki Date: Tue Nov 5 11:27:49 2019 +0100 PCI/PM: Use pci_power_up() in pci_set_power_state() Make it explicitly clear that the code to put devices into D0 in pci_set_power_state() and in pci_pm_default_resume_early() is the same by making the latter use pci_power_up() for transitions into D0. Code rearrangement, no intentional functional impact. Link: https://lore.kernel.org/r/2520019.OZ1nXS5aSj@kreacher Signed-off-by: Rafael J. Wysocki Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit 81cfa5908fd6fe610b7c47b742fe30d6d897ba0f Author: Rafael J. Wysocki Date: Tue Nov 5 11:13:43 2019 +0100 PCI/PM: Move power state update away from pci_power_up() Move the invocation of pci_update_current_state() from pci_power_up() to pci_pm_default_resume_early(), which is the only caller of that function. Preparatory change, no functional impact. Link: https://lore.kernel.org/r/37482337.udjOGdOKNb@kreacher Signed-off-by: Rafael J. Wysocki Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg commit 1a1daf097e21e544dd3e7c0ff620d78a9795fbf2 Author: Bjorn Helgaas Date: Thu Oct 31 17:37:54 2019 -0500 PCI/PM: Remove unused pci_driver.suspend_late() hook The struct pci_driver.suspend_late() hook is one of the legacy PCI power management callbacks, and there are no remaining users of it. Remove it. Link: https://lore.kernel.org/r/20191101204558.210235-7-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 89cdbc3546354c359558a1809133902028c57da4 Author: Bjorn Helgaas Date: Thu Oct 31 17:53:04 2019 -0500 PCI/PM: Remove unused pci_driver.resume_early() hook The struct pci_driver.resume_early() hook is one of the legacy PCI power management callbacks, and there are no remaining users of it. Remove it. Link: https://lore.kernel.org/r/20191101204558.210235-6-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 77b84bb306fd0d5d1d3a4bf1f2acf73dc971e372 Author: Bjorn Helgaas Date: Fri Nov 1 08:20:40 2019 -0500 xen-platform: Convert to generic power management Convert xen-platform from the legacy PCI power management callbacks to the generic operations. This is one step towards removing support for the legacy PCI callbacks. The generic .resume_noirq() operation is called by pci_pm_resume_noirq() at the same point the legacy PCI .resume_early() callback was, so this patch should not change the xen-platform behavior. Link: https://lore.kernel.org/r/20191101204558.210235-5-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Cc: Stefano Stabellini Cc: KarimAllah Ahmed commit baef7f8e5e91f85ce7625c11370479f9f0778fae Author: Bjorn Helgaas Date: Wed Oct 16 15:23:20 2019 -0500 PCI/PM: Simplify pci_set_power_state() Check for the PCI_DEV_FLAGS_NO_D3 quirk early, before calling __pci_start_power_transition(). This way all the cases where we don't need to do anything at all are checked up front. This doesn't fix anything because if the caller requested D3hot or D3cold, __pci_start_power_transition() is a no-op. But calling it is pointless and makes the code harder to analyze. Link: https://lore.kernel.org/r/20191101204558.210235-4-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 993cc6d1bd3af734693a74a3ccc9445dd5b31f9c Author: Bjorn Helgaas Date: Mon Oct 28 08:27:00 2019 -0500 PCI/PM: Expand PM reset messages to mention D3hot (not just D3) pci_pm_reset() resets a device by putting it in D3hot and bringing it back to D0. Clarify related messages to mention "D3hot" explicitly instead of just "D3". Link: https://lore.kernel.org/r/20191101204558.210235-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 7e24bc347e57992d532bc2ed700209b0fc0a4bf5 Author: Bjorn Helgaas Date: Wed Oct 23 17:40:52 2019 -0500 PCI/PM: Apply D2 delay as milliseconds, not microseconds PCI_PM_D2_DELAY is defined as 200, which is milliseconds, but previously we used udelay(), which only waited for 200 microseconds. Use msleep() instead so we wait the correct amount of time. See PCIe r5.0, sec 5.9. Link: https://lore.kernel.org/r/20191101204558.210235-2-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 12bcae44bf48595c71898330076576075590e15b Author: Bjorn Helgaas Date: Mon Oct 7 07:52:28 2019 -0500 PCI/PM: Use pci_WARN() to include device information Add and use pci_WARN() wrappers so warnings include device information. Link: https://lore.kernel.org/r/20191017212851.54237-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 6941a0c2bdedfb729fb166091e12d06e4fce177f Author: Bjorn Helgaas Date: Mon Oct 7 07:55:18 2019 -0500 PCI/PM: Use PCI dev_printk() wrappers for consistency Use the PCI dev_printk() wrappers for consistency with the rest of the PCI core. No functional change intended. Link: https://lore.kernel.org/r/20191017212851.54237-2-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit b64cf7a1711d7796fdac19a23bc63d378a6e7ed1 Author: Bjorn Helgaas Date: Tue Oct 8 15:25:23 2019 -0500 PCI/PM: Wrap long lines in documentation Documentation/power/pci.rst is wrapped to fit in 80 columns, but directory structure changes made a few lines longer. Wrap them so they all fit in 80 columns again. Link: https://lore.kernel.org/r/20191014230016.240912-7-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 85a9b0507db2fbbfe7912dc3b33d322f200e2ca7 Author: Bjorn Helgaas Date: Tue Oct 8 15:28:00 2019 -0500 PCI/PM: Note that PME can be generated from D0 Per PCIe r5.0 sec 7.5.2.1, PME may be generated from D0, so update Documentation/power/pci.rst to reflect that. Link: https://lore.kernel.org/r/20191016194450.68959-1-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 6da2f2ccfd2deb81a63fc23a505ccd72de005c39 Author: Bjorn Helgaas Date: Mon Oct 14 13:46:50 2019 -0500 PCI/PM: Make power management op coding style consistent Some of the power management ops use this style: struct device_driver *drv = dev->driver; if (drv && drv->pm && drv->pm->prepare(dev)) drv->pm->prepare(dev); while others use this: const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; if (pm && pm->runtime_resume) pm->runtime_resume(dev); Convert the first style to the second so they're all consistent. Remove local "error" variables when unnecessary. No functional change intended. Link: https://lore.kernel.org/r/20191014230016.240912-6-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit f7b32a86e455b035dd45a334c203abf6fe118cf3 Author: Bjorn Helgaas Date: Sat Oct 12 17:15:57 2019 -0500 PCI/PM: Run resume fixups before disabling wakeup events pci_pm_resume() and pci_pm_restore() call pci_pm_default_resume(), which runs resume fixups before disabling wakeup events: static void pci_pm_default_resume(struct pci_dev *pci_dev) { pci_fixup_device(pci_fixup_resume, pci_dev); pci_enable_wake(pci_dev, PCI_D0, false); } pci_pm_runtime_resume() does both of these, but in the opposite order: pci_enable_wake(pci_dev, PCI_D0, false); pci_fixup_device(pci_fixup_resume, pci_dev); We should always use the same ordering unless there's a reason to do otherwise. Change pci_pm_runtime_resume() to call pci_pm_default_resume() instead of open-coding this, so the fixups are always done before disabling wakeup events. pci_pm_default_resume() is called from pci_pm_runtime_resume(), which is under #ifdef CONFIG_PM. If SUSPEND and HIBERNATION are disabled, PM_SLEEP is disabled also, so move pci_pm_default_resume() from #ifdef CONFIG_PM_SLEEP to #ifdef CONFIG_PM. Link: https://lore.kernel.org/r/20191014230016.240912-5-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit ec6a75ef8e33fe33f963b916fd902c52a0be33ff Author: Bjorn Helgaas Date: Thu Oct 10 16:54:36 2019 -0500 PCI/PM: Clear PCIe PME Status even for legacy power management Previously, pci_pm_resume_noirq() cleared the PME Status bit in the Root Status register only if the device had no driver or the driver did not implement legacy power management. It should clear PME Status regardless of what sort of power management the driver supports, so do this before checking for legacy power management. This affects Root Ports and Root Complex Event Collectors, for which the usual driver is the PCIe portdrv, which implements new power management, so this change is just on principle, not to fix any actual defects. Fixes: a39bd851dccf ("PCI/PM: Clear PCIe PME Status bit in core, not PCIe port driver") Link: https://lore.kernel.org/r/20191014230016.240912-4-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit dc68b406783edf33af0e997fb98e9e048b4d46e8 Author: Bjorn Helgaas Date: Mon Oct 14 14:14:06 2019 -0500 PCI/PM: Correct pci_pm_thaw_noirq() documentation According to the documentation, pci_pm_thaw_noirq() did not put the device into the full-power state and restore its standard configuration registers. This is incorrect, so update the documentation to match the code. Link: https://lore.kernel.org/r/20191014230016.240912-3-helgaas@kernel.org Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit f2c33ccacb2d4bbeae2a255a7ca0cbfd03017b7c Author: Dexuan Cui Date: Wed Aug 14 01:06:55 2019 +0000 PCI/PM: Always return devices to D0 when thawing pci_pm_thaw_noirq() is supposed to return the device to D0 and restore its configuration registers, but previously it only did that for devices whose drivers implemented the new power management ops. Hibernation, e.g., via "echo disk > /sys/power/state", involves freezing devices, creating a hibernation image, thawing devices, writing the image, and powering off. The fact that thawing did not return devices with legacy power management to D0 caused errors, e.g., in this path: pci_pm_thaw_noirq if (pci_has_legacy_pm_support(pci_dev)) # true for Mellanox VF driver return pci_legacy_resume_early(dev) # ... legacy PM skips the rest pci_set_power_state(pci_dev, PCI_D0) pci_restore_state(pci_dev) pci_pm_thaw if (pci_has_legacy_pm_support(pci_dev)) pci_legacy_resume drv->resume mlx4_resume ... pci_enable_msix_range ... if (dev->current_state != PCI_D0) # <--- return -EINVAL; which caused these warnings: mlx4_core a6d1:00:02.0: INTx is not supported in multi-function mode, aborting PM: dpm_run_callback(): pci_pm_thaw+0x0/0xd7 returns -95 PM: Device a6d1:00:02.0 failed to thaw: error -95 Return devices to D0 and restore config registers for all devices, not just those whose drivers support new power management. [bhelgaas: also call pci_restore_state() before pci_legacy_resume_early(), update comment, add stable tag, commit log] Link: https://lore.kernel.org/r/KU1P153MB016637CAEAD346F0AA8E3801BFAD0@KU1P153MB0166.APCP153.PROD.OUTLOOK.COM Signed-off-by: Dexuan Cui Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki Cc: stable@vger.kernel.org # v4.13+ commit 30c185da7692b7aa65316b4644fd62f76a50a649 Merge: c22fe762ba91 0122baaa93cc Author: Dave Airlie Date: Thu Nov 21 09:17:02 2019 +1000 Merge tag 'drm-intel-next-fixes-2019-11-20' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Includes gvt-next-fixes-2019-11-12 - Fix Bugzilla #112051: Fix detection for a CMP-V PCH - Fix Bugzilla #112256: Corrupted page table at address on plymouth splash - Fix Bugzilla #111594: Avoid losing RC6 when HuC authentication is used - Fix for OA/perf metric coherency, restore GT coarse power gating workaround - Avoid atomic context on error capture - Avoid MST bitmask overflowing to EDP/DPI input select - Fixes to CI found dmesg splats Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20191120204035.GA14908@jlahtine-desk.ger.corp.intel.com commit 40d47c155e8ae9bcb3f2d0d01cf14d903c664726 Author: Dmitry Monakhov Date: Fri Nov 1 13:11:10 2019 +0000 block,bfq: Skip tracing hooks if possible In most cases blk_tracing is not active, but bfq_log_bfqq macro generate pid_str unconditionally, which result in significant overhead. ## Test modprobe null_blk echo bfq > /sys/block/nullb0/queue/scheduler fio --name=t --ioengine=libaio --direct=1 --filename=/dev/nullb0 \ --runtime=30 --time_based=1 --rw=write --iodepth=128 --bs=4k # Results | | baseline | w/ patch | gain | | iops | 113.19K | 126.42K | +11% | Acked-by: Paolo Valente Signed-off-by: Dmitry Monakhov Signed-off-by: Jens Axboe commit c22fe762ba91380d3167b742bab4ff5e99ad84a2 Merge: 17cc51390c14 622b2a0ab647 Author: Dave Airlie Date: Thu Nov 21 08:52:26 2019 +1000 Merge tag 'drm-next-5.5-2019-11-15' of git://people.freedesktop.org/~agd5f/linux into drm-next drm-next-5.5-2019-11-15: amdgpu: - Fix AVFS handling on SMU7 parts with custom power tables - Enable Overdrive sysfs interface for Navi parts - Fix power limit handling on smu11 parts - Fix pcie link sysfs output for Navi - Probably cancel MM worker threads on shutdown radeon: - Cleanup for ppc change Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20191115163516.3714-1-alexander.deucher@amd.com commit e3cb0c7102f04c83bf1a7cb1d052e92749310b46 Author: Alexander Duyck Date: Wed Nov 20 14:25:53 2019 -0800 x86/ioperm: Fix use of deprecated config option The commit 111e7b15cf10 ("x86/ioperm: Extend IOPL config to control ioperm() as well") replaced X86_IOPL_EMULATION with X86_IOPL_IOPERM. However it appears that there was at least one spot missed as tss_update_io_bitmap() still had a reference to it contained in the code. The result of this is that it exposed a NULL pointer dereference as seen below with a linux-next next-20191120 kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 5 PID: 1542 Comm: ovs-vswitchd Tainted: G W 5.4.0-rc8-next-20191120 #125 RIP: 0010:tss_update_io_bitmap+0x4e/0x180 Code: 10 31 c0 65 48 03 1d 69 54 5d 6d 65 48 8b 04 25 40 8c 01 00 48 8b 10 \ f7 c2 00 00 40 00 0f 84 8c 00 00 00 4c 8b a0 c0 22 00 00 <49> 8b 04 \ 24 48 39 43 68 74 2e 8b 53 70 41 39 54 24 0c 48 8d 7b 78 RSP: 0018:ffffb8888a0ebf08 EFLAGS: 00010006 RAX: ffff8a429811a680 RBX: ffff8a4c3f946000 RCX: 0000000000000011 RDX: 0000000000400080 RSI: 0000000000400080 RDI: 0000000000000000 RBP: ffffb8888a0ebf30 R08: 00007ffffb5d7ce0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f68a9635c40(0000) GS:ffff8a4c3f940000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000103572a001 CR4: 00000000001606e0 Call Trace: ? syscall_slow_exit_work+0x39/0xdb do_syscall_64+0x1a5/0x200 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f68a7aff797 Fixes: 111e7b15cf10 ("x86/ioperm: Extend IOPL config to control ioperm() as well") Signed-off-by: Alexander Duyck Signed-off-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: "H. Peter Anvin" Cc: Andy Lutomirski Cc: Ingo Molnar Cc: Rik van Riel Cc: x86-ml Link: https://lkml.kernel.org/r/20191120222426.3060.18462.stgit@localhost.localdomain commit f612b2132db529feac4f965f28a1b9258ea7c22b Author: Mike Snitzer Date: Wed Nov 20 17:27:39 2019 -0500 Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues" This reverts commit a1b89132dc4f61071bdeaab92ea958e0953380a1. Revert required hand-patching due to subsequent changes that were applied since commit a1b89132dc4f61071bdeaab92ea958e0953380a1. Requires: ed0302e83098d ("dm crypt: make workqueue names device-specific") Cc: stable@vger.kernel.org Bug: https://bugzilla.kernel.org/show_bug.cgi?id=199857 Reported-by: Vito Caputo Signed-off-by: Mike Snitzer commit 196e8ca74886c433dcfc64a809707074b936aaf5 Author: Daniel Borkmann Date: Wed Nov 20 23:04:44 2019 +0100 bpf: Switch bpf_map_{area_alloc,area_mmapable_alloc}() to u64 size Given we recently extended the original bpf_map_area_alloc() helper in commit fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY"), we need to apply the same logic as in ff1c08e1f74b ("bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()"). To avoid conflicts, extend it for bpf-next. Reported-by: Stephen Rothwell Signed-off-by: Daniel Borkmann commit 91e6015b082b08a74e5d9d326f651e5890a93519 Author: Daniel Borkmann Date: Wed Nov 20 22:38:16 2019 +0100 bpf: Emit audit messages upon successful prog load and unload Allow for audit messages to be emitted upon BPF program load and unload for having a timeline of events. The load itself is in syscall context, so additional info about the process initiating the BPF prog creation can be logged and later directly correlated to the unload event. The only info really needed from BPF side is the globally unique prog ID where then audit user space tooling can query / dump all info needed about the specific BPF program right upon load event and enrich the record, thus these changes needed here can be kept small and non-intrusive to the core. Raw example output: # auditctl -D # auditctl -a always,exit -F arch=x86_64 -S bpf # ausearch --start recent -m 1334 [...] ---- time->Wed Nov 20 12:45:51 2019 type=PROCTITLE msg=audit(1574271951.590:8974): proctitle="./test_verifier" type=SYSCALL msg=audit(1574271951.590:8974): arch=c000003e syscall=321 success=yes exit=14 a0=5 a1=7ffe2d923e80 a2=78 a3=0 items=0 ppid=742 pid=949 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="test_verifier" exe="/root/bpf-next/tools/testing/selftests/bpf/test_verifier" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=UNKNOWN[1334] msg=audit(1574271951.590:8974): auid=0 uid=0 gid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=949 comm="test_verifier" exe="/root/bpf-next/tools/testing/selftests/bpf/test_verifier" prog-id=3260 event=LOAD ---- time->Wed Nov 20 12:45:51 2019 type=UNKNOWN[1334] msg=audit(1574271951.590:8975): prog-id=3260 event=UNLOAD ---- [...] Signed-off-by: Daniel Borkmann Signed-off-by: Jiri Olsa Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191120213816.8186-1-jolsa@kernel.org commit 9d09e5a95c54d2b0cbb4ae00929edbcadc847c7f Author: Bjorn Helgaas Date: Tue Oct 15 17:11:22 2019 -0500 PCI: Fix typos Fix typos in drivers/pci. Comment and whitespace changes only. Signed-off-by: Bjorn Helgaas commit e2193c9334291ecdc437cdbd9fe9ac35c14fffa8 Merge: e2ffe3ff6f5e df0120f12f93 Author: David S. Miller Date: Wed Nov 20 12:50:25 2019 -0800 Merge branch 'r8169-smaller-improvements-to-firmware-handling' Heiner Kallweit says: ==================== r8169: smaller improvements to firmware handling This series includes few smaller improvements to firmware handling. ==================== Signed-off-by: David S. Miller commit df0120f12f93f2e11eb67d00ed8270de92d0134d Author: Heiner Kallweit Date: Wed Nov 20 21:08:47 2019 +0100 r8169: add check for PHY_MDIO_CHG to rtl_nic_fw_data_ok Only values 0 and 1 are currently defined as parameters for PHY_MDIO_CHG. Instead of silently ignoring unknown values and misinterpreting the firmware code let's explicitly check. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit cfccde80e8b1d935e611d40c0f0bba3ed0557bd8 Author: Heiner Kallweit Date: Wed Nov 20 21:07:41 2019 +0100 r8169: use macro FIELD_SIZEOF in definition of FW_OPCODE_SIZE Using macro FIELD_SIZEOF makes this define easier understandable. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit e20c43dbdf960e8a03381aa455ddea56504bdbc4 Author: Heiner Kallweit Date: Wed Nov 20 21:06:58 2019 +0100 r8169: change mdelay to msleep in rtl_fw_write_firmware We're not in atomic context here, therefore switch to msleep. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit e2ffe3ff6f5e18325c7a5500acd102a67fac078f Author: Thomas Bogendoerfer Date: Wed Nov 20 17:02:36 2019 +0100 net: ipconfig: Wait for deferred device probes If network device drives are using deferred probing, it was possible that waiting for devices to show up in ipconfig was already over, when the device eventually showed up. By calling wait_for_device_probe() we now make sure deferred probing is done before checking for available devices. Signed-off-by: Thomas Bogendoerfer Signed-off-by: David S. Miller commit 2be8ca97d07e1133e81cd3977bd1f94058b65489 Author: Mao Wenan Date: Wed Nov 20 16:56:34 2019 +0100 vsock/vmci: make vmci_vsock_cb_host_called static When using make C=2 drivers/misc/vmw_vmci/vmci_driver.o to compile, below warning can be seen: drivers/misc/vmw_vmci/vmci_driver.c:33:6: warning: symbol 'vmci_vsock_cb_host_called' was not declared. Should it be static? This patch make symbol vmci_vsock_cb_host_called static. Fixes: b1bba80a4376 ("vsock/vmci: register vmci_transport only when VMCI guest/host are active") Reported-by: Hulk Robot Signed-off-by: Mao Wenan Reported-by: kbuild test robot Signed-off-by: Stefano Garzarella Signed-off-by: David S. Miller commit e07e75412ba4a8e68f47de345da53847f343f337 Merge: cec2975f2b70 07e13edbb6a6 Author: David S. Miller Date: Wed Nov 20 12:34:37 2019 -0800 Merge branch 'page_pool-DMA-sync' Lorenzo Bianconi says: ==================== add DMA-sync-for-device capability to page_pool API Introduce the possibility to sync DMA memory for device in the page_pool API. This feature allows to sync proper DMA size and not always full buffer (dma_sync_single_for_device can be very costly). Please note DMA-sync-for-CPU is still device driver responsibility. Relying on page_pool DMA sync mvneta driver improves XDP_DROP pps of about 170Kpps: - XDP_DROP DMA sync managed by mvneta driver: ~420Kpps - XDP_DROP DMA sync managed by page_pool API: ~585Kpps Do not change naming convention for the moment since the changes will hit other drivers as well. I will address it in another series. Changes since v4: - do not allow the driver to set max_len to 0 - convert PP_FLAG_DMA_MAP/PP_FLAG_DMA_SYNC_DEV to BIT() macro Changes since v3: - move dma_sync_for_device before putting the page in ptr_ring in __page_pool_recycle_into_ring since ptr_ring can be consumed concurrently. Simplify the code moving dma_sync_for_device before running __page_pool_recycle_direct/__page_pool_recycle_into_ring Changes since v2: - rely on PP_FLAG_DMA_SYNC_DEV flag instead of dma_sync Changes since v1: - rename sync in dma_sync - set dma_sync_size to 0xFFFFFFFF in page_pool_recycle_direct and page_pool_put_page routines - Improve documentation ==================== Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 07e13edbb6a6a9a407d6772a355836270e924aa8 Author: Lorenzo Bianconi Date: Wed Nov 20 16:54:19 2019 +0200 net: mvneta: get rid of huge dma sync in mvneta_rx_refill Get rid of costly dma_sync_single_for_device in mvneta_rx_refill since now the driver can let page_pool API to manage needed DMA sync with a proper size. - XDP_DROP DMA sync managed by mvneta driver: ~420Kpps - XDP_DROP DMA sync managed by page_pool API: ~585Kpps Tested-by: Matteo Croce Signed-off-by: Lorenzo Bianconi Acked-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit e68bc75691cc3de608c2c7505057c948d13ae587 Author: Lorenzo Bianconi Date: Wed Nov 20 16:54:18 2019 +0200 net: page_pool: add the possibility to sync DMA memory for device Introduce the following parameters in order to add the possibility to sync DMA memory for device before putting allocated pages in the page_pool caches: - PP_FLAG_DMA_SYNC_DEV: if set in page_pool_params flags, all pages that the driver gets from page_pool will be DMA-synced-for-device according to the length provided by the device driver. Please note DMA-sync-for-CPU is still device driver responsibility - offset: DMA address offset where the DMA engine starts copying rx data - max_len: maximum DMA memory size page_pool is allowed to flush. This is currently used in __page_pool_alloc_pages_slow routine when pages are allocated from page allocator These parameters are supposed to be set by device drivers. This optimization reduces the length of the DMA-sync-for-device. The optimization is valid because pages are initially DMA-synced-for-device as defined via max_len. At RX time, the driver will perform a DMA-sync-for-CPU on the memory for the packet length. What is important is the memory occupied by packet payload, because this is the area CPU is allowed to read and modify. As we don't track cache-lines written into by the CPU, simply use the packet payload length as dma_sync_size at page_pool recycle time. This also take into account any tail-extend. Tested-by: Matteo Croce Signed-off-by: Lorenzo Bianconi Signed-off-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit f383b2950070ce4f34e74db94f70bb565b746e97 Author: Lorenzo Bianconi Date: Wed Nov 20 16:54:17 2019 +0200 net: mvneta: rely on page_pool_recycle_direct in mvneta_run_xdp Rely on page_pool_recycle_direct and not on xdp_return_buff in mvneta_run_xdp. This is a preliminary patch to limit the dma sync len to the one strictly necessary Signed-off-by: Lorenzo Bianconi Acked-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit cec2975f2b7058c42330a0f8164d94c6b7c8c446 Author: Gautam Ramakrishnan Date: Wed Nov 20 19:43:54 2019 +0530 net: sched: pie: enable timestamp based delay calculation RFC 8033 suggests an alternative approach to calculate the queue delay in PIE by using a timestamp on every enqueued packet. This patch adds an implementation of that approach and sets it as the default method to calculate queue delay. The previous method (based on Little's law) to calculate queue delay is set as optional. Signed-off-by: Gautam Ramakrishnan Signed-off-by: Leslie Monis Signed-off-by: Mohit P. Tahiliani Acked-by: Dave Taht Signed-off-by: David S. Miller commit c131280c03bd1c225c2e64e9ef75873ffca3d96e Author: Stephan Gerhold Date: Mon Nov 18 14:02:52 2019 +0100 drm/mcde: dsi: Fix invalid pointer dereference if panel cannot be found The "panel" pointer is not reset to NULL if of_drm_find_panel() returns an error. Therefore we later assume that a panel was found, and try to dereference the error pointer, resulting in: mcde-dsi a0351000.dsi: failed to find panel try bridge (4294966779) Unable to handle kernel paging request at virtual address fffffe03 PC is at drm_panel_bridge_add.part.0+0x10/0x5c LR is at mcde_dsi_bind+0x120/0x464 ... Reset "panel" to NULL to avoid this problem. Also change the format string of the error to %ld to print the negative errors correctly. The crash above then becomes: mcde-dsi a0351000.dsi: failed to find panel try bridge (-517) mcde-dsi a0351000.dsi: no panel or bridge ... Fixes: 5fc537bfd000 ("drm/mcde: Add new driver for ST-Ericsson MCDE") Signed-off-by: Stephan Gerhold Signed-off-by: Linus Walleij Link: https://patchwork.freedesktop.org/patch/msgid/20191118130252.170324-1-stephan@gerhold.net commit f01b437d1297f14a366c02427f7c07260ec1345b Author: Krzysztof Kozlowski Date: Wed Nov 20 21:41:20 2019 +0800 isdn: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 041ccdb620f0ec0590bb6899c2a8088d60cf14b8 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:40:44 2019 +0800 nfc: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 07def463829cc8f3def7ecbe45cb409992d3d33c Merge: 77c05d2f7306 21c4c60b7696 Author: David S. Miller Date: Wed Nov 20 12:05:24 2019 -0800 Merge branch 'cxgb4-add-TC-MATCHALL-classifier-offload' Rahul Lakkireddy says: ==================== cxgb4: add TC-MATCHALL classifier offload This series of patches add support to offload TC-MATCHALL classifier to hardware to classify all outgoing and incoming traffic on the underlying port. Only 1 egress and 1 ingress rule each can be offloaded on the underlying port. Patch 1 adds support for TC-MATCHALL classifier offload on the egress side. TC-POLICE is the only action that can be offloaded on the egress side and is used to rate limit all outgoing traffic to specified max rate. Patch 2 adds logic to reject the current rule offload if its priority conflicts with existing rules in the TCAM. Patch 3 adds support for TC-MATCHALL classifier offload on the ingress side. The same set of actions supported by existing TC-FLOWER classifier offload can be applied on all the incoming traffic. v5: - Fixed commit message and comment to include comparison for equal priority in patch 2. v4: - Removed check in patch 1 to reject police offload if prio is not 1. - Moved TC_SETUP_BLOCK code to separate function in patch 1. - Added logic to ensure the prio passed by TC doesn't conflict with other rules in TCAM in patch 2. - Higher index has lower priority than lower index in TCAM. So, rework cxgb4_get_free_ftid() to search free index from end of TCAM in descending order in patch 2. - Added check to ensure the matchall rule's prio doesn't conflict with other rules in TCAM in patch 3. - Added logic to fill default mask for VIID, if none has been provided, to prevent conflict with duplicate VIID rules in patch 3. - Used existing variables in private structure to fill VIID info, instead of extracting the info manually in patch 3. v3: - Added check in patch 1 to reject police offload if prio is not 1. - Assign block_shared variable only for TC_SETUP_BLOCK in patch 1. v2: - Added check to reject flow block sharing for policers in patch 1. - Removed logic to fetch free index from end of TCAM in patch 2. Must maintain the same ordering as in kernel. ==================== Signed-off-by: David S. Miller commit 21c4c60b7696346c48ed11478f4bffec6d1b2dcb Author: Rahul Lakkireddy Date: Wed Nov 20 05:46:08 2019 +0530 cxgb4: add TC-MATCHALL classifier ingress offload Add TC-MATCHALL classifier ingress offload support. The same actions supported by existing TC-FLOWER offload can be applied to all incoming traffic on the underlying interface. Ensure the rule priority doesn't conflict with existing rules in the TCAM. Only 1 ingress matchall rule can be active at a time on the underlying interface. v5: - No change. v4: - Added check to ensure the matchall rule's prio doesn't conflict with other rules in TCAM. - Added logic to fill default mask for VIID, if none has been provided, to prevent conflict with duplicate VIID rules. - Used existing variables in private structure to fill VIID info, instead of extracting the info manually. v3: - No change. v2: - Removed logic to fetch free index from end of TCAM. Must maintain same ordering as in kernel. Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit 41ec03e534ca450939edae01d9f2037a6262e6de Author: Rahul Lakkireddy Date: Wed Nov 20 05:46:07 2019 +0530 cxgb4: check rule prio conflicts before offload Only offload rule if it satisfies both of the following conditions: 1. The immediate previous rule has priority <= current rule's priority. 2. The immediate next rule has priority >= current rule's priority. Also rework free entry fetch logic to search from end of TCAM, instead of beginning, because higher indices have lower priority than lower indices. This is similar to how TC auto generates priority values. v5: - Fixed commit message and comment to include comparison for equal priority. v4: - Patch added in this version. Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit 4ec4762d8ec6edcfe59fd806472d2b7518debe52 Author: Rahul Lakkireddy Date: Wed Nov 20 05:46:06 2019 +0530 cxgb4: add TC-MATCHALL classifier egress offload Add TC-MATCHALL classifier offload with TC-POLICE action applied for all outgoing traffic on the underlying interface. Split flow block offload to support both egress and ingress classification. For example, to rate limit all outgoing traffic to 1 Gbps: $ tc qdisc add dev enp2s0f4 clsact $ tc filter add dev enp2s0f4 egress matchall skip_sw \ action police rate 1Gbit burst 8Kbit Note that skip_sw is important. Otherwise, both stack and hardware will end up doing policing. Policing can't be shared across flow blocks. Only 1 egress matchall rule can be active at a time on the underlying interface. v5: - No change. v4: - Removed check to reject police offload if prio is not 1. - Moved TC_SETUP_BLOCK code to separate function. v3: - Added check to reject police offload if prio is not 1. - Assign block_shared variable only for TC_SETUP_BLOCK. v2: - Added check to reject flow block sharing for policers. Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit 093edc2baad2c258b1f55d1ab9c63c2b5ae67e42 Author: Wei Yongjun Date: Wed Oct 30 03:40:46 2019 +0000 usb: gadget: configfs: Fix missing spin_lock_init() The driver allocates the spinlock but not initialize it. Use spin_lock_init() on it to initialize it correctly. This is detected by Coccinelle semantic patch. Fixes: 1a1c851bbd70 ("usb: gadget: configfs: fix concurrent issue between composite APIs") Signed-off-by: Wei Yongjun Cc: stable Reviewed-by: Peter Chen Link: https://lore.kernel.org/r/20191030034046.188808-1-weiyongjun1@huawei.com Signed-off-by: Greg Kroah-Hartman commit 77c05d2f73066e205f786c407964b97d11abb7f4 Merge: 1f12177b322d 6849c6d86bad Author: David S. Miller Date: Wed Nov 20 11:47:36 2019 -0800 Merge branch 'page_pool-API-for-numa-node-change-handling' Saeed Mahameed says: ==================== page_pool: API for numa node change handling This series extends page pool API to allow page pool consumers to update page pool numa node on the fly. This is required since on some systems, rx rings irqs can migrate between numa nodes, due to irq balancer or user defined scripts, current page pool has no way to know of such migration and will keep allocating and holding on to pages from a wrong numa node, which is bad for the consumer performance. 1) Add API to update numa node id of the page pool Consumers will call this API to update the page pool numa node id. 2) Don't recycle non-reusable pages: Page pool will check upon page return whether a page is suitable for recycling or not. 2.1) when it belongs to a different num node. 2.2) when it was allocated under memory pressure. 3) mlx5 will use the new API to update page pool numa id on demand. The series is a joint work between me and Jonathan, we tested it and it proved itself worthy to avoid page allocator bottlenecks and improve packet rate and cpu utilization significantly for the described scenarios above. Performance testing: XDP drop/tx rate and TCP single/multi stream, on mlx5 driver while migrating rx ring irq from close to far numa: mlx5 internal page cache was locally disabled to get pure page pool results. CPU: Intel(R) Xeon(R) CPU E5-2603 v4 @ 1.70GHz NIC: Mellanox Technologies MT27700 Family [ConnectX-4] (100G) XDP Drop/TX single core: NUMA | XDP | Before | After --------------------------------------- Close | Drop | 11 Mpps | 10.9 Mpps Far | Drop | 4.4 Mpps | 5.8 Mpps Close | TX | 6.5 Mpps | 6.5 Mpps Far | TX | 3.5 Mpps | 4 Mpps Improvement is about 30% drop packet rate, 15% tx packet rate for numa far test. No degradation for numa close tests. TCP single/multi cpu/stream: NUMA | #cpu | Before | After -------------------------------------- Close | 1 | 18 Gbps | 18 Gbps Far | 1 | 15 Gbps | 18 Gbps Close | 12 | 80 Gbps | 80 Gbps Far | 12 | 68 Gbps | 80 Gbps In all test cases we see improvement for the far numa case, and no impact on the close numa case. ================== Performance analysis and conclusions by Jesper [1]: Impact on XDP drop x86_64 is inconclusive and shows only 0.3459ns slow-down, as this is below measurement accuracy of system. v2->v3: - Rebase on top of latest net-next and Jesper's page pool object release patchset [2] - No code changes - Performance analysis by Jesper added to the cover letter. v1->v2: - Drop last patch, as requested by Ilias and Jesper. - Fix documentation's performance numbers order. [1] https://github.com/xdp-project/xdp-project/blob/master/areas/mem/page_pool04_inflight_changes.org#performance-notes [2] https://patchwork.ozlabs.org/cover/1192098/ ==================== Acked-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit 6849c6d86bada8bd269fe0ee0c4a93892ccaf2c3 Author: Saeed Mahameed Date: Wed Nov 20 00:15:21 2019 +0000 net/mlx5e: Rx, Update page pool numa node when changed Once every napi poll cycle, check if numa node is different than the page pool's numa id, and update it using page_pool_update_nid(). Alternatively, we could have registered an irq affinity change handler, but page_pool_update_nid() must be called from napi context anyways, so the handler won't actually help. Performance testing: XDP drop/tx rate and TCP single/multi stream, on mlx5 driver while migrating rx ring irq from close to far numa: mlx5 internal page cache was locally disabled to get pure page pool results. CPU: Intel(R) Xeon(R) CPU E5-2603 v4 @ 1.70GHz NIC: Mellanox Technologies MT27700 Family [ConnectX-4] (100G) XDP Drop/TX single core: NUMA | XDP | Before | After --------------------------------------- Close | Drop | 11 Mpps | 10.9 Mpps Far | Drop | 4.4 Mpps | 5.8 Mpps Close | TX | 6.5 Mpps | 6.5 Mpps Far | TX | 3.5 Mpps | 4 Mpps Improvement is about 30% drop packet rate, 15% tx packet rate for numa far test. No degradation for numa close tests. TCP single/multi cpu/stream: NUMA | #cpu | Before | After -------------------------------------- Close | 1 | 18 Gbps | 18 Gbps Far | 1 | 15 Gbps | 18 Gbps Close | 12 | 80 Gbps | 80 Gbps Far | 12 | 68 Gbps | 80 Gbps In all test cases we see improvement for the far numa case, and no impact on the close numa case. Signed-off-by: Saeed Mahameed Acked-by: Jonathan Lemon Acked-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit d5394610b1ba06373b3543b5177a4c91052f9f62 Author: Saeed Mahameed Date: Wed Nov 20 00:15:19 2019 +0000 page_pool: Don't recycle non-reusable pages A page is NOT reusable when at least one of the following is true: 1) allocated when system was under some pressure. (page_is_pfmemalloc) 2) belongs to a different NUMA node than pool->p.nid. To update pool->p.nid users should call page_pool_update_nid(). Holding on to such pages in the pool will hurt the consumer performance when the pool migrates to a different numa node. Performance testing: XDP drop/tx rate and TCP single/multi stream, on mlx5 driver while migrating rx ring irq from close to far numa: mlx5 internal page cache was locally disabled to get pure page pool results. CPU: Intel(R) Xeon(R) CPU E5-2603 v4 @ 1.70GHz NIC: Mellanox Technologies MT27700 Family [ConnectX-4] (100G) XDP Drop/TX single core: NUMA | XDP | Before | After --------------------------------------- Close | Drop | 11 Mpps | 10.9 Mpps Far | Drop | 4.4 Mpps | 5.8 Mpps Close | TX | 6.5 Mpps | 6.5 Mpps Far | TX | 3.5 Mpps | 4 Mpps Improvement is about 30% drop packet rate, 15% tx packet rate for numa far test. No degradation for numa close tests. TCP single/multi cpu/stream: NUMA | #cpu | Before | After -------------------------------------- Close | 1 | 18 Gbps | 18 Gbps Far | 1 | 15 Gbps | 18 Gbps Close | 12 | 80 Gbps | 80 Gbps Far | 12 | 68 Gbps | 80 Gbps In all test cases we see improvement for the far numa case, and no impact on the close numa case. The impact of adding a check per page is very negligible, and shows no performance degradation whatsoever, also functionality wise it seems more correct and more robust for page pool to verify when pages should be recycled, since page pool can't guarantee where pages are coming from. Signed-off-by: Saeed Mahameed Acked-by: Jonathan Lemon Reviewed-by: Ilias Apalodimas Acked-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit bc836748707cf6b8b1a948b61149278f109107da Author: Saeed Mahameed Date: Wed Nov 20 00:15:17 2019 +0000 page_pool: Add API to update numa node Add page_pool_update_nid() to be called by page pool consumers when they detect numa node changes. It will update the page pool nid value to start allocating from the new effective numa node. This is to mitigate page pool allocating pages from a wrong numa node, where the pool was originally allocated, and holding on to pages that belong to a different numa node, which causes performance degradation. For pages that are already being consumed and could be returned to the pool by the consumer, in next patch we will add a check per page to avoid recycling them back to the pool and return them to the page allocator. Signed-off-by: Saeed Mahameed Acked-by: Jonathan Lemon Reviewed-by: Ilias Apalodimas Acked-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit 68a33b1794665ba8a1d1ef1d3bfcc7c587d380a6 Author: Christoph Hellwig Date: Tue Nov 19 17:38:58 2019 +0100 dma-direct: exclude dma_direct_map_resource from the min_low_pfn check The valid memory address check in dma_capable only makes sense when mapping normal memory, not when using dma_map_resource to map a device resource. Add a new boolean argument to dma_capable to exclude that check for the dma_map_resource case. Fixes: b12d66278dd6 ("dma-direct: check for overflows on 32 bit DMA addresses") Reported-by: Marek Szyprowski Signed-off-by: Christoph Hellwig Acked-by: Marek Szyprowski Tested-by: Marek Szyprowski commit 4268ac6ae5870af10a7417b22990d615f72f77e2 Author: Christoph Hellwig Date: Tue Nov 19 17:35:36 2019 +0100 dma-direct: don't check swiotlb=force in dma_direct_map_resource When mapping resources we can't just use swiotlb ram for bounce buffering. Switch to a direct dma_capable check instead. Fixes: cfced786969c ("dma-mapping: remove the default map_resource implementation") Reported-by: Robin Murphy Signed-off-by: Christoph Hellwig Acked-by: Marek Szyprowski Tested-by: Marek Szyprowski commit 50f579a2399dee0ad1c86ea8159ab8657b74f95b Author: Dan Carpenter Date: Tue Nov 19 09:18:19 2019 +0300 dma-debug: clean up put_hash_bucket() The put_hash_bucket() is a bit cleaner if it takes an unsigned long directly instead of a pointer to unsigned long. Signed-off-by: Dan Carpenter Signed-off-by: Christoph Hellwig commit cb6f6392dbefb45b6aabd9a6f566440ef642b6f8 Author: Christoph Hellwig Date: Tue Nov 12 17:08:49 2019 +0100 powerpc: remove support for NULL dev in __phys_to_dma / __dma_to_phys Support for calling the DMA API functions without a valid device pointer was removed a while ago, so remove the stale support for that from the powerpc __phys_to_dma / __dma_to_phys helpers. Signed-off-by: Christoph Hellwig Acked-by: Michael Ellerman Reviewed-by: Nicolas Saenz Julienne commit c7345159f7db6fb69ec1c3b3f8f28cd05c731be2 Author: Christoph Hellwig Date: Tue Nov 12 17:07:43 2019 +0100 dma-direct: avoid a forward declaration for phys_to_dma Move dma_capable down a bit so that we don't need a forward declaration for phys_to_dma. Signed-off-by: Christoph Hellwig Reviewed-by: Nicolas Saenz Julienne commit 130c1ccbf55330b55e82612a6e54eebb82c9d746 Author: Christoph Hellwig Date: Tue Nov 12 17:06:04 2019 +0100 dma-direct: unify the dma_capable definitions Currently each architectures that wants to override dma_to_phys and phys_to_dma also has to provide dma_capable. But there isn't really any good reason for that. powerpc and mips just have copies of the generic one minus the latests fix, and the arm one was the inspiration for said fix, but misses the bus_dma_mask handling. Make all architectures use the generic version instead. Signed-off-by: Christoph Hellwig Acked-by: Michael Ellerman (powerpc) Reviewed-by: Nicolas Saenz Julienne commit 56e35f9c5b87ec1ae93e483284e189c84388de16 Author: Christoph Hellwig Date: Thu Nov 7 18:03:11 2019 +0100 dma-mapping: drop the dev argument to arch_sync_dma_for_* These are pure cache maintainance routines, so drop the unused struct device argument. Signed-off-by: Christoph Hellwig Suggested-by: Daniel Vetter commit 1f12177b322dd7e7555537211778d308bdc31dab Merge: b9242da6f6e6 3727d259ddaf Author: David S. Miller Date: Wed Nov 20 11:25:24 2019 -0800 Merge branch 'cpsw-switchdev' Grygorii Strashko says: ==================== net: ethernet: ti: introduce new cpsw switchdev based driver Thank you All for review of v6. There are no significant changes in this version, just fixed comments to v6. --- v6 The major change in this version is DT bindings conversation to json-schema, and fixed other comments to v5. Also added patch to clean up ALE on init and netif restart. --- v5 The major part of work done in this iteration is rebasing on top of net-next with XDP series from Ivan Khoronzhuk [3], and enable XDP support in the new CPSW switchdev driver (it was little bit painful ;(). There are mostly no functional changes in new CPSW driver, just few fixes, sync with old driver and cleanups/optimizations. So, I've kept rest of cover letter unchanged. --- This series originally based on work [1][2] done by Ilias Apalodimas . This the RFC v5 which introduces new CPSW switchdev based driver which is operating in dual-emac mode by default, thus working as 2 individual network interfaces. The Switch mode can be enabled by configuring devlink driver parameter "switch_mode" to 1/true: devlink dev param set platform/48484000.switch \ name switch_mode value 1 cmode runtime This can be done regardless of the state of Port's netdev devices - UP/DOWN, but Port's netdev devices have to be in UP before joining the bridge to avoid overwriting of bridge configuration as CPSW switch driver completely reloads its configuration when first Port changes its state to UP. When the both interfaces joined the bridge - CPSW switch driver will start marking packets with offload_fwd_mark flag unless "ale_bypass=0". All configuration is implemented via switchdev API. The previous solution of tracking both Ports joined the bridge (from netdevice_notifier) proved to be not correct as changing CPSW switch driver mode required cleanup of ALE table and CPSW settings which happens while second Port is joined bridge and as result configuration loaded by bridge for the first Port became corrupted. The introduction of the new CPSW switchdev based driver (cpsw_new.c) is split on two parts: Part 1 - basic dual-emac driver; Part 2 switchdev support. Such approach has simplified code development and testing alot. And, I hope, it will help with better review. patches #1 - 5: preparation patches which also moves common code to cpsw_priv.c patches #6 - 9: Introduce TI CPSW switch driver based on switchdev and new DT bindings patch #10: new CPSW switchdev driver documentation patch #11: adds DT nodes for new CPSW switchdev driver added for DRA7 SoC patch #12: adds DT nodes for new cpsw switchdev driver for am571x-idk board patch #13: enables build of TI CPSW driver Most of the contents of the previous cover-letter have been added in new driver documentation, so please refer to that for configuration, testing and future work. These patches can be found at (branch contains some additional patches required for testing on top of net-next): https://github.com/grygoriyS/linux.git branch: lkml-5.4-switch-tbd-v7 changes in v7: - patch 2: added check for devm_kmalloc_array() return value - patch 6: fixed comments changes in v6: https://lkml.org/lkml/2019/11/9/108 - DT bindings converted to json-schema - netdev initialization is split on creation and registration. The netdevs registration happens now at the end of the pobe. - reworked cpsw_set_pauseparam() to use PHYlib APIs. - other comments for v5 fixed v5: https://patchwork.kernel.org/cover/11208785/ - rebase on top of net-next with XDP series from Ivan Khoronzhuk [3], and enable XDP support in the new CPSW switchdev driver cpsw driver (tested XDP_DROP only) - sync with old cpsw driver - implement comments from Ivan Khoronzhuk and Rob Herring - fixed "NETDEV WATCHDOG: .." warning after interface after interface UP/DOWN, missed TX wake in cpsw_adjust_link() v4: https://patchwork.kernel.org/cover/11010523/ - finished split of common CPSW code - added devlink support - changed CPSW mode configuration approach: from netdevice_notifier to devlink parameter - refactor and clean up ALE changes which allows to modify VLANs/MDBs entries - added missed support for port QDISC_CBS and QDISC_MQPRIO - the CPSW is split on two parts: basic dual_mac driver and switchdev support - added missed callback .ndo_get_port_parent_id() - reworked ingress frames marking in switch mode (offload_fwd_mark) - applied comments from Andrew Lunn v3: https://lwn.net/Articles/786677/ Changes in v3: - alot of work done to split properly common code between legacy and switchdev CPSW drivers and clean up code - CPSW switchdev interface updated to the current LKML switchdev interface - actually new CPSW switchdev based driver introduced - optimized dual_mac mode in new driver. Main change is that in promiscuous mode P0_UNI_FLOOD (both ports) is enabled in addition to ALLMULTI (current port) instead of ALE_BYPASS. So, port in non promiscuous mode will keep possibility of mcast and vlan filtering. - changed bridge join sequnce: now switch mode will be enabled only when both ports joined the bridge. CPSW will be switched to dual_mac mode if any port leave bridge. ALE table is completly cleared and then refiled while switching to switch mode - this simplidies code a lot, but introduces some limitation to bridge setup sequence: ip link add name br0 type bridge ip link set dev br0 type bridge ageing_time 1000 ip link set dev br0 type bridge vlan_filtering 0 <- disable echo 0 > /sys/class/net/br0/bridge/default_vlan ip link set dev sw0p1 up <- add ports ip link set dev sw0p2 up ip link set dev sw0p1 master br0 ip link set dev sw0p2 master br0 echo 1 > /sys/class/net/br0/bridge/default_vlan <- enable ip link set dev br0 type bridge vlan_filtering 1 bridge vlan add dev br0 vid 1 pvid untagged self - STP tested with vlan_filtering 1/0. To make STP work I've had to set NO_SA_UPDATE for all slave ports (see comment in code). It also required to statically register STP mcast address {0x01, 0x80, 0xc2, 0x0, 0x0, 0x0}; - allowed build both TI_CPSW and TI_CPSW_SWITCHDEV drivers - PTP can be enabled on both ports in dual_mac mode [1] https://patchwork.ozlabs.org/cover/929367/ [2] https://patches.linaro.org/cover/136709/ [3] https://patchwork.kernel.org/cover/11035813/ ==================== Signed-off-by: David S. Miller commit 3727d259ddafc4c8b8a9034ea4d115a8d0547877 Author: Grygorii Strashko Date: Wed Nov 20 00:19:25 2019 +0200 arm: omap2plus_defconfig: enable new cpsw switchdev driver Add CONFIG_TI_CPSW_SWITCHDEV option to enable new cpsw switchdev driver Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 15b991ade40069b2b88f29082f4ee59ae0a1ac38 Author: Grygorii Strashko Date: Wed Nov 20 00:19:24 2019 +0200 ARM: dts: am571x-idk: enable for new cpsw switch dev driver Add DT nodes for new cpsw switchdev driver for am571x-idk board for now to enable testing of the new solution. Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 39331a49c4e159eca2500ccbd25ccf9e048b7559 Author: Grygorii Strashko Date: Wed Nov 20 00:19:23 2019 +0200 ARM: dts: dra7: add dt nodes for new cpsw switch dev driver Add DT nodes for new cpsw switch dev driver. Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 14c815a9d1d32802119e9750ff2ebfac38038b83 Author: Ilias Apalodimas Date: Wed Nov 20 00:19:22 2019 +0200 Documentation: networking: add cpsw switchdev based driver documentation A new cpsw dirver based on switchdev was added. Add documentation about basic configuration and future features Signed-off-by: Ilias Apalodimas Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit da84e50c8e7525517c8484269578b247760cc7f4 Author: Grygorii Strashko Date: Wed Nov 20 00:19:21 2019 +0200 phy: ti: phy-gmii-sel: dependency from ti cpsw-switchdev driver Add dependency from TI_CPSW_SWITCHDEV. Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 111cf1ab4da393416b8b79c2a7598378bfaf07e4 Author: Ilias Apalodimas Date: Wed Nov 20 00:19:20 2019 +0200 net: ethernet: ti: introduce cpsw switchdev based driver part 2 - switch CPSW switchdev based driver which is operating in dual-emac mode by default, thus working as 2 individual network interfaces. The Switch mode can be enabled by configuring devlink driver parameter "switch_mode" to 1: devlink dev param set platform/48484000.switch \ name switch_mode value 1 cmode runtime This can be done regardless of the state of Port's netdevs - UP/DOWN, but Port's netdev devices have to be UP before joining the bridge to avoid overwriting of bridge configuration as CPSW switch driver completely reloads its configuration when first Port changes its state to UP. When the both interfaces joined the bridge - CPSW switch driver will start marking packets with offload_fwd_mark flag unless "ale_bypass=0". All configuration is implemented via switchdev API and notifiers. Supported: - SWITCHDEV_ATTR_ID_PORT_PRE_BRIDGE_FLAGS - SWITCHDEV_ATTR_ID_PORT_BRIDGE_FLAGS: BR_MCAST_FLOOD - SWITCHDEV_ATTR_ID_PORT_STP_STATE - SWITCHDEV_OBJ_ID_PORT_VLAN - SWITCHDEV_OBJ_ID_PORT_MDB - SWITCHDEV_OBJ_ID_HOST_MDB Hence CPSW switchdev driver supports: - FDB offloading - MDB offloading - VLAN filtering and offloading - STP Signed-off-by: Ilias Apalodimas Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit ed3525eda4c4983fb8509e488de0a351788041ba Author: Ilias Apalodimas Date: Wed Nov 20 00:19:19 2019 +0200 net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac Part 1: Introduce basic CPSW dual_mac driver (cpsw_new.c) which is operating in dual-emac mode by default, thus working as 2 individual network interfaces. Main differences from legacy CPSW driver are: - optimized promiscuous mode: The P0_UNI_FLOOD (both ports) is enabled in addition to ALLMULTI (current port) instead of ALE_BYPASS. So, Ports in promiscuous mode will keep possibility of mcast and vlan filtering, which is provides significant benefits when ports are joined to the same bridge, but without enabling "switch" mode, or to different bridges. - learning disabled on ports as it make not too much sense for segregated ports - no forwarding in HW. - enabled basic support for devlink. devlink dev show platform/48484000.switch devlink dev param show platform/48484000.switch: name ale_bypass type driver-specific values: cmode runtime value false - "ale_bypass" devlink driver parameter allows to enable ALE_CONTROL(4).BYPASS mode for debug purposes. - updated DT bindings. Signed-off-by: Ilias Apalodimas Signed-off-by: Murali Karicheri Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit ef63fe72f698a051ed7f24d1a6b1ab3745fd4bbb Author: Grygorii Strashko Date: Wed Nov 20 00:19:18 2019 +0200 dt-bindings: net: ti: add new cpsw switch driver bindings Add bindings for the new TI CPSW switch driver. Comparing to the legacy bindings (net/cpsw.txt): - ports definition follows DSA bindings (net/dsa/dsa.txt) and ports can be marked as "disabled" if not physically wired. - all deprecated properties dropped; - all legacy propertiies dropped which represent constant HW cpapbilities (cpdma_channels, ale_entries, bd_ram_size, mac_control, slaves, active_slave) - TI CPTS DT properties are reused as is, but grouped in "cpts" sub-node - TI Davinci MDIO DT bindings are reused as is, because Davinci MDIO is reused. Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit c5013ac1dd0e11267f81c855d50bd974fc8f88fe Author: Grygorii Strashko Date: Wed Nov 20 00:19:17 2019 +0200 net: ethernet: ti: cpsw: move set of common functions in cpsw_priv As a preparatory patch to add support for a switchdev based cpsw driver, move common functions to cpsw-priv.c so that they can be used across both drivers. Signed-off-by: Ilias Apalodimas Signed-off-by: Murali Karicheri Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 51a9533797b07b44374346fbd36ae0aa4f36ccd3 Author: Grygorii Strashko Date: Wed Nov 20 00:19:16 2019 +0200 net: ethernet: ti: cpsw: resolve build deps of cpsw drivers A following patches introduce new CPSW switchdev driver which uses common code with legacy CPSW driver. This will introduce build dependency between CPSW switchdev and CPSW legacy drivers related to for_each_slave() and cpsw_slave_index() - they can be compiled both, but only one of them will be not functional depending in Kconfig settings due to duffrences in Slave Ports indexes calculation. To fix this make for_each_slave() local (it's used now only by legacy CPSW driver) and convert cpsw_slave_index() to be a function pointer which is assigned in probe. Driver to probe is defined by DT. Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit e85c14370783bf9339a95cab9da0fa54dc770a72 Author: Ilias Apalodimas Date: Wed Nov 20 00:19:15 2019 +0200 net: ethernet: ti: ale: modify vlan/mdb api for switchdev A following patch introduces switchdev functionality, so modify ALE engine VLANs/MDBs API: - cpsw_ale_del_mcast(): update so it will remove only selected ports from mcast port_mask or delete whole mcast record if !port_mask - cpsw_ale_del_vlan(): update so it will remove only selected ports from all VLAN record's masks or delete whole VLAN record if !port_mask - add cpsw_ale_vlan_add_modify() to add or modify existing VLAN record's masks - add cpsw_ale_set_unreg_mcast() for enabling unreg mcast on port VLANs Signed-off-by: Ilias Apalodimas Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 4b41d34367960e8b582cf3c51b954c07e0e3a1aa Author: Grygorii Strashko Date: Wed Nov 20 00:19:14 2019 +0200 net: ethernet: ti: cpsw: allow untagged traffic on host port Now untagged vlan traffic is not support on Host P0 port. This patch adds in ALE context bitmap of VLANs for which Host P0 port bit set in Force Untagged Packet Egress bitmask in VLANs ALE entries, and adds corresponding check in VLAN incapsulation header parsing function cpsw_rx_vlan_encap(). Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit 7fe579dfb90fcdf0c7722f33c772d5f0d1bc7cb6 Author: Grygorii Strashko Date: Wed Nov 20 00:19:13 2019 +0200 net: ethernet: ti: ale: clean ale tbl on init and intf restart Clean CPSW ALE on init and intf restart (up/down) to avoid reading obsolete or garbage entries from ALE table. Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller commit b9242da6f6e66d0e5548f0009abe9f781a536b51 Merge: 2f1d370b997a 89d8fd44abfb Author: David S. Miller Date: Wed Nov 20 11:21:35 2019 -0800 Merge branch 'nf_tables_offload-vlan-matching-support' Pablo Neira Ayuso says: ==================== nf_tables_offload: vlan matching support The following patchset contains Netfilter support for vlan matching offloads: 1) Constify nft_reg_load() as a preparation patch. 2) Restrict rule matching to ingress interface type ARPHRD_ETHER. 3) Add new vlan_tci field to flow_dissector_key_vlan structure, to allow to set up vlan_id, vlan_dei and vlan_priority in one go. 4) C-VLAN matching support. ==================== Signed-off-by: David S. Miller commit 89d8fd44abfb9019bb37a858532d6633e2590cac Author: Pablo Neira Ayuso Date: Tue Nov 19 23:05:55 2019 +0100 netfilter: nft_payload: add C-VLAN offload support Match on h_vlan_encapsulated_proto and set up protocol dependency. Check for protocol dependency before accessing the tci field. Allow to match on the encapsulated ethertype too. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit a82055af595946aea461528e551e6ae064b3d560 Author: Pablo Neira Ayuso Date: Tue Nov 19 23:05:54 2019 +0100 netfilter: nft_payload: add VLAN offload support Match on ethertype and set up protocol dependency. Check for protocol dependency before accessing the tci field. Allow to match on the encapsulated ethertype too. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 8819efc9430142957c9c8fc7c09d9107e2061b87 Author: Pablo Neira Ayuso Date: Tue Nov 19 23:05:53 2019 +0100 netfilter: nf_tables_offload: allow ethernet interface type only Hardware offload support at this stage assumes an ethernet device in place. The flow dissector provides the intermediate representation to express this selector, so extend it to allow to store the interface type. Flower does not uses this, so skb_flow_dissect_meta() is not extended to match on this new field. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 7cd9a58d6860ae09acd7f0c219b5fa333703f72f Author: Pablo Neira Ayuso Date: Tue Nov 19 23:05:52 2019 +0100 netfilter: nf_tables: constify nft_reg_load{8, 16, 64}() This patch constifies the pointer to source register data that is passed as an input parameter. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 94722e74272cf4aa08841c98e3a219c7a4c9028b Author: Takashi Iwai Date: Sun Nov 17 09:53:08 2019 +0100 ALSA: docs: Update about the new PCM sync_stop ops Add the documentation about the new PCM sync_stop ops and card->sync_irq field. Link: https://lore.kernel.org/r/20191117085308.23915-9-tiwai@suse.de Signed-off-by: Takashi Iwai commit fabb26dcd104027b971c018275fe40f2ebe09ae3 Author: Takashi Iwai Date: Sun Nov 17 09:53:07 2019 +0100 ALSA: pcm: Add card sync_irq field Many PCI and other drivers performs snd_pcm_period_elapsed() simply in its interrupt handler, so the sync_stop operation is just to call synchronize_irq(). Instead of putting this call multiple times, introduce the common card->sync_irq field. When this field is set, PCM core performs synchronize_irq() for sync-stop operation. Each driver just needs to copy its local IRQ number to card->sync_irq, and that's all we need. Link: https://lore.kernel.org/r/20191117085308.23915-8-tiwai@suse.de Signed-off-by: Takashi Iwai commit 1e850beea2781d30418743dd99250291cef37919 Author: Takashi Iwai Date: Sun Nov 17 09:53:06 2019 +0100 ALSA: pcm: Add the support for sync-stop operation The standard programming model of a PCM sound driver is to process snd_pcm_period_elapsed() from an interrupt handler. When a running stream is stopped, PCM core calls the trigger-STOP PCM ops, sets the stream state to SETUP, and moves on to the next step. This is performed in an atomic manner -- this could be called from the interrupt context, after all. The problem is that, if the stream goes further and reaches to the CLOSE state immediately, the stream might be still being processed in snd_pcm_period_elapsed() in the interrupt context, and hits a NULL dereference. Such a crash happens because of the atomic operation, and we can't wait until the stream-stop finishes. For addressing such a problem, this commit adds a new PCM ops, sync_stop. This gets called at the appropriate places that need a sync with the stream-stop, i.e. at hw_params, prepare and hw_free. Some drivers already have a similar mechanism implemented locally, and we'll refactor the code later. Link: https://lore.kernel.org/r/20191117085308.23915-7-tiwai@suse.de Signed-off-by: Takashi Iwai commit 0821fd77a1129cf4848d82d9275fb4e90e02edf8 Author: Takashi Iwai Date: Sun Nov 17 11:05:12 2019 +0100 ALSA: pcm: Move PCM_RUNTIME_CHECK() macro into local header It should be used only in the PCM core code locally. Link: https://lore.kernel.org/r/20191117085308.23915-6-tiwai@suse.de Signed-off-by: Takashi Iwai commit f6161f379c5d455bcedc2cbb1968235a85e151c1 Author: Takashi Iwai Date: Sun Nov 17 09:53:04 2019 +0100 ALSA: docs: Update document about the default PCM ioctl ops Mention that it's completely optional now. Link: https://lore.kernel.org/r/20191117085308.23915-5-tiwai@suse.de Signed-off-by: Takashi Iwai commit fc033cbf6fb75452f03774ca5adccac8cf9bc84f Author: Takashi Iwai Date: Sun Nov 17 09:53:03 2019 +0100 ALSA: pcm: Allow NULL ioctl ops Currently PCM ioctl ops is a mandatory field but almost all drivers simply pass snd_pcm_lib_ioctl. For simplicity, allow to set NULL in the field and call snd_pcm_lib_ioctl() as default. Link: https://lore.kernel.org/r/20191117085308.23915-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit 72b4bcbf1c96c766a0c037a665ef5bbe62bb2628 Author: Takashi Iwai Date: Sun Nov 17 09:53:02 2019 +0100 ALSA: docs: Update for managed buffer allocation mode Update the documentation for the newly introduced managed buffer allocation mode accordingly. The old preallocation is no longer recommended. Link: https://lore.kernel.org/r/20191117085308.23915-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit 0dba808eae2627f40024872d2f02f75f0d2b0790 Author: Takashi Iwai Date: Sun Nov 17 09:53:01 2019 +0100 ALSA: pcm: Introduce managed buffer allocation mode This patch adds the support for the feature to automatically allocate and free PCM buffers, so called "managed buffer allocation" mode. It's set up via new PCM helpers, snd_pcm_set_managed_buffer() and snd_pcm_set_managed_buffer_all(), both of which correspond to the existing preallocator helpers, snd_pcm_lib_preallocate_pages() and snd_pcm_lib_preallocate_pages_for_all(). When the new helper is used, it not only performs the pre-allocation of buffers, but also it manages to call snd_pcm_lib_malloc_pages() before the PCM hw_params ops and snd_lib_pcm_free() after the PCM hw_free ops inside PCM core, respectively. This allows drivers to drop the explicit calls of the memory allocation / release functions, and it will be a good amount of code reduction in the end of this patch series. When the PCM substream is set to the managed buffer allocation mode, the managed_buffer_alloc flag is set in the substream object. Since some drivers want to know when a buffer is newly allocated or re-allocated at hw_params callback (e.g. want to set up the additional stuff for the given buffer only at allocation time), now PCM core turns on buffer_changed flag when the buffer has changed. The standard conversions to use the new API will be straightforward: - Replace snd_pcm_lib_preallocate*() calls with the corresponding snd_pcm_set_managed_buffer*(); the arguments should be unchanged - Drop superfluous snd_pcm_lib_malloc() and snd_pcm_lib_free() calls; the check of snd_pcm_lib_malloc() returns should be replaced with the check of runtime->buffer_changed flag. - If hw_params or hw_free becomes empty, drop them from PCM ops Link: https://lore.kernel.org/r/20191117085308.23915-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit c6ae99605633cade7dc61a2b35b04dda90302dad Author: Andrew Gabbasov Date: Wed Nov 20 11:49:55 2019 -0600 ALSA: aloop: Support runtime change of snd_timer via info interface Show and change sound card timer source with read-write info file in proc filesystem. Initial string can still be set as module parameter. The timer source string value can be changed at any time, but it is latched by PCM substream open callback (the first one for a particular cable). At this point it is actually used, that is the string is parsed, and the timer is looked up and opened. The timer source is set for a loopback card (the same as initial setting by module parameter), but every cable uses the value, current at the moment of open. Setting the value to empty string switches the timer to jiffies. Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191120174955.6410-8-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit 26c53379f98d22d6a3e50bb146651dc7824334d7 Author: Timo Wischer Date: Wed Nov 20 11:49:54 2019 -0600 ALSA: aloop: Support selection of snd_timer instead of jiffies to do synchronous audio forwarding between hardware sound card and aloop devices. Such an audio route could look like the following: Sound card -> Loopback application -> ALSA loop device -> arecord In this case the loopback device should use the sound timer of the sound card. Without this patch the loopback application has to implement an adaptive sample rate converter to align the different clocks of the different ALSA devices. The used timer can be selected by referring to a sound card, its device and subdevice, when loading the module: $ modprobe snd_aloop enable=1 timer_source=[[.[.]]] is the name (id) of the sound card or a card number. and are device and subdevice numbers (defaults are 0). Empty string as a value of timer_source= parameter enables previous functionality (using jiffies timer). Signed-off-by: Timo Wischer Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191120174955.6410-7-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit fd1f7c743d30938d3befb1af038a510c003a6a27 Author: Timo Wischer Date: Wed Nov 20 11:49:53 2019 -0600 ALSA: aloop: Move CABLE_VALID_BOTH to the top of file so all functions can use the same. Signed-off-by: Timo Wischer Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191120174955.6410-6-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit 8e3bf7cde43339507f9ce15fc10ff329e76ad649 Author: Timo Wischer Date: Wed Nov 20 11:49:52 2019 -0600 ALSA: aloop: Rename all jiffies timer specific functions This commit does not change the behaviour. It only separates the jiffies timer specific implementation from the generic part. Signed-off-by: Timo Wischer Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191120174955.6410-5-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit 133f37593eb6db43158bafd52937974acccd1d29 Author: Timo Wischer Date: Wed Nov 20 11:49:51 2019 -0600 ALSA: aloop: Use callback functions for timer specific implementations This commit only refactors the implementation. It does not change the behaviour. It is required to support other timers (e.g sound timer). Signed-off-by: Timo Wischer Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191120174955.6410-4-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit 09419f1ace213284823ad835d28b239c33daeb71 Author: Timo Wischer Date: Wed Nov 20 11:49:50 2019 -0600 ALSA: aloop: Support return of error code for timer start and stop This is required for additional timer implementations which could detect errors and want to throw them. Signed-off-by: Timo Wischer Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191120174955.6410-3-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit 97dda3da20732df8010090dd6d749b9d5b86bffe Author: Timo Wischer Date: Wed Nov 20 11:49:49 2019 -0600 ALSA: aloop: Describe units of variables Describe the unit of the variables used to calculate the hw pointer depending on jiffies ticks. Signed-off-by: Timo Wischer Signed-off-by: Andrew Gabbasov Link: https://lore.kernel.org/r/20191120174955.6410-2-andrew_gabbasov@mentor.com Signed-off-by: Takashi Iwai commit 2f1d370b997a249ff289507cbd629b4fdd99c564 Author: Xin Long Date: Tue Nov 19 17:39:11 2019 +0800 lwtunnel: add support for multiple geneve opts geneve RFC (draft-ietf-nvo3-geneve-14) allows a geneve packet to carry multiple geneve opts, so it's necessary for lwtunnel to support adding multiple geneve opts in one lwtunnel route. But vxlan and erspan opts are still only allowed to add one option. With this patch, iproute2 could make it like: # ip r a 1.1.1.0/24 encap ip id 1 geneve_opts 0:0:12121212,1:2:12121212 \ dst 10.1.0.2 dev geneve1 # ip r a 1.1.1.0/24 encap ip id 1 vxlan_opts 456 \ dst 10.1.0.2 dev erspan1 # ip r a 1.1.1.0/24 encap ip id 1 erspan_opts 1:123:0:0 \ dst 10.1.0.2 dev erspan1 Which are pretty much like cls_flower and act_tunnel_key. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 924ea58dadea23cc28b60d02b9c0896b7b168a6f Merge: 54b6416e679d 23cb16d2ccb5 Author: Kalle Valo Date: Wed Nov 20 20:11:58 2019 +0200 Merge tag 'mt76-for-kvalo-2019-11-20' of https://github.com/nbd168/wireless mt76 patches for 5.5 * monitor mode fix for mt7615 * fixes for rx aggregation race conditions * cleanups * mt7615 smart carrier sense support * code unification / deduplication * mt7615 debugfs improvements * debugfs aggregation statistics * airtime fairness support * mt76x0 OF mac address support * locking fixes * usb support improvements * rate control fixes commit 54b6416e679d5f255a36fd5a9e148802647cdd65 Merge: eac08515d7bd 54fae6e31bed Author: Kalle Valo Date: Wed Nov 20 20:09:50 2019 +0200 Merge tag 'iwlwifi-next-for-kalle-2019-11-20' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Patches intended for v5.5 * Fix a merge damage that causes issues with high-throuput on AX200+; * Support TX/RX antennas reporting; * Small fix in DVM's BT link-quality code; * Bump supported FW API version to 52; * Yet another scan FW API update; * Some clean-ups; commit d7d8d62a3f3b50b606c9395298b017bd9fd9c8d4 Merge: b82049f2c139 37238d3dd584 cb6cfe2eaed1 Author: Tony Lindgren Date: Wed Nov 20 10:04:05 2019 -0800 Merge branches 'omap-for-v5.5/soc' and 'omap-for-v5.5/ti-sysc' into omap-for-v5.5/ti-sysc-late commit b82049f2c1395d0bf99f0ae291c748c9dcb7d507 Merge: b08a0c577518 0b491904f053 Author: Tony Lindgren Date: Wed Nov 20 10:01:38 2019 -0800 Merge tag 'omap-for-v5.5/soc-late-signed' into omap-for-v5.5/ti-sysc-late Few late SoC changes for v5.5 merge window These changes just clean up few typos, and there is one non-critical correction of missing put_device() after calling of_platform_populate() for display controller. Naturally none of this is urgent and can be merged when suitable. commit 6af0a549c25e0d02366aa95507bfe3cad2f7b68b Author: Grygorii Strashko Date: Mon Nov 18 14:20:16 2019 +0200 ARM: dts: dra7: fix cpsw mdio fck clock The DRA7 CPSW MDIO functional clock (gmac_clkctrl DRA7_GMAC_GMAC_CLKCTRL 0) is specified incorrectly, which is caused incorrect MDIO bus clock configuration MDCLK. The correct CPSW MDIO functional clock is gmac_main_clk (125MHz), which is the same as CPSW fck. Hence fix it. Fixes: 1faa415c9c6e ("ARM: dts: Add fck for cpsw mdio for omap variants") Signed-off-by: Grygorii Strashko Signed-off-by: Tony Lindgren commit e415e4d2d506ce64ea540b4552654d1be0680a52 Author: Faiz Abbas Date: Mon Nov 18 16:46:54 2019 +0530 ARM: dts: am57xx-beagle-x15: Update pinmux name to ddr_3_3v am57xx-beagle-x15 revb1 and revc have 3.3V connected to the eMMC I/O lines. Update the pinmux name to reflect this. Signed-off-by: Faiz Abbas Signed-off-by: Tony Lindgren commit 287897f9aaa2ad1c923d9875914f57c4dc9159c8 Author: Jarkko Nikula Date: Sat Nov 16 17:16:51 2019 +0200 ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity The MMC card detection GPIO polarity is active low on TAO3530, like in many other similar boards. Now the card is not detected and it is unable to mount rootfs from an SD card. Fix this by using the correct polarity. This incorrect polarity was defined already in the commit 30d95c6d7092 ("ARM: dts: omap3: Add Technexion TAO3530 SOM omap3-tao3530.dtsi") in v3.18 kernel and later changed to use defined GPIO constants in v4.4 kernel by the commit 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags cell for OMAP2+ boards"). While the latter commit did not introduce the issue I'm marking it with Fixes tag due the v4.4 kernels still being maintained. Fixes: 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags cell for OMAP2+ boards") Cc: linux-stable # 4.4+ Signed-off-by: Jarkko Nikula Signed-off-by: Tony Lindgren commit 3efd72330543da44e82e9371dfb639802c886f6c Author: Krzysztof Kozlowski Date: Wed Nov 20 21:32:52 2019 +0800 ASoC: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191120133252.6365-1-krzk@kernel.org Signed-off-by: Mark Brown commit 5cca59516de5df9de6bdecb328dd55fb5bcccb41 Author: Shengjiu Wang Date: Tue Nov 12 18:46:42 2019 +0800 ASoC: soc-pcm: check symmetry before hw_params This reverts commit 957ce0c6b8a1f (ASoC: soc-pcm: check symmetry after hw_params). That commit cause soc_pcm_params_symmetry can't take effect. cpu_dai->rate, cpu_dai->channels and cpu_dai->sample_bits are updated in the middle of soc_pcm_hw_params, so move soc_pcm_params_symmetry to the end of soc_pcm_hw_params is not a good solution, for judgement of symmetry in the function is always true. FIXME: According to the comments of that commit, I think the case described in the commit should disable symmetric_rates in Back-End, rather than changing the position of soc_pcm_params_symmetry. Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1573555602-5403-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 9fbea0b7e842890a76acffce9be9e430b9e11194 Author: Eugeniy Paltsev Date: Tue Nov 19 18:26:15 2019 +0300 ARC: add kmemleak support kmemleak is used internally for a long time and as there isn't any issue with it we can finally enable it in upstream. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit e1b2743d705205314cda550c97f59ed7ce9917f4 Author: Eugeniy Paltsev Date: Tue Nov 19 16:22:15 2019 +0300 ARC: [plat-axs10x]: remove hardcoded video mode from bootargs Now have pixel clock PLL driver and we can change pixel clock rate so we don't need to enforce one exact video mode. Moreover enforcing video mode is harmful in case of we enforce mode which isn't supported by the monitor we are using. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit 93c53f2397fb584963a53fe32288384adcdd5f6c Author: Eugeniy Paltsev Date: Tue Nov 19 16:22:14 2019 +0300 ARC: [plat-axs10x]: use pgu pll instead of fixed clock Use PLL driver instead of fixed-clock for PGU pixel clock. That allows us to support wider range of graphic modes. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit 554bbe726ce0ef692cd95fedd5730c69c1189138 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:39:16 2019 +0800 spi: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133916.13595-1-krzk@kernel.org Signed-off-by: Mark Brown commit 76bec25b32363f47225d35a70ccb97d6d0f09dd9 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:39:49 2019 +0800 regulator: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133949.13996-1-krzk@kernel.org Signed-off-by: Mark Brown commit f0a19fa823fb7b1f98d54b22a3ae0e5de88a1e50 Author: Sven Van Asbroeck Date: Tue Nov 19 10:46:09 2019 -0500 regulator: tps6105x: add optional devicetree support Tell the regulator framework to retrieve regulator init data from the 'regulator' subnode, or from the parent mfd device's platform data. Example: i2c0 { tps61052@33 { compatible = "ti,tps61052"; reg = <0x33>; regulator { regulator-min-microvolt = <5000000>; regulator-max-microvolt = <5000000>; regulator-always-on; }; }; }; Tree: next-20191118 Signed-off-by: Sven Van Asbroeck Link: https://lore.kernel.org/r/20191119154611.29625-3-TheSven73@gmail.com Signed-off-by: Mark Brown commit 62f7f3eca4c30064ab37b42d97cef4292d75fdd0 Author: Sven Van Asbroeck Date: Tue Nov 19 10:46:08 2019 -0500 tps6105x: add optional devicetree support This driver currently requires platform data to specify the operational mode and regulator init data (in case of regulator mode). Optionally specify the operational mode by looking at the name of the devicetree child node. Example: put chip in regulator mode: i2c0 { tps61052@33 { compatible = "ti,tps61052"; reg = <0x33>; regulator { regulator-min-microvolt = <5000000>; regulator-max-microvolt = <5000000>; regulator-always-on; }; }; }; Tree: linux-next Signed-off-by: Sven Van Asbroeck Link: https://lore.kernel.org/r/20191119154611.29625-2-TheSven73@gmail.com Signed-off-by: Mark Brown commit 4ec48e7cbe6e70352c802b5cb172b00ebd8af8e0 Author: Peter Ujfalusi Date: Wed Nov 20 15:17:53 2019 +0200 ASoC: pcm3168a: Update the RST gpio handling to align with documentation The RST (reset-gpios) is low active so the driver must handle it accordingly. Add comments to explain clearly how the line is used. Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20191120131753.6831-3-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit 103e5d734ae28fc1ccd80d1df9d33f44536d74a4 Author: Peter Ujfalusi Date: Wed Nov 20 15:17:52 2019 +0200 ASoC: dt-bindings: pcm3168a: Update the optional RST gpio for clarity Use the standard name for the gpion in DT: reset-gpios Document that the RST line is low active and update the example accordingly. Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20191120131753.6831-2-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit fb5126778333d289b2623a7e6260beeb1ac1b819 Author: Tzung-Bi Shih Date: Wed Nov 20 14:08:43 2019 +0800 ASoC: core: add SND_SOC_BYTES_E Add SND_SOC_BYTES_E to accept getter and putter. Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20191120060844.224607-2-tzungbi@google.com Signed-off-by: Mark Brown commit dc73d73aa7145f55412611f3eead1e85ae026785 Author: Jaroslav Kysela Date: Tue Nov 19 18:49:32 2019 +0100 ASoC: add control components management This ASCII string can carry additional information about soundcard components or configuration. Add the possibility to set this string via the ASoC card. Signed-off-by: Jaroslav Kysela Cc: Mark Brown Link: https://lore.kernel.org/r/20191119174933.25526-1-perex@perex.cz Signed-off-by: Mark Brown commit 1e4d401860268bbed124eb93a0010237bd8ed26c Author: Robin Murphy Date: Sat Nov 16 12:54:19 2019 +0000 PCI: rockchip: Make some regulators non-optional The 0V9 and 1V8 supplies power the PCIe block in the SoC itself, and are thus fundamental to PCIe being usable at all. As such, it makes sense to treat them as non-optional and rely on dummy regulators if not explicitly described. Signed-off-by: Robin Murphy Signed-off-by: Lorenzo Pieralisi Reviewed-by: Mark Brown Reviewed-by: Andrew Murray commit 3b55809cf91f54fa5add4cc4cfed934565568ed7 Author: Rob Herring Date: Mon Oct 28 11:32:56 2019 -0500 PCI: Make devm_of_pci_get_host_bridge_resources() static Now that all the PCI host drivers are using pci_parse_request_of_pci_ranges(), make devm_of_pci_get_host_bridge_resources() static. Signed-off-by: Rob Herring Signed-off-by: Lorenzo Pieralisi Cc: Bjorn Helgaas commit 085f793984adcbf3966176bac088c32e0b66235a Author: Rob Herring Date: Mon Oct 28 11:32:55 2019 -0500 PCI: rcar: Use inbound resources for setup Now that the helpers provide the inbound resources in the host bridge 'dma_ranges' resource list, convert Renesas R-Car PCIe host bridge to use the resource list to setup the inbound addresses. Signed-off-by: Rob Herring Signed-off-by: Lorenzo Pieralisi Cc: Simon Horman Cc: Lorenzo Pieralisi Cc: Bjorn Helgaas commit b9ae59b30bcf62691aec4170ce4bafc20e968490 Author: Rob Herring Date: Mon Oct 28 11:32:54 2019 -0500 PCI: iproc: Use inbound resources for setup Now that the helpers provide the inbound resources in the host bridge 'dma_ranges' resource list, convert Broadcom iProc host bridge to use the resource list to setup the inbound addresses. Signed-off-by: Rob Herring Signed-off-by: Lorenzo Pieralisi Reviewed-by: Andrew Murray Cc: Lorenzo Pieralisi Cc: Bjorn Helgaas Cc: Ray Jui Cc: Scott Branden Cc: bcm-kernel-feedback-list@broadcom.com commit 6dce5aa59e0bf2430733d7a8b11c205ec10f408e Author: Rob Herring Date: Mon Oct 28 11:32:53 2019 -0500 PCI: xgene: Use inbound resources for setup Now that the helpers provide the inbound resources in the host bridge 'dma_ranges' resource list, convert the Xgene host bridge to use the resource list to setup the inbound addresses. Signed-off-by: Rob Herring Signed-off-by: Lorenzo Pieralisi Reviewed-by: Andrew Murray Cc: Toan Le Cc: Lorenzo Pieralisi Cc: Bjorn Helgaas commit 070d7d70291c3a6b61fb10f0e9cf5874df91e214 Author: Rob Herring Date: Mon Oct 28 11:32:52 2019 -0500 PCI: v3-semi: Use inbound resources for setup Now that the helpers provide the inbound resources in the host bridge 'dma_ranges' resource list, convert the v3-semi host bridge to use the resource list to setup the inbound addresses. Signed-off-by: Rob Herring Signed-off-by: Lorenzo Pieralisi Reviewed-by: Andrew Murray Reviewed-by: Linus Walleij Cc: Lorenzo Pieralisi Cc: Bjorn Helgaas commit ea4f718e8455e8d94ec5fcf270b9d37988fc5bbd Author: Rob Herring Date: Mon Oct 28 11:32:51 2019 -0500 PCI: ftpci100: Use inbound resources for setup Now that the helpers provide the inbound resources in the host bridge 'dma_ranges' resource list, convert Faraday ftpci100 host bridge to use the resource list to setup the inbound addresses. Signed-off-by: Rob Herring Signed-off-by: Lorenzo Pieralisi Reviewed-by: Andrew Murray Acked-by: Linus Walleij Cc: Lorenzo Pieralisi Cc: Bjorn Helgaas commit 331f63457165a30c708280de2c77f1742c6351dc Author: Rob Herring Date: Wed Oct 30 17:30:57 2019 -0500 PCI: of: Add inbound resource parsing to helpers Extend devm_of_pci_get_host_bridge_resources() and pci_parse_request_of_pci_ranges() helpers to also parse the inbound addresses from DT 'dma-ranges' and populate a resource list with the translated addresses. This will help ensure 'dma-ranges' is always parsed in a consistent way. Tested-by: Srinath Mannam Tested-by: Thomas Petazzoni # for AArdvark Signed-off-by: Rob Herring Signed-off-by: Lorenzo Pieralisi Reviewed-by: Srinath Mannam Reviewed-by: Andrew Murray Acked-by: Gustavo Pimentel Cc: Jingoo Han Cc: Gustavo Pimentel Cc: Lorenzo Pieralisi Cc: Bjorn Helgaas Cc: Thomas Petazzoni Cc: Will Deacon Cc: Linus Walleij Cc: Toan Le Cc: Ley Foon Tan Cc: Tom Joseph Cc: Ray Jui Cc: Scott Branden Cc: bcm-kernel-feedback-list@broadcom.com Cc: Ryder Lee Cc: Karthikeyan Mitran Cc: Hou Zhiqiang Cc: Simon Horman Cc: Shawn Lin Cc: Heiko Stuebner Cc: Michal Simek Cc: rfi@lists.rocketboards.org Cc: linux-mediatek@lists.infradead.org Cc: linux-renesas-soc@vger.kernel.org Cc: linux-rockchip@lists.infradead.org commit ec11e5c213cc20cac5e8310728b06793448b9f6d Author: Jon Derrick Date: Tue Nov 12 05:47:53 2019 -0700 PCI: vmd: Add device id for VMD device 8086:9A0B This patch adds support for this VMD device which supports the bus restriction mode. Signed-off-by: Jon Derrick Signed-off-by: Lorenzo Pieralisi commit 08bcdd22ecdb01dd60d9284a55f8220a8a40150e Author: Jon Derrick Date: Tue Nov 12 05:47:52 2019 -0700 PCI: vmd: Add bus 224-255 restriction decode VMD bus restrictions are required when IO fabric is multiplexed such that VMD cannot use the entire bus range. This patch adds another bus restriction decode bit that can be set by firmware to restrict the VMD bus range to between 224-255. Signed-off-by: Jon Derrick Signed-off-by: Lorenzo Pieralisi commit c2ce4d23299fc8c40d5f20f2536eb56838c27762 Author: Chuhong Yuan Date: Wed Nov 13 14:38:21 2019 +0800 platform/chrome: cros_usbpd_logger: add missed destroy_workqueue in remove The driver forgets to destroy workqueue in remove. Add the missed call to fix it. Signed-off-by: Chuhong Yuan Signed-off-by: Enric Balletbo i Serra commit 6a82e23f45fe0aa821e7a935e39d0acb20c275c0 Author: Thomas Richter Date: Fri Nov 15 12:50:46 2019 +0100 s390/cpumf: Adjust registration of s390 PMU device drivers Linux-next commit titled "perf/core: Optimize perf_init_event()" changed the semantics of PMU device driver registration. It was done to speed up the lookup/handling of PMU device driver specific events. It also enforces that only one PMU device driver will be registered of type PERF_EVENT_RAW. This change added these line in function perf_pmu_register(): ... + ret = idr_alloc(&pmu_idr, pmu, max, 0, GFP_KERNEL); + if (ret < 0) goto free_pdc; + + WARN_ON(type >= 0 && ret != type); The warn_on generates a message. We have 3 PMU device drivers, each registered as type PERF_TYPE_RAW. The cf_diag device driver (arch/s390/kernel/perf_cpumf_cf_diag.c) always hits the WARN_ON because it is the second PMU device driver (after sampling device driver arch/s390/kernel/perf_cpumf_sf.c) which is registered as type 4 (PERF_TYPE_RAW). So when the sampling device driver is registered, ret has value 4. When cf_diag device driver is registered with type 4, ret has value of 5 and WARN_ON fires. Adjust the PMU device drivers for s390 to support the new semantics required by perf_pmu_register(). Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit 14ce38484419e8cb4f9fbd7eb7c2e8673b87a6f5 Author: Sudip Mukherjee Date: Wed Nov 20 15:17:08 2019 +0000 tty: remove unused argument from tty_open_by_driver() The argument 'inode' passed to tty_open_by_driver() was not being used. Remove the extra argument. Signed-off-by: Sudip Mukherjee Link: https://lore.kernel.org/r/20191120151709.14148-1-sudipm.mukherjee@gmail.com Signed-off-by: Greg Kroah-Hartman commit 60774d2af07a465dc916321e7428a4c5b7867ed4 Author: Saravana Kannan Date: Thu Nov 14 20:50:48 2019 -0800 i2c: of: Populate fwnode in of_i2c_get_board_info() This allows the of_devlink feature to work across i2c devices too. This avoid unnecessary probe deferrals of i2c devices, defers consumers of i2c devices till the i2c devices probe, and allows i2c drivers to implement sync_state() callbacks. Signed-off-by: Saravana Kannan Acked-by: Wolfram Sang Link: https://lore.kernel.org/r/20191115045049.261104-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 443633225ef9e07515578aa0d01bd214fa93db53 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:41:10 2019 +0800 dm: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Mike Snitzer commit 379c02ebcc9a30d1697923c10628ca32283675ff Author: Krzysztof Kozlowski Date: Wed Nov 20 21:40:13 2019 +0800 platform/chrome: cros_ec: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Signed-off-by: Enric Balletbo i Serra commit 1637a947e684dfdaae9e91b902297f65517259c9 Author: Christian Gromm Date: Wed Nov 20 15:05:38 2019 +0100 staging: most: core: remove sysfs attr remove_link This patch removes the sysfs attribute remove_link, as it is not needed anymore since the introduction of the configfs configuration interface. Signed-off-by: Christian Gromm Link: https://lore.kernel.org/r/1574258738-12863-1-git-send-email-christian.gromm@microchip.com Signed-off-by: Greg Kroah-Hartman commit 83072c35ee878cd3ad5e85c282dd13097de74b03 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:38:48 2019 +0800 staging: vc04: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133848.13250-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit ee5f771f10fcd536ca2ae6c1b695cbabf9ef3cbe Author: Krzysztof Kozlowski Date: Wed Nov 20 21:38:53 2019 +0800 staging: pi433: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133853.13308-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit f82ea85dd722b340225f576dfb28e04ad19d3b53 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:38:58 2019 +0800 staging: nvec: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133858.13369-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4574c517bb33d7189539782af4364d869c0f2725 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:39:03 2019 +0800 staging: most: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133903.13428-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit 63f1dae291b972551e25ff7c7e46a06ad4f013e8 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:39:07 2019 +0800 staging: fwserial: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133907.13483-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3750392ecc9d47303291a845c35756292fd971d1 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:39:11 2019 +0800 staging: fbtft: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133911.13539-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4500914d36860145c3c8a777646cfeca8a3f823f Author: Krzysztof Kozlowski Date: Wed Nov 20 21:38:43 2019 +0800 tty: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120133843.13189-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit abf5c67dc43cacf85d709d9c027a09e97849c8e4 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:42:56 2019 +0800 drivers: base: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120134256.16186-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit ab64ec1db25e0cceab0bad15b03fd57e2b461b15 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:40:56 2019 +0800 misc: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120134056.14677-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit c8175bd155c5c8e20008787148f8303ab20885b8 Author: Krzysztof Kozlowski Date: Wed Nov 20 21:42:47 2019 +0800 char: Fix Kconfig indentation Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20191120134247.16073-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6e6c18bcb78c0dc0601ebe216bed12c844492d0c Author: Alexander Shishkin Date: Wed Nov 20 15:08:06 2019 +0200 intel_th: pci: Add Tiger Lake CPU support This adds support for the Trace Hub in Tiger Lake CPU. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191120130806.44028-4-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 6a1743422a7c0fda26764a544136cac13e5ae486 Author: Alexander Shishkin Date: Wed Nov 20 15:08:05 2019 +0200 intel_th: pci: Add Ice Lake CPU support This adds support for the Trace Hub in Ice Lake CPU. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191120130806.44028-3-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 512592779a337feb5905d8fcf9498dbf33672d4a Author: Alexander Shishkin Date: Wed Nov 20 15:08:04 2019 +0200 intel_th: Fix a double put_device() in error path Commit a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices") factored out intel_th_subdevice_alloc() from intel_th_populate(), but got the error path wrong, resulting in two instances of a double put_device() on a freshly initialized, but not 'added' device. Fix this by only doing one put_device() in the error path. Signed-off-by: Alexander Shishkin Fixes: a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices") Reported-by: Wen Yang Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org # v4.14+ Link: https://lore.kernel.org/r/20191120130806.44028-2-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 189f39ee6ac51d1c3d753c4aeee5943abafc983e Author: Andy Shevchenko Date: Wed Nov 20 11:57:16 2019 +0200 fbtft: Drop OF dependency Now, since driver became OF independent, no need to keep OF dependency. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191120095716.26628-5-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8b2d3aeeb7ec8110458ba59bf9c8b3af84f1139a Author: Andy Shevchenko Date: Wed Nov 20 11:57:15 2019 +0200 fbtft: Make use of device property API Make use of device property API in this driver so that both OF based system and ACPI based system can use this driver. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191120095716.26628-4-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2494fd4c8388af803fcb5d5198b46d1285121afb Author: Andy Shevchenko Date: Wed Nov 20 11:57:14 2019 +0200 fbtft: Drop useless #ifdef CONFIG_OF and dead code First of all there is no need to guard GPIO request by CONFIG_OF. It works for everybody independently on resource provider. While here, rename the function to reflect the above. Moreover, since we have a global dependency to OF, the rest of conditional compilation is no-op, i.e. it's always be true. Due to above drop useless #ifdef CONFIG_OF and therefore dead code. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191120095716.26628-3-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 6753e7957fef5d9f48eaee25b87314d7a800eb3a Author: Andy Shevchenko Date: Wed Nov 20 11:57:13 2019 +0200 fbtft: Describe function parameters in kernel-doc Kernel documentation script complains that some of the function parameters are not described: drivers/staging/fbtft/fbtft-core.c:543: warning: Function parameter or member 'pdata' not described in 'fbtft_framebuffer_alloc' Describe function parameters where it's appropriate. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191120095716.26628-2-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 21f585480deb4bcf0d92b08879c35d066dfee030 Author: Andy Shevchenko Date: Wed Nov 20 11:57:12 2019 +0200 fbtft: Make sure string is NULL terminated New GCC warns about inappropriate use of strncpy(): drivers/staging/fbtft/fbtft-core.c: In function ‘fbtft_framebuffer_alloc’: drivers/staging/fbtft/fbtft-core.c:665:2: warning: ‘strncpy’ specified bound 16 equals destination size [-Wstringop-truncation] 665 | strncpy(info->fix.id, dev->driver->name, 16); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Later on the copy is being used with the assumption to be NULL terminated. Make sure string is NULL terminated by switching to snprintf(). Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20191120095716.26628-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 992edeaefed682511bd173dabd2f54b1ce5387df Author: Liran Alon Date: Wed Nov 20 14:24:52 2019 +0200 KVM: nVMX: Assume TLB entries of L1 and L2 are tagged differently if L0 use EPT Since commit 1313cc2bd8f6 ("kvm: mmu: Add guest_mode to kvm_mmu_page_role"), guest_mode was added to mmu-role and therefore if L0 use EPT, it will always run L1 and L2 with different EPTP. i.e. EPTP01!=EPTP02. Because TLB entries are tagged with EP4TA, KVM can assume TLB entries populated while running L2 are tagged differently than TLB entries populated while running L1. Therefore, update nested_has_guest_tlb_tag() to consider if L0 use EPT instead of if L1 use EPT. Reviewed-by: Joao Martins Reviewed-by: Krish Sadhukhan Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit 5637f60b6828c0abfd5fe3cc6922a7106b5366c7 Author: Liran Alon Date: Mon Nov 18 19:27:02 2019 +0200 KVM: x86: Unexport kvm_vcpu_reload_apic_access_page() The function is only used in kvm.ko module. Reviewed-by: Mark Kanda Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit c79eb77554bb6dde8ecd5319e2824e4c8e1f4819 Author: Chenyi Qiang Date: Tue Nov 19 16:33:59 2019 +0800 KVM: nVMX: add CR4_LA57 bit to nested CR4_FIXED1 When L1 guest uses 5-level paging, it fails vm-entry to L2 due to invalid host-state. It needs to add CR4_LA57 bit to nested CR4_FIXED1 MSR. Signed-off-by: Chenyi Qiang Reviewed-by: Xiaoyao Li Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini commit cc877670975be9082138e34f9e55d9d79c527b5c Author: Liran Alon Date: Mon Nov 18 21:11:21 2019 +0200 KVM: nVMX: Use semi-colon instead of comma for exit-handlers initialization Reviewed-by: Mark Kanda Signed-off-by: Liran Alon Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 9a2ae9f6b6bbd3ef05d5e5977ace854e9b8f04b5 Author: Nitesh Narayan Lal Date: Wed Nov 20 07:12:24 2019 -0500 KVM: x86: Zero the IOAPIC scan request dest vCPUs bitmap Not zeroing the bitmap used for identifying the destination vCPUs for an IOAPIC scan request in fixed delivery mode could lead to waking up unwanted vCPUs. This patch zeroes the vCPU bitmap before passing it to kvm_bitmap_or_dest_vcpus(), which is responsible for setting the bitmap with the bits corresponding to the destination vCPUs. Fixes: 7ee30bc132c6("KVM: x86: deliver KVM IOAPIC scan request to target vCPUs") Signed-off-by: Nitesh Narayan Lal Signed-off-by: Paolo Bonzini commit 407e62f52aadd8124dcba407f18a03aedce9b86a Merge: 20a15ee040f2 585d1183ffee Author: Thomas Gleixner Date: Wed Nov 20 14:16:34 2019 +0100 Merge tag 'irqchip-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip updates from Marc Zyngier: - Qualcomm PDC wakeup interrupt support - Layerscape external IRQ support - Broadcom bcm7038 PM and wakeup support - Ingenic driver cleanup and modernization - GICv3 ITS preparation for GICv4.1 updates - GICv4 fixes - Various cleanups commit a5c8b2ae2e5123c8a6b291e2c56ba5c39b645a95 Author: Manish Narani Date: Wed Nov 20 12:17:29 2019 +0530 mmc: sdhci-of-arasan: Add support for ZynqMP Platform Tap Delays Setup Apart from taps set by auto tuning, ZynqMP platform has feature to set the tap values manually. Add support to set tap delay values in HW via ZynqMP SoC framework. Signed-off-by: Manish Narani Signed-off-by: Ulf Hansson commit 1297eacfe79ed084f2608c43b31f3881ec9ffa7b Author: Manish Narani Date: Wed Nov 20 12:17:28 2019 +0530 dt-bindings: mmc: arasan: Document 'xlnx,zynqmp-8.9a' controller Add documentation for 'xlnx,zynqmp-8.9a' SDHCI controller and optional properties followed by example. Signed-off-by: Manish Narani Reviewed-by: Rob Herring Signed-off-by: Ulf Hansson commit 1ed7d5c8f82d2aebabb6fe24f436a68bdd8c1065 Author: Manish Narani Date: Wed Nov 20 12:17:27 2019 +0530 firmware: xilinx: Add SDIO Tap Delay nodes Add tap delay nodes for setting SDIO Tap Delays on ZynqMP platform. Signed-off-by: Manish Narani Signed-off-by: Ulf Hansson commit f3dafc374a82929c679a0e791f43cc53268af952 Author: Manish Narani Date: Wed Nov 20 12:17:26 2019 +0530 mmc: sdhci-of-arasan: Add support to set clock phase delays for SD Add support to read Clock Phase Delays from the DT and set it via clk_set_phase() API from clock framework. Some of the controllers might have their own handling of setting clock delays, for this keep the set_clk_delays as function pointer which can be assigned controller specific handling of the same. Signed-off-by: Manish Narani Signed-off-by: Ulf Hansson commit fec81c5bca2499b4a263667860018c2ce47f4f51 Author: Manish Narani Date: Wed Nov 20 12:17:25 2019 +0530 dt-bindings: mmc: Add optional generic properties for mmc Add optional properties for mmc hosts which are used to set clk delays for different speed modes in the controller. Signed-off-by: Manish Narani Signed-off-by: Ulf Hansson commit 07a14d1df4547ebc0104331511f25e2a7f3a8858 Author: Manish Narani Date: Wed Nov 20 12:17:24 2019 +0530 mmc: sdhci-of-arasan: Add sampling clock for a phy to use There are some operations like setting the clock delays may need to have two clocks, one for output path and one for input path. Adding input path clock for some phys to use. Signed-off-by: Manish Narani Signed-off-by: Ulf Hansson commit 1963ae50999b68f845961f5c3b83f91a393f59bd Author: Manish Narani Date: Wed Nov 20 12:17:23 2019 +0530 dt-bindings: mmc: arasan: Update Documentation for the input clock Add documentation for an optional input clock which is essentially used in sampling the input data coming from the card. Signed-off-by: Manish Narani Reviewed-by: Rob Herring Signed-off-by: Ulf Hansson commit e1463618cd8c1c381ef343cb6efb413ae355eb07 Author: Manish Narani Date: Wed Nov 20 12:17:22 2019 +0530 mmc: sdhci-of-arasan: Separate out clk related data to another structure To improve the code readability, use two different structs, one for clock provider data and one for mmc platform data. Signed-off-by: Manish Narani Signed-off-by: Ulf Hansson commit b0b19ce6e47ce17761a25e6c247d8749c8842992 Author: Fabio Estevam Date: Tue Nov 19 12:55:03 2019 -0300 mmc: sdhci: Fix grammar in warning message The correct form is "did not become", so fix it accordingly. Signed-off-by: Fabio Estevam Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 76216850b207ff61ef409903495bf4535050bc84 Author: Ivan Mikhaylov Date: Mon Nov 18 13:46:46 2019 +0300 mmc: sdhci-of-aspeed: add inversion signal presence Add read_l callback in sdhci_ops with flipping of SDHCI_CARD_PRESENT bit in case of inverted card detection signal. Signed-off-by: Ivan Mikhaylov Reviewed-by: Andrew Jeffery Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 9679062263c389e1c6ed81f7c0b85824c4179218 Author: Ivan Mikhaylov Date: Mon Nov 18 13:46:45 2019 +0300 mmc: sdhci-of-aspeed: enable CONFIG_MMC_SDHCI_IO_ACCESSORS Enable CONFIG_MMC_SDHCI_IO_ACCESSORS for the ASPEED MMC driver. The read_l callback is used for inverted card detection. Signed-off-by: Ivan Mikhaylov Reviewed-by: Andrew Jeffery Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit f545702b74f93b96bf70cf3fb12f5d68ce6ad677 Author: Faiz Abbas Date: Mon Nov 18 13:06:09 2019 +0530 mmc: sdhci_am654: Add Support for Command Queuing Engine to J721E Add Support for CQHCI (Command Queuing Host Controller Interface) for each of the host controllers present in TI's J721E devices. Add cqhci_ops and a .irq() callback to handle cqhci specific interrupts. Signed-off-by: Faiz Abbas Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 23cb16d2ccb5f819d7acff602e5a153157bf2884 Author: Lorenzo Bianconi Date: Sun Nov 17 14:26:14 2019 +0200 mt76: mt76u: fix endpoint definition order Even if they are not currently used fix BK/BE endpoint definition order. Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit acf5457fd99db6c9a42ef280494dfee949ee1e09 Author: Lorenzo Bianconi Date: Thu Nov 14 22:21:11 2019 +0200 mt76: mt7615: read {tx,rx} mask from eeprom Parse configured {tx,rx} mask from eeprom data instead of just setting it to four tx-rx streams Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit e49c76d455a93b6cc978ae9e9fab2a1e551c147e Author: Lorenzo Bianconi Date: Thu Nov 14 17:12:07 2019 +0200 mt76: move mt76_get_antenna in mt76_core module Move mt76_get_antenna in mac80211.c in order to be reused by all drivers. Initialize .get_antenna function pointer for mt76x0, mt7603, mt7615 and mt76x2u drivers Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit e8b970c8e367e85fab9b8ac4f36080e5d653c38e Author: Lorenzo Bianconi Date: Thu Nov 7 01:01:58 2019 +0200 mt76: fix possible out-of-bound access in mt7615_fill_txs/mt7603_fill_txs Fix possible out-of-bound access of status rates array in mt7615_fill_txs/mt7603_fill_txs routines Fixes: c5211e997eca ("mt76: mt7603: rework and fix tx status reporting") Fixes: 4af81f02b49c ("mt76: mt7615: sync with mt7603 rate control changes") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 45876d6ebbd26d2df178d1d5410642e73a289f67 Author: Stanislaw Gruszka Date: Tue Nov 5 11:00:32 2019 +0100 Revert "mt76: mt76x0e: don't use hw encryption for MT7630E" This reverts commit 34b0e9b767bfa09ae233ca0d6ceb299bf2e24600. Since commit 7bd0650be63c ("mt76: dma: fix buffer unmap with non-linear skbs") is no longer necessary to disable HW encryption for MT7630E. Disabling HW encryption helped previously because somehow fragmented skb's are not created if mac80211 encrypt frames, so buffer unmap bug of non-linear skbs was not triggered. Now since this bug is properly fixed by commit 7bd0650be63c ("mt76: dma: fix buffer unmap with non-linear skbs") , we can enable HW encryption back. Signed-off-by: Stanislaw Gruszka Acked-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 2b5d1b91e1741c48f00682dec7b1a0845f9792f3 Author: Lorenzo Bianconi Date: Fri Nov 1 23:21:07 2019 +0100 mt76: mt7615: disable radar pattern detector during scanning Set switch_reason to CH_SWITCH_SCAN_BYPASS_DPD during frequency scanning in order to disable radar pattern detector Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 0eb8c104fd8dfc2a8636b09b3f908170f7c9d037 Author: Lorenzo Bianconi Date: Thu Oct 31 11:03:12 2019 +0100 mt76: move interface_modes definition in mt76_core module Move interface modes declaration in common code since now mt76 chipsets support all modes (NL80211_IFTYPE_STATION, NL80211_IFTYPE_AP, NL80211_IFTYPE_MESH_POINT and NL80211_IFTYPE_ADHOC) Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 7f4b7920318b601bcea353b71d569a21846ffac5 Author: Lorenzo Bianconi Date: Tue Oct 8 00:49:00 2019 +0200 mt76: mt7615: add ibss support Enable IFTYPE_ADHOC support on 7615 devices. The feature has been tested using a mt76x2 device as wireless peer. Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 19d0affadd6e6122742381813809f2d9f5c49eca Author: Lorenzo Bianconi Date: Thu Oct 31 09:15:09 2019 +0100 mt76: move SUPPORTS_REORDERING_BUFFER hw property in mt76_register_device Move SUPPORTS_REORDERING_BUFFER hw property configuration from chip specific code to mt76_register_device since it is supported by all mt76 drivers Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 61c51a74a4e58673e28e79447f44279b0a52686b Author: Lorenzo Bianconi Date: Tue Oct 29 14:34:44 2019 +0100 mt76: use mt76_dev in mt76_is_{mmio,usb} Convert mt76_is_mmio and mt76_is_usb to rely on mt76_dev instead of mt76x02_dev since this is a property not strictly related to hw chipset and it will be more reusable Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit cc53b52daa091ee875372d843255728c3ec941e4 Author: zhengbin Date: Tue Oct 29 12:48:39 2019 +0800 mt76: Remove set but not used variable 'idx' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/mediatek/mt76/dma.c: In function mt76_dma_rx_fill: drivers/net/wireless/mediatek/mt76/dma.c:377:6: warning: variable idx set but not used [-Wunused-but-set-variable] It is not used since commit 17f1de56df05 ("mt76: add common code shared between multiple chipsets") Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Felix Fietkau commit 284efb473ef5f02a7f2c13fdf8d516ecc589bdf1 Author: Lorenzo Bianconi Date: Mon Oct 28 17:38:05 2019 +0100 mt76: mt76u: rely on a dedicated stats workqueue rate controller and throughput are very sensitive to tx status timing. In order to improve performances when the system is heavily loaded, substitute stat_work delayed_work with a regular work_struct and create a mt76u dedicated workqueue for tx status reporting Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 80df01f4dc79abbed724bbe0851cab3fe8ad9d99 Author: Lorenzo Bianconi Date: Mon Oct 28 16:21:41 2019 +0100 mt76: mt76u: rely on usb_interface instead of usb_dev usb drivers are supposed to communicate using usb_interface instead mt76x{0,2}u is now registering through usb_device. Fix it by passing usb_intf device to mt76_alloc_device routine. Fixes: 112f980ac8926 ("mt76usb: use usb_dev private data") Signed-off-by: Lorenzo Bianconi Tested-By: Zero_Chaos Signed-off-by: Felix Fietkau commit 5d1ad7d7bab0e9519c6f2a75fde6ab193279c5b3 Author: YueHaibing Date: Fri Oct 25 17:16:16 2019 +0800 mt76: mt7615: remove unneeded semicolon remove unneeded semicolon. This is detected by coccinelle. Signed-off-by: YueHaibing Signed-off-by: Felix Fietkau commit 2ec1e82bbf92c3031307beb89b59b589206c318c Author: Lorenzo Bianconi Date: Fri Oct 18 23:31:23 2019 +0200 mt76: mt76x0: remove 350ms delay in mt76x0_phy_calibrate Since mt76x0 does not save the phy calibration data it is not necessary to wait 350ms in mt76x0_phy_calibrate Tested-by: Sid Hayn Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit b86b173f634f9d53ae226c8e7e8af9e163f759c0 Author: Lorenzo Bianconi Date: Fri Oct 18 00:50:04 2019 +0200 mt76: mt76x02u: update ewma pkt len in mt76x02u_tx_prepare_skb Update ewma packet length in mt76x02u_tx_prepare_skb as it is done for pci counterpart in order to properly estimate tx time on current channel Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 3473750cd412e5506213e773e9fdd0729d1affe5 Author: Felix Fietkau Date: Mon Oct 14 12:01:09 2019 +0200 mt76: remove obsolete .add_buf() from struct mt76_queue_ops It hasn't been used in a while Signed-off-by: Felix Fietkau commit bf5238b25ac373cb2a544fe8554fd66fc9e04efc Author: Felix Fietkau Date: Thu Oct 10 21:59:46 2019 +0200 mt76: add sanity check for a-mpdu rx wcid index Avoid dereferencing invalid ids Signed-off-by: Felix Fietkau commit 237312c5e485804417e0f809f948112c3eb7fc96 Author: Lorenzo Bianconi Date: Tue Oct 15 17:16:43 2019 +0200 mt76: refactor cc_lock locking scheme Read busy counters not holding cc_lock spinlock since usb read can't be performed in interrupt context. Move cc_active and cc_rx counters out of cc_lock since they are not modified in interrupt context. Grab cc_lock updating cur_cc_bss_rx in mt76_airtime_report and do not hold rx_lock in mt76_update_survey. Moreover grab mt76 mutex in mt76_get_survey before running mt76_update_survey. This patch fixes the following 'schedule while atomic' [ 291.790866] BUG: scheduling while atomic: iw/2161/0x00000202 [ 291.791002] Preemption disabled at: [ 291.791007] [<0000000000000000>] 0x0 [ 291.791015] CPU: 0 PID: 2161 Comm: iw Tainted: G W 5.4.= 0-rc2-3-ARCH-00104-g9e208aa06c21 #1 [ 291.791017] Hardware name: LENOVO 2349QM6/2349QM6, BIOS G1ETC2WW (2.82=) 08/07/2019 [ 291.791019] Call Trace: [ 291.791042] dump_stack+0x5c/0x80 [ 291.791049] __schedule_bug.cold+0x8e/0x9b [ 291.791055] __schedule+0x5f8/0x770 [ 291.791062] schedule+0x43/0xd0 [ 291.791068] schedule_preempt_disabled+0x14/0x20 [ 291.791074] __mutex_lock.isra.0+0x18a/0x530 [ 291.791099] mt76u_rr+0x1f/0x40 [mt76_usb] [ 291.791113] mt76x02_update_channel+0x22/0x40 [mt76x02_lib] [ 291.791122] mt76_update_survey+0x42/0xe0 [mt76] [ 291.791129] mt76_get_survey+0x2f/0x1b0 [mt76] [ 291.791170] ieee80211_dump_survey+0x5e/0x140 [mac80211] [ 291.791217] nl80211_dump_survey+0x13c/0x2f0 [cfg80211] [ 291.791222] ? __kmalloc_reserve.isra.0+0x2d/0x70 [ 291.791225] ? __alloc_skb+0x96/0x1d0 [ 291.791229] netlink_dump+0x17b/0x370 [ 291.791247] __netlink_dump_start+0x16f/0x1e0 [ 291.791253] genl_family_rcv_msg+0x396/0x410 [ 291.791290] ? nl80211_prepare_wdev_dump+0x1b0/0x1b0 [cfg80211] [ 291.791297] ? _raw_spin_unlock_irqrestore+0x20/0x40 [ 291.791312] ? __wake_up_common_lock+0x8a/0xc0 [ 291.791316] genl_rcv_msg+0x47/0x90 [ 291.791320] ? genl_family_rcv_msg+0x410/0x410 [ 291.791323] netlink_rcv_skb+0x49/0x110 [ 291.791329] genl_rcv+0x24/0x40 [ 291.791333] netlink_unicast+0x171/0x200 [ 291.791340] netlink_sendmsg+0x208/0x3d0 [ 291.791358] sock_sendmsg+0x5e/0x60 [ 291.791361] ___sys_sendmsg+0x2ae/0x330 [ 291.791368] ? filemap_map_pages+0x272/0x390 [ 291.791374] ? _raw_spin_unlock+0x16/0x30 [ 291.791379] ? __handle_mm_fault+0x112f/0x1390 [ 291.791388] __sys_sendmsg+0x59/0xa0 [ 291.791396] do_syscall_64+0x5b/0x1a0 [ 291.791400] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 291.791404] RIP: 0033:0x7f5d0c7f37b7 [ 291.791418] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 0= 0 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05= <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 291.791421] RSP: 002b:00007ffe8b5d0538 EFLAGS: 00000246 ORIG_RAX: 0000= 00000000002e [ 291.791426] RAX: ffffffffffffffda RBX: 000055a038e6c390 RCX: 00007f5d0= c7f37b7 [ 291.791430] RDX: 0000000000000000 RSI: 00007ffe8b5d0570 RDI: 000000000= 0000003 [ 291.791434] RBP: 000055a038e718c0 R08: 000055a038e6c02a R09: 000000000= 0000002 [ 291.791438] R10: 000055a03808cb00 R11: 0000000000000246 R12: 000055a03= 8e71780 [ 291.791440] R13: 00007ffe8b5d0570 R14: 000055a038e717d0 R15: 000055a03= 8e718c0 [ 291.791480] NOHZ: local_softirq_pending 202 Fixes: 168aea24f4bb ("mt76: mt76x02u: enable survey support") Tested-by: Markus Theil Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit d1bc9bf2072c04e3303339437788fe224a33a7fa Author: Pawel Dembicki Date: Fri Oct 4 15:23:49 2019 +0200 mt76: mt76x0: eeprom: add support for MAC address from OF mt76x0e driver only supports MAC addresses from calibration data eeprom. Many routers however do not have a valid stock address set in this field. This patch makes it possible to take a MAC address from OF (e.g. from mtd). Signed-off-by: Pawel Dembicki [adjusted for kernel submission] Signed-off-by: Adrian Schmutzler Signed-off-by: Felix Fietkau commit 3e0705acd4de7821d42bea7fb01938ff05fd4d58 Author: Felix Fietkau Date: Mon Oct 7 12:33:39 2019 +0200 mt76: avoid enabling interrupt if NAPI poll is still pending if napi_complete() returns false, it means that polling is still pending. Interrupts should not fire until the polling is no longer scheduled Signed-off-by: Felix Fietkau commit e7aaa72f4728451487d7a3fe54225796d08ab1e5 Author: Felix Fietkau Date: Mon Oct 7 12:30:46 2019 +0200 mt76: fix aggregation stop issue Cancel the workqueue after the tid has been cleaned up, in order to avoid a possible rescheduling from within the work function. Signed-off-by: Felix Fietkau commit fb7d95c6ee4f71ba131c9b3c65d658369ffd1128 Author: Felix Fietkau Date: Mon Oct 7 15:30:18 2019 +0200 mt76: drop rcu read lock in mt76_rx_aggr_stop A rcu read locked section is not allowed to sleep, and the rcu lock here isn't actually necessary, because we're holding dev->mutex. Fixes an issue when the tid work item is still running while freeing a station or stopping the aggregation session Signed-off-by: Felix Fietkau commit 1a817fa73c3b27a593aadf0029de24db1bbc1a3e Author: Felix Fietkau Date: Mon Oct 7 12:32:14 2019 +0200 mt76: add missing locking around ampdu action This is needed primarily to avoid races in dealing with rx aggregation related data structures Signed-off-by: Felix Fietkau commit 36f7e2b2bb1de86f0072cd49ca93d82b9e8fd894 Author: Felix Fietkau Date: Sun Sep 29 22:04:37 2019 +0200 mt76: do not use devm API for led classdev With the devm API, the unregister happens after the device cleanup is done, after which the struct mt76_dev which contains the led_cdev has already been freed. This leads to a use-after-free bug that can crash the system. Signed-off-by: Felix Fietkau commit 55857ab857975080d9e400ca85a7c192f7986ab9 Author: Felix Fietkau Date: Fri Sep 6 11:29:09 2019 +0200 mt76: enable airtime fairness It is supported by all hardware drivers now Signed-off-by: Felix Fietkau Acked-by: Toke Høiland-Jørgensen commit b2c2f029683c4f42265c18dbb7e8ccbe06e6b01d Author: Lorenzo Bianconi Date: Wed Sep 18 12:58:05 2019 +0200 mt76: mt7615: track tx/rx airtime for airtime fairness Poll per-station hardware counters available in WTBL after tx/rx status events in order to report tx/rx airtime to mac80211 layer Co-developed-by: Felix Fietkau Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 87d3cdeb28113703d4caac5a6926e5a60ccedbeb Author: Lorenzo Bianconi Date: Wed Sep 18 12:58:03 2019 +0200 mt76: mt7615: introduce mt7615_mac_wtbl_update routine Introduce mt7615_mac_wtbl_update utility routine in order to update WTBL update register Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 29ed2a79de000a7cf48a2aba74f25b59f1bbc36d Author: Felix Fietkau Date: Thu Sep 26 18:23:56 2019 +0200 mt76: mt7615: fix survey channel busy time Like on mt7603, MIB status register 16 tracks CCA time, but does not include tx time. Switch to status register 9 to includ NAV and tx time as well. Signed-off-by: Felix Fietkau commit 6bfa6e38266d234c845c37e976084e6b524743b1 Author: Lorenzo Bianconi Date: Wed Sep 18 12:58:02 2019 +0200 mt76: mt7615: report tx_time, bss_rx and busy time to mac80211 Report tx time/rx time and obss time from hw mib counters to fill survey info requested by mac80211 Co-developed-by: Felix Fietkau Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 355f8d00c597f944213708d296e86a06f7a9ade8 Author: Felix Fietkau Date: Fri Sep 6 10:19:19 2019 +0200 mt76: mt76x02: track approximate tx airtime for airtime fairness and survey Estimate by calculating duration for EWMA packet size + estimated A-MPDU length on tx status events Signed-off-by: Felix Fietkau commit b02f42f4ed2ff5756780da024108866aa87aa528 Author: Felix Fietkau Date: Thu Sep 5 19:30:21 2019 +0200 mt76: mt76x02: move MT_CH_TIME_CFG init to mt76x02_mac_cc_reset Reduces code duplication and adds missing bits for USB variants Signed-off-by: Felix Fietkau commit aec65e484779c6326116be921cc1bf1aa8e85ecc Author: Felix Fietkau Date: Thu Sep 5 18:29:13 2019 +0200 mt76: unify channel survey update code Host time is used to calculate the channel active time on mt7603 and mt7615. Use the same on mt76x02 and move the lock to core code to get rid of some duplicated code. Signed-off-by: Felix Fietkau commit dcff8d4dc301c0601625ccae0dffec1bbef83234 Author: Felix Fietkau Date: Wed Sep 4 21:12:10 2019 +0200 mt76: mt7603: switch to a different counter for survey busy time MT_MIB_STAT_PSCCA only counts rx CCA busy time, which does not include tx time. MT_MIB_STAT_CCA counts full busy time, including Rx, Tx and NAV Signed-off-by: Felix Fietkau commit ea565833fd7848208eb63fc653d32a6ad3a86d87 Author: Felix Fietkau Date: Wed Sep 4 20:50:14 2019 +0200 mt76: mt7603: track tx airtime for airtime fairness and survey Poll per-station hardware counters after tx status events Signed-off-by: Felix Fietkau commit 5ce09c1a79074f613326f626f4781d21fc557296 Author: Felix Fietkau Date: Wed Sep 4 17:45:02 2019 +0200 mt76: track rx airtime for airtime fairness and survey Report total rx airtime for valid stations as BSS rx time in survey mt7615 is left out for now, it will be supported later by reading hardware counters instead of calculating airtime in software Signed-off-by: Felix Fietkau commit 0fd0eb54bfe09afc1c0fd5da2893338c215de276 Author: Felix Fietkau Date: Thu Sep 5 16:58:08 2019 +0200 mt76: store current channel survey_state in struct mt76_dev Move mt76_channel_state() from mt76.h to mac80211.c Preparation for updating channel state from more places in the drivers/core Signed-off-by: Felix Fietkau commit 9ec0b821b815243d60235220c45250805398147b Author: Felix Fietkau Date: Sat Aug 31 12:41:59 2019 +0200 mt76: rename mt76_driver_ops txwi_flags to drv_flags and include tx aligned4 This reduces the struct size and is useful for adding more flags later Signed-off-by: Felix Fietkau commit d515fdca46e7290547547f7a5e1a30c608eeb0ac Author: Felix Fietkau Date: Wed Aug 28 11:28:36 2019 +0200 mt76: report rx a-mpdu subframe status This can be used in monitor mode to figure out which subframes were sent as part of which A-MPDU Signed-off-by: Felix Fietkau commit 055da6cfd0dc5c87f8999f747cc9dce75b390419 Author: Felix Fietkau Date: Wed Aug 28 11:07:39 2019 +0200 mt76: mt7603: remove q_rx field from struct mt7603_dev It is no longer used Signed-off-by: Felix Fietkau commit 5a8d4678e02bb3ab89191336b505dd7a7212c4e3 Author: Lorenzo Bianconi Date: Fri Sep 13 09:05:54 2019 +0200 mt76: mt7603: collect aggregation stats Introduce ampdu_stat entry in mt7603 debugfs in order to dump 802.11 aggr cumulative statistics Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 75601194a1c80f4d2a830ce36b9c3e3abfd8d006 Author: Lorenzo Bianconi Date: Fri Sep 13 09:05:53 2019 +0200 mt76: mt7615: collect aggregation stats Introduce ampdu_stat entry in mt7615 debugfs in order to dump 802.11 aggr cumulative statistics Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit d7b47bbdd71cbd769501bf181d57e9ff12efc30b Author: Lorenzo Bianconi Date: Fri Sep 13 09:05:52 2019 +0200 mt76: move aggr_stats array in mt76_dev Move aggr_stats array from mt76x02_dev to mt76_dev in order to be reused adding aggregation stats for mt7603/mt7615 drivers Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 25990ed3816e0d47f56b5430bb9415d631e313a7 Author: Lorenzo Bianconi Date: Fri Sep 13 09:05:51 2019 +0200 mt76: mt7615: add queue entry in debugfs Introduce mt7615_queues_read routine to dump hw queue related info. Add hw ac queues statistics in mt7615 debugfs Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 0b82a8e8024b34cf99094105a44ae959c21b7534 Author: Lorenzo Bianconi Date: Fri Sep 13 09:05:50 2019 +0200 mt76: move queue debugfs entry to driver specific code Move queue debugfs entry to driver specific code since mt7615 devices rely on a different queue layout Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit fdb96b06040d0d410705f9b42851a75ec4106ae4 Author: Lorenzo Bianconi Date: Thu Sep 12 11:06:38 2019 +0200 mt76: mt76x02u: move mt76x02u_mac_start in mt76x02-usb module Unify mt76x02u_mac_start between mt76x2u and mt76x0u since the code is shared between both drivers Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit d5b3be417b015d4f401eba05943b5ca33137aecd Author: Lorenzo Bianconi Date: Thu Sep 12 11:06:37 2019 +0200 mt76: mt76x0u: reset counter starting the device Remove mt76x02_mac_reset_counters from mt76x0_init_hardware since it will be run starting the device Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit ad571c93169bbefd834b2359b782c5a94174c321 Author: Lorenzo Bianconi Date: Thu Sep 12 11:06:36 2019 +0200 mt76: mt76x2: move mt76x02_mac_reset_counters in mt76x02_mac_start Move mt76x02_mac_reset_counters in mt76x02_mac_start and get rid of mt76x2_mac_start since it is just a wrapper for mt76x02_mac_start Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 7b37cce09d187fdc4a2e2a57adb1b2e170d1dfe6 Author: Lorenzo Bianconi Date: Thu Sep 12 11:06:35 2019 +0200 mt76: mt76x02: move mac_reset_counter in mt76x02_lib module Unify mac_reset_counter routine and move it in mt76x02_lib module since it is shared by all mt76x02 drivers (pci/usb) Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 45971b2385d6a30b7d377c2e24728d680eae7553 Author: Lorenzo Bianconi Date: Fri Sep 6 17:29:04 2019 +0200 mt76: mt7615: enable SCS by default Enable Smart Carrier Sense algorithm by default in order to improve performances in a noisy environment Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 4482455409b044ed64b48e5e9c153469e2df7f86 Author: Colin Ian King Date: Fri Sep 6 13:19:26 2019 +0100 mt76: mt76x0e: make array mt76x0_chan_map static const, makes object smaller Don't populate the array mt76x0_chan_map on the stack but instead make it static const. Makes the object code smaller by 80 bytes. Before: text data bss dec hex filename 7685 1192 0 8877 22ad mediatek/mt76/mt76x0/eeprom.o After: text data bss dec hex filename 7541 1256 0 8797 225d mediatek/mt76/mt76x0/eeprom.o (gcc version 9.2.1, amd64) Signed-off-by: Colin Ian King Signed-off-by: Felix Fietkau commit af3076db14b1d143d53815bd37033a1b684ed6bc Author: Lorenzo Bianconi Date: Thu Sep 5 18:32:58 2019 +0200 mt76: usb: add lockdep_assert_held in __mt76u_vendor_request Introduce lockdep_assert_held macro in __mt76u_vendor_request routine and remove comments regarding usb_ctrl_mtx lock Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit a670111131db75b53c6377f26b4ccf12fe3912c8 Author: Lorenzo Bianconi Date: Thu Aug 22 11:49:10 2019 +0200 mt76: remove empty flag in mt76_txq_schedule_list Remove empty flag in mt76_txq_schedule_list and mt76_txq_send_burst since we just need retry_q length to notify mac80211 to reschedule the current tx queue Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit b0b2373db7fe3624f2c378795e21d23d9e23b06f Author: Felix Fietkau Date: Sun Sep 15 18:43:59 2019 +0200 mt76: use cancel_delayed_work_sync in mt76_rx_aggr_shutdown The workqueue item needs to be fully shut down before the struct can be freed. Signed-off-by: Felix Fietkau commit c7f647d9bdb062845592bd5fd56d726b554bb48b Author: Felix Fietkau Date: Sun Sep 15 18:43:14 2019 +0200 mt76: remove aggr_work field from struct mt76_wcid It is unused Signed-off-by: Felix Fietkau commit b4124a5b1a00d461e40c00755adda8ae05810648 Author: Felix Fietkau Date: Thu Sep 12 16:42:53 2019 +0200 mt76: mt7615: fix control frame rx in monitor mode Adjust filters and ensure frames don't get sent to MCU instead of host Signed-off-by: Felix Fietkau commit 72a81ad9d6d62dcb79f7e8ad66ffd1c768b72026 Author: Heiko Carstens Date: Sun Nov 17 14:55:38 2019 +0100 s390/smp: fix physical to logical CPU map for SMT If an SMT capable system is not IPL'ed from the first CPU the setup of the physical to logical CPU mapping is broken: the IPL core gets CPU number 0, but then the next core gets CPU number 1. Correct would be that all SMT threads of CPU 0 get the subsequent logical CPU numbers. This is important since a lot of code (like e.g. the CPU topology code) assumes that CPU maps are setup like this. If the mapping is broken the system will not IPL due to broken topology masks: [ 1.716341] BUG: arch topology broken [ 1.716342] the SMT domain not a subset of the MC domain [ 1.716343] BUG: arch topology broken [ 1.716344] the MC domain not a subset of the BOOK domain This scenario can usually not happen since LPARs are always IPL'ed from CPU 0 and also re-IPL is intiated from CPU 0. However older kernels did initiate re-IPL on an arbitrary CPU. If therefore a re-IPL from an old kernel into a new kernel is initiated this may lead to crash. Fix this by setting up the physical to logical CPU mapping correctly. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit c2313594216b3fde9559e502bb36d14e9d601a56 Author: Vasily Gorbik Date: Thu Nov 14 14:08:28 2019 +0100 s390/early: move access registers setup in C code Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit b8ce1fa4892cccff0576827c8fd7fcad1698de3b Author: Vasily Gorbik Date: Wed Nov 13 11:22:30 2019 +0100 s390/head64: remove unnecessary vdso_per_cpu_data setup vdso_per_cpu_data lowcore value is only needed for fully functional exception handlers, which are activated in setup_lowcore_dat_off. The same function does init vdso_per_cpu_data via vdso_alloc_boot_cpu. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit c02ee6a16a260ae00a403be440e229fd8618486b Author: Vasily Gorbik Date: Tue Nov 12 17:35:28 2019 +0100 s390/early: move control registers setup in C code Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 13f9bae579c6bd051e58f326913dd09af1291208 Author: Vasily Gorbik Date: Tue Nov 5 17:33:20 2019 +0100 s390/kasan: support memcpy_real with TRACE_IRQFLAGS Currently if the kernel is built with CONFIG_TRACE_IRQFLAGS and KASAN and used as crash kernel it crashes itself due to trace_hardirqs_off/trace_hardirqs_on being called with DAT off. This happens because trace_hardirqs_off/trace_hardirqs_on are instrumented and kasan code tries to perform access to shadow memory to validate memory accesses. Kasan shadow memory is populated with vmemmap, so all accesses require DAT on. memcpy_real could be called with DAT on or off (with kasan enabled DAT is set even before early code is executed). Make sure that trace_hardirqs_off/trace_hardirqs_on are called with DAT on and only actual __memcpy_real is called with DAT off. Also annotate __memcpy_real and _memcpy_real with __no_sanitize_address to avoid further problems due to switching DAT off. Reviewed-by: Philipp Rudo Signed-off-by: Vasily Gorbik commit 0398d4ab1677f7d8cd43aac2aa29a93dfcf9e2e3 Author: YueHaibing Date: Thu Nov 14 15:30:05 2019 +0800 s390/crypto: Fix unsigned variable compared with zero s390_crypto_shash_parmsize() return type is int, it should not be stored in a unsigned variable, which compared with zero. Reported-by: Hulk Robot Fixes: 3c2eb6b76cab ("s390/crypto: Support for SHA3 via CPACF (MSA6)") Signed-off-by: YueHaibing Signed-off-by: Joerg Schmidbauer Signed-off-by: Vasily Gorbik commit 0122baaa93cc681faace064ec25d16bb5c9825ab Merge: 093b92287363 83faaf074e6d Author: Joonas Lahtinen Date: Wed Nov 20 13:21:38 2019 +0200 Merge tag 'gvt-next-fixes-2019-11-12' of https://github.com/intel/gvt-linux into drm-intel-next-fixes gvt-next-fixes-2019-11-12 - Remove PVINFO read for initial state (Tina) Signed-off-by: Joonas Lahtinen From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20191112062032.GO4196@zhen-hp.sh.intel.com commit 1992b66d2f55cf36a14072cfd977fdf4f0d2f2c2 Author: Bjorn Helgaas Date: Tue Nov 19 08:09:23 2019 -0600 PM: Wrap documentation to fit in 80 columns Wrap to 80 columns. No textual change except to correct some "it's" that should be "its". Signed-off-by: Bjorn Helgaas Signed-off-by: Rafael J. Wysocki commit 5aa9ba6312e36c18626e73506b92d1513d815435 Author: Daniel Lezcano Date: Sat Nov 16 14:16:13 2019 +0100 cpuidle: Pass exit latency limit to cpuidle_use_deepest_state() Modify cpuidle_use_deepest_state() to take an additional exit latency limit argument to be passed to find_deepest_idle_state() and make cpuidle_idle_call() pass dev->forced_idle_latency_limit_ns to it for forced idle. Suggested-by: Rafael J. Wysocki Signed-off-by: Daniel Lezcano [ rjw: Rebase and rearrange code, subject & changelog ] Signed-off-by: Rafael J. Wysocki commit c55b51a06b01d67a99457bb82a8c31081c7faa23 Author: Daniel Lezcano Date: Sat Nov 16 14:16:12 2019 +0100 cpuidle: Allow idle injection to apply exit latency limit In some cases it may be useful to specify an exit latency limit for the idle state to be used during CPU idle time injection. Instead of duplicating the information in struct cpuidle_device or propagating the latency limit in the call stack, replace the use_deepest_state field with forced_latency_limit_ns to represent that limit, so that the deepest idle state with exit latency within that limit is forced (i.e. no governors) when it is set. A zero exit latency limit for forced idle means to use governors in the usual way (analogous to use_deepest_state equal to "false" before this change). Additionally, add play_idle_precise() taking two arguments, the duration of forced idle and the idle state exit latency limit, both in nanoseconds, and redefine play_idle() as a wrapper around that new function. This change is preparatory, no functional impact is expected. Suggested-by: Rafael J. Wysocki Signed-off-by: Daniel Lezcano [ rjw: Subject, changelog, cpuidle_use_deepest_state() kerneldoc, whitespace ] Signed-off-by: Rafael J. Wysocki commit 54fae6e31bed393a17512c1c8d2559bc737943c9 Author: Luca Coelho Date: Wed Apr 10 09:23:39 2019 +0300 iwlwifi: bump FW API to 52 for 22000 series Start supporting API version 52 for 22000 series. Signed-off-by: Luca Coelho commit 5974fbb5e10b018fdbe3c3b81cb4cc54e1105ab9 Author: Johannes Berg Date: Tue Nov 5 14:50:32 2019 +0100 iwlwifi: check kasprintf() return value kasprintf() can fail, we should check the return value. Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger") Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver") Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit b646a883ad74387ec17266e94720c46d6aaa1be2 Author: Johannes Berg Date: Mon Sep 30 14:16:18 2019 +0200 iwlwifi: mvm: remove outdated comment referring to wake lock There's no multicast wake lock in the driver, remove the comment that refers to it. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit 9b08ae2219b141a31de2935452e7fe20ea10a72d Author: Johannes Berg Date: Mon Sep 30 11:49:49 2019 +0200 iwlwifi: pcie: trace IOVA for iwlwifi_dev_tx_tb We trace the whole TFD with all TBs when in iwlwifi_dev_tx, but sometimes we add TBs to it later and then we don't have any of this data. Trace the I/O virtual address (IOVA) (it can be the physical address, or as returned by the IOMMU) here to aid debugging the DMA flows. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit e7babbe31fe28a812eb64dab16a0c4423c6ebadd Author: Denis Efremov Date: Wed Sep 25 23:49:35 2019 +0300 iwlwifi: dvm: excessive if in rs_bt_update_lq() There is no need to check 'priv->bt_ant_couple_ok' twice in rs_bt_update_lq(). The second check is always true. Thus, the expression can be simplified. Signed-off-by: Denis Efremov Signed-off-by: Luca Coelho commit e8503aeca3547d30087e8615156a7ba82a28b365 Author: Ben Greear Date: Thu Sep 5 14:28:01 2019 -0700 iwlwifi: mvm: Report tx/rx antennas This makes it easier for user-space to know how many antennas the radio has. Seems to work with the AX200 radio, at least. Signed-off-by: Ben Greear Signed-off-by: Luca Coelho commit 5661925a9b383f7cb348c196c6c69ab92f08102d Author: Johannes Berg Date: Fri Sep 27 11:11:20 2019 +0200 iwlwifi: pcie: rx: use rxq queue_size instead of constant This is a little less efficient now as it's known to be a multiqueue device in this function, but a future patch will have to use a variable here anyway, so use rxq->queue_size now instead to make it clearer. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit 924f838b6b368f81bab7778fa829def1e8552246 Author: Johannes Berg Date: Fri Sep 27 18:36:10 2019 +0200 iwlwifi: mvm: remove left-over non-functional email alias This email alias (ilw@linux.intel.com) hasn't been functional for probably closer to a decade than not, remove it. It's not really clear to me how this ended up in new code though. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit 49b7b35cf61f1b9f831dd3043c40c957a39d47aa Author: Johannes Berg Date: Fri Sep 27 10:42:38 2019 +0200 iwlwifi: config: remove max_rx_agg_size This field isn't set by any configuration, remove it. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit ab393cb12d035be73d9064456dae86393713f392 Author: Johannes Berg Date: Fri Sep 27 12:54:14 2019 +0200 iwlwifi: pcie: make some RX functions static These aren't used outside the rx.c file, so make them static. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho commit 17ffa21af93ad1558c12108701f6216ff1cc68c2 Author: Tova Mussai Date: Sun Sep 15 10:22:58 2019 +0300 iwlwifi: scan: support scan req FW API ver 13 1. Modify channel config flags to be used for legacy bands channels as well, to indicate SSIDs elements from ssidIEsArray. 2. Add new general flag. 3. Remove ssidNum from probe params. Signed-off-by: Tova Mussai Signed-off-by: Luca Coelho commit 4f4925a7b23428d5719af5a2816586b2a0e6fd19 Author: Johannes Berg Date: Fri Jun 1 10:32:55 2018 +0200 iwlwifi: pcie: fix support for transmitting SKBs with fraglist When the implementation of SKBs with fraglist was sent upstream, a merge-damage occurred and half the patch was not applied. This causes problems in high-throughput situations with AX200 devices, including low throughput and FW crashes. Introduce the part that was missing from the original patch. Fixes: 0044f1716c4d ("iwlwifi: pcie: support transmitting SKBs with fraglist") Cc: stable@vger.kernel.org # 4.20+ Signed-off-by: Johannes Berg [ This patch was created by me, but the original author of this code is Johannes, so his s-o-b is here and he's marked as the author of the patch. ] Signed-off-by: Luca Coelho commit 093b922873633f57cb2d488a538afd15c4e4dcdb Author: Chris Wilson Date: Thu Nov 14 17:25:35 2019 +0000 drm/i915: Split i915_active.mutex into an irq-safe spinlock for the rbtree As we want to be able to run inside atomic context for retiring the i915_active, and we are no longer allowed to abuse mutex_trylock, split the tree management portion of i915_active.mutex into an irq-safe spinlock. References: a0855d24fc22d ("locking/mutex: Complain upon mutex API misuse in IRQ contexts") References: https://bugs.freedesktop.org/show_bug.cgi?id=111626 Fixes: 274cbf20fd10 ("drm/i915: Push the i915_active.retire into a worker") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Matthew Auld Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191114172535.1116-1-chris@chris-wilson.co.uk (cherry picked from commit c9ad602feabe4271d2adf1bdae5d8b20c2dc84f1) Signed-off-by: Joonas Lahtinen commit e190de6941db14813032af87873f5550ad5764fe Author: Kai-Heng Feng Date: Wed Nov 20 16:20:35 2019 +0800 ALSA: hda - Add mute led support for HP ProBook 645 G4 Mic mute led does not work on HP ProBook 645 G4. We can use CXT_FIXUP_MUTE_LED_GPIO fixup to support it. Signed-off-by: Kai-Heng Feng Cc: Link: https://lore.kernel.org/r/20191120082035.18937-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai commit 3ef240eaff36b8119ac9e2ea17cbf41179c930ba Author: Thomas Gleixner Date: Wed Nov 6 22:55:46 2019 +0100 futex: Prevent exit livelock Oleg provided the following test case: int main(void) { struct sched_param sp = {}; sp.sched_priority = 2; assert(sched_setscheduler(0, SCHED_FIFO, &sp) == 0); int lock = vfork(); if (!lock) { sp.sched_priority = 1; assert(sched_setscheduler(0, SCHED_FIFO, &sp) == 0); _exit(0); } syscall(__NR_futex, &lock, FUTEX_LOCK_PI, 0,0,0); return 0; } This creates an unkillable RT process spinning in futex_lock_pi() on a UP machine or if the process is affine to a single CPU. The reason is: parent child set FIFO prio 2 vfork() -> set FIFO prio 1 implies wait_for_child() sched_setscheduler(...) exit() do_exit() .... mm_release() tsk->futex_state = FUTEX_STATE_EXITING; exit_futex(); (NOOP in this case) complete() --> wakes parent sys_futex() loop infinite because tsk->futex_state == FUTEX_STATE_EXITING The same problem can happen just by regular preemption as well: task holds futex ... do_exit() tsk->futex_state = FUTEX_STATE_EXITING; --> preemption (unrelated wakeup of some other higher prio task, e.g. timer) switch_to(other_task) return to user sys_futex() loop infinite as above Just for the fun of it the futex exit cleanup could trigger the wakeup itself before the task sets its futex state to DEAD. To cure this, the handling of the exiting owner is changed so: - A refcount is held on the task - The task pointer is stored in a caller visible location - The caller drops all locks (hash bucket, mmap_sem) and blocks on task::futex_exit_mutex. When the mutex is acquired then the exiting task has completed the cleanup and the state is consistent and can be reevaluated. This is not a pretty solution, but there is no choice other than returning an error code to user space, which would break the state consistency guarantee and open another can of problems including regressions. For stable backports the preparatory commits ac31c7ff8624 .. ba31c1a48538 are required as well, but for anything older than 5.3.y the backports are going to be provided when this hits mainline as the other dependencies for those kernels are definitely not stable material. Fixes: 778e9a9c3e71 ("pi-futex: fix exit races and locking problems") Reported-by: Oleg Nesterov Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Cc: Stable Team Link: https://lkml.kernel.org/r/20191106224557.041676471@linutronix.de commit ac31c7ff8624409ba3c4901df9237a616c187a5d Author: Thomas Gleixner Date: Wed Nov 6 22:55:45 2019 +0100 futex: Provide distinct return value when owner is exiting attach_to_pi_owner() returns -EAGAIN for various cases: - Owner task is exiting - Futex value has changed The caller drops the held locks (hash bucket, mmap_sem) and retries the operation. In case of the owner task exiting this can result in a live lock. As a preparatory step for seperating those cases, provide a distinct return value (EBUSY) for the owner exiting case. No functional change. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.935606117@linutronix.de commit 3f186d974826847a07bc7964d79ec4eded475ad9 Author: Thomas Gleixner Date: Wed Nov 6 22:55:44 2019 +0100 futex: Add mutex around futex exit The mutex will be used in subsequent changes to replace the busy looping of a waiter when the futex owner is currently executing the exit cleanup to prevent a potential live lock. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.845798895@linutronix.de commit af8cbda2cfcaa5515d61ec500498d46e9a8247e2 Author: Thomas Gleixner Date: Wed Nov 6 22:55:43 2019 +0100 futex: Provide state handling for exec() as well exec() attempts to handle potentially held futexes gracefully by running the futex exit handling code like exit() does. The current implementation has no protection against concurrent incoming waiters. The reason is that the futex state cannot be set to FUTEX_STATE_DEAD after the cleanup because the task struct is still active and just about to execute the new binary. While its arguably buggy when a task holds a futex over exec(), for consistency sake the state handling can at least cover the actual futex exit cleanup section. This provides state consistency protection accross the cleanup. As the futex state of the task becomes FUTEX_STATE_OK after the cleanup has been finished, this cannot prevent subsequent attempts to attach to the task in case that the cleanup was not successfull in mopping up all leftovers. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.753355618@linutronix.de commit 4a8e991b91aca9e20705d434677ac013974e0e30 Author: Thomas Gleixner Date: Wed Nov 6 22:55:42 2019 +0100 futex: Sanitize exit state handling Instead of having a smp_mb() and an empty lock/unlock of task::pi_lock move the state setting into to the lock section. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.645603214@linutronix.de commit 18f694385c4fd77a09851fd301236746ca83f3cb Author: Thomas Gleixner Date: Wed Nov 6 22:55:41 2019 +0100 futex: Mark the begin of futex exit explicitly Instead of relying on PF_EXITING use an explicit state for the futex exit and set it in the futex exit function. This moves the smp barrier and the lock/unlock serialization into the futex code. As with the DEAD state this is restricted to the exit path as exec continues to use the same task struct. This allows to simplify that logic in a next step. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.539409004@linutronix.de commit f24f22435dcc11389acc87e5586239c1819d217c Author: Thomas Gleixner Date: Wed Nov 6 22:55:40 2019 +0100 futex: Set task::futex_state to DEAD right after handling futex exit Setting task::futex_state in do_exit() is rather arbitrarily placed for no reason. Move it into the futex code. Note, this is only done for the exit cleanup as the exec cleanup cannot set the state to FUTEX_STATE_DEAD because the task struct is still in active use. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.439511191@linutronix.de commit 150d71584b12809144b8145b817e83b81158ae5f Author: Thomas Gleixner Date: Wed Nov 6 22:55:39 2019 +0100 futex: Split futex_mm_release() for exit/exec To allow separate handling of the futex exit state in the futex exit code for exit and exec, split futex_mm_release() into two functions and invoke them from the corresponding exit/exec_mm_release() callsites. Preparatory only, no functional change. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.332094221@linutronix.de commit 4610ba7ad877fafc0a25a30c6c82015304120426 Author: Thomas Gleixner Date: Wed Nov 6 22:55:38 2019 +0100 exit/exec: Seperate mm_release() mm_release() contains the futex exit handling. mm_release() is called from do_exit()->exit_mm() and from exec()->exec_mm(). In the exit_mm() case PF_EXITING and the futex state is updated. In the exec_mm() case these states are not touched. As the futex exit code needs further protections against exit races, this needs to be split into two functions. Preparatory only, no functional change. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.240518241@linutronix.de commit 3d4775df0a89240f671861c6ab6e8d59af8e9e41 Author: Thomas Gleixner Date: Wed Nov 6 22:55:37 2019 +0100 futex: Replace PF_EXITPIDONE with a state The futex exit handling relies on PF_ flags. That's suboptimal as it requires a smp_mb() and an ugly lock/unlock of the exiting tasks pi_lock in the middle of do_exit() to enforce the observability of PF_EXITING in the futex code. Add a futex_state member to task_struct and convert the PF_EXITPIDONE logic over to the new state. The PF_EXITING dependency will be cleaned up in a later step. This prepares for handling various futex exit issues later. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.149449274@linutronix.de commit ba31c1a48538992316cc71ce94fa9cd3e7b427c0 Author: Thomas Gleixner Date: Wed Nov 6 22:55:36 2019 +0100 futex: Move futex exit handling into futex code The futex exit handling is #ifdeffed into mm_release() which is not pretty to begin with. But upcoming changes to address futex exit races need to add more functionality to this exit code. Split it out into a function, move it into futex code and make the various futex exit functions static. Preparatory only and no functional change. Folded build fix from Borislav. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191106224556.049705556@linutronix.de commit eac08515d7bd665d306cefa2ae9f3de56e875d6d Author: zhengbin Date: Tue Nov 19 10:25:14 2019 +0800 rtl8xxxu: Remove set but not used variable 'vif','dev','len' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c: In function rtl8xxxu_c2hcmd_callback: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:5396:24: warning: variable vif set but not used [-Wunused-but-set-variable] drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c: In function rtl8xxxu_c2hcmd_callback: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:5397:17: warning: variable dev set but not used [-Wunused-but-set-variable] drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c: In function rtl8xxxu_c2hcmd_callback: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:5400:6: warning: variable len set but not used [-Wunused-but-set-variable] They are introduced by commit e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna"), but never used, so remove them. Reported-by: Hulk Robot Signed-off-by: zhengbin Reviewed-by: Chris Chiu Signed-off-by: Kalle Valo commit 4f61563da075bc8faefddfd5f8fc0cc14c49650a Author: Rafał Miłecki Date: Mon Nov 18 13:38:55 2019 +0100 brcmfmac: remove monitor interface when detaching This fixes a minor WARNING in the cfg80211: [ 130.658034] ------------[ cut here ]------------ [ 130.662805] WARNING: CPU: 1 PID: 610 at net/wireless/core.c:954 wiphy_unregister+0xb4/0x198 [cfg80211] Signed-off-by: Rafał Miłecki Signed-off-by: Kalle Valo commit 5d26a6a6150c486f51ea2aaab33af04db02f63b8 Author: Rafał Miłecki Date: Mon Nov 18 12:53:08 2019 +0100 brcmfmac: disable PCIe interrupts before bus reset Keeping interrupts on could result in brcmfmac freeing some resources and then IRQ handlers trying to use them. That was obviously a straight path for crashing a kernel. Example: CPU0 CPU1 ---- ---- brcmf_pcie_reset brcmf_pcie_bus_console_read brcmf_detach ... brcmf_fweh_detach brcmf_proto_detach brcmf_pcie_isr_thread ... brcmf_proto_msgbuf_rx_trigger ... drvr->proto->pd brcmf_pcie_release_irq [ 363.789218] Unable to handle kernel NULL pointer dereference at virtual address 00000038 [ 363.797339] pgd = c0004000 [ 363.800050] [00000038] *pgd=00000000 [ 363.803635] Internal error: Oops: 17 [#1] SMP ARM (...) [ 364.029209] Backtrace: [ 364.031725] [] (brcmf_proto_msgbuf_rx_trigger [brcmfmac]) from [] (brcmf_pcie_isr_thread+0x228/0x274 [brcmfmac]) [ 364.043662] r7:00000001 r6:c8ca0000 r5:00010000 r4:c7b4f800 Fixes: 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Rafał Miłecki Signed-off-by: Kalle Valo commit 3dff7c6e37499c87a7ba3f728b2ad1775cbbf725 Author: Yan-Hsuan Chuang Date: Mon Nov 18 17:54:32 2019 +0800 rtw88: allows to enable/disable HCI link PS mechanism Different interfaces have its own link-related power save mechanism. Such as PCI can enter L1 state based on the traffic on the link, and sometimes driver needs to enable/disable it to avoid some issues, like throughput degrade when PCI trying to enter L1 state even if driver is having heavy traffic. For now, rtw88 only supports PCIE chips, and they just need to disable ASPM L1 when driver is not in power save mode, such as IPS and LPS. Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit d2e2c47e65af7310ad7d40ebf4cbb1d898719ec2 Author: Yan-Hsuan Chuang Date: Mon Nov 18 17:54:31 2019 +0800 rtw88: pci: enable CLKREQ function if host supports it By Realtek's design, there are two HW modules associated for CLKREQ, one is responsible to follow the PCIE host settings, and another is to actually working on it. But the module that is actually working on it is default disabled, and driver should enable that module if host and device have successfully sync'ed with each other. The module is default disabled because sometimes the host does not support it, and if there is any incorrect settings (ex. CLKREQ# is not Bi-Direction), device can be lost and disconnected to the host. So driver should first check after host and device are sync'ed, and the host does support the function and set it in configuration space, then driver can turn on the HW module to working on it. Signed-off-by: Yan-Hsuan Chuang Reviewed-by: Chris Chiu Signed-off-by: Kalle Valo commit ff3297f62fff6fc90d35051eec48913dbd9cbb18 Author: Yan-Hsuan Chuang Date: Mon Nov 18 17:54:30 2019 +0800 rtw88: pci: use for loop instead of while loop for DBI/MDIO Use a for loop to polling DBI/MDIO read/write flags to avoid infinite loop happens Signed-off-by: Yan-Hsuan Chuang Reviewed-by: Chris Chiu Signed-off-by: Kalle Valo commit 83a5a2d76f996ff47dc9fbf09d80bbff6bf85e71 Author: Yan-Hsuan Chuang Date: Mon Nov 18 17:54:29 2019 +0800 rtw88: pci: use macros to access PCI DBI/MDIO registers Add some register and bit macros to access DBI/MDIO register. This should not change the logic. Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo commit df0af4c7bac47039c97682fbf2c1cbe6efb08950 Author: Mikhail Karpenko Date: Mon Nov 18 08:23:16 2019 +0000 qtnfmac: process HE capabilities requests Pass HE interface type data requests between firmware and driver. Signed-off-by: Mikhail Karpenko Signed-off-by: Kalle Valo commit be4f00cf15925903138577263bfc2366183a0704 Author: Mikhail Karpenko Date: Mon Nov 18 08:23:14 2019 +0000 qtnfmac: add TLV for extension IEs Extension information elements have additional field for ID. This commit adds TLV for such elements and a structure for interface HE capabilities communication with firmware. Signed-off-by: Mikhail Karpenko Signed-off-by: Kalle Valo commit 1db359946bd1602dd7a70ca461c7cfb3835ab270 Author: Igor Mitsyanko Date: Mon Nov 18 08:23:12 2019 +0000 qtnfmac: signal that all packets coming from device are already flooded Firmware floods all packets that need to be flooded (multicast, broadcast, unknown unicast) as required. Tell kernel bridge subsystem it does not need to flood packet itself by marking each incoming frame with skb->offload_fwd_mark flag. Signed-off-by: Igor Mitsyanko Signed-off-by: Kalle Valo commit 4e14e76cee382619766176095ac0c10651980b66 Author: Igor Mitsyanko Date: Mon Nov 18 08:23:10 2019 +0000 qtnfmac: advertise netdev port parent ID Use MAC address of the first active radio as a unique device ID. Signed-off-by: Igor Mitsyanko Signed-off-by: Kalle Valo commit 904628d3130b5aef0c9b06efa80e5a96f203e000 Author: Igor Mitsyanko Date: Mon Nov 18 08:23:08 2019 +0000 qtnfmac: add interface ID to each packet Add interface ID information to the tail of each transmitted packet so that firmware can know to which interface the packet belongs to. This is only needed if device supports HW switch capability. Signed-off-by: Igor Mitsyanko Signed-off-by: Kalle Valo commit decfc5c70d206fdfba5de8405eb9148de6d7897b Author: Igor Mitsyanko Date: Mon Nov 18 08:23:06 2019 +0000 qtnfmac: track broadcast domain of each interface If firmware reports that it supports hardware switch capabilities, driver needs to track and notify device whenever broadcast domain of a particular network device changes (ie. whenever it's upper master device changes). Firmware needs a unique ID to tell broadcast domains from each other which is an opaque number otherwise. For that purpose we can use netspace:ifidx pair to uniquely identify each broadcast domain: - if netdev is not part of a bridge, then use it's own ifidx as a broadcast domain ID - if netdev is part of a bridge, then use bridge netdev ifidx as broadcast domain ID Firmware makes sure that packets are only forwarded between interfaces marked with the same broadcast domain ID. Signed-off-by: Igor Mitsyanko Signed-off-by: Kalle Valo commit 45028223425dc37d3452da7e9bd01f7789024ee7 Author: Igor Mitsyanko Date: Mon Nov 18 08:23:04 2019 +0000 qtnfmac: remove VIF in firmware in case of error Currently in case of error when registering network device with the kernel, we won't properly cleanup VIF state in firmware due to DEL_VIF command will not be send to wifi card. Make sure it does. Signed-off-by: Igor Mitsyanko Signed-off-by: Kalle Valo commit 4c8c0d8f709d16f418a5d1962b4eda86ff570151 Author: Ping-Ke Shih Date: Mon Nov 18 11:14:55 2019 +0800 rtlwifi: set proper udelay within rf_serial_read Since read RF register is an indirect access that hardware needs time to accomplish read action, but there's no ready bit, so delay is required to guarantee the read value is correct. After investigating internal documents, these delays are reduced as proper values. Reported-by: Lucas Stach Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo commit 92541dd9dda5ab474751e24cdb4253eb290b8b33 Author: Ping-Ke Shih Date: Mon Nov 18 11:14:54 2019 +0800 rtlwifi: rf_lock use non-irqsave spin_lock rf_lock is used to protect RF register access, but they will not called from interrupt context, so *_irqsave version isn't necessary. Then, these delays don't affect IRQ services. The old code holds spin_lock_irqsave() that will be detected a long delay as below: kworker/-276 4d... 0us : _raw_spin_lock_irqsave kworker/-276 4d... 0us : rtl8723_phy_rf_serial_read <-rtl8723de_phy_set_rf_reg kworker/-276 4d... 1us : rtl8723_phy_query_bb_reg <-rtl8723_phy_rf_serial_read kworker/-276 4d... 3us : rtl8723_phy_set_bb_reg <-rtl8723_phy_rf_serial_read kworker/-276 4d... 4us : __const_udelay <-rtl8723_phy_rf_serial_read kworker/-276 4d... 4us!: delay_mwaitx <-rtl8723_phy_rf_serial_read kworker/-276 4d... 1004us : rtl8723_phy_set_bb_reg <-rtl8723_phy_rf_serial_read [...] Reported-by: Lucas Stach Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo commit f89f1aefff5a53917579bbf8b85be09d7cc17daf Author: zhengbin Date: Sat Nov 16 15:41:23 2019 +0800 ipw2x00: remove set but not used variable 'force_update' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/intel/ipw2x00/ipw2100.c: In function shim__set_security: drivers/net/wireless/intel/ipw2x00/ipw2100.c:5582:9: warning: variable force_update set but not used [-Wunused-but-set-variable] Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Kalle Valo commit 805a57acd7b52e1ba0ad2649e33c585bba958633 Author: zhengbin Date: Sat Nov 16 15:41:22 2019 +0800 ipw2x00: remove set but not used variable 'reason' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/intel/ipw2x00/ipw2200.c: In function ipw_wx_set_mlme: drivers/net/wireless/intel/ipw2x00/ipw2200.c:6805:9: warning: variable reason set but not used [-Wunused-but-set-variable] Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Kalle Valo commit 7af496b9eb0433bc4cb478c9a46f85509cdb5541 Author: zhengbin Date: Sat Nov 16 15:22:47 2019 +0800 brcmfmac: remove set but not used variable 'mpnum','nsp','nmp' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c: In function brcmf_chip_dmp_get_regaddr: drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:790:5: warning: variable mpnum set but not used [-Wunused-but-set-variable] drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c: In function brcmf_chip_dmp_erom_scan: drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:866:10: warning: variable nsp set but not used [-Wunused-but-set-variable] drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c: In function brcmf_chip_dmp_erom_scan: drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:866:5: warning: variable nmp set but not used [-Wunused-but-set-variable] Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Kalle Valo commit 65309ef6b258f5a7b57c1033a82ba2aba5c434cc Author: Laurence Oberman Date: Tue Nov 19 10:46:34 2019 -0500 scsi: bnx2fc: timeout calculation invalid for bnx2fc_eh_abort() In the bnx2fc_eh_abort() function there is a calculation for wait_for_completion that uses a HZ multiplier. This is incorrect, it scales the timeout by 1000 seconds instead of converting the ms value to jiffies. Therefore change the calculation. Link: https://lore.kernel.org/r/1574178394-16635-1-git-send-email-loberman@redhat.com Reported-by: David Jeffery Reviewed-by: John Pittman Reviewed-by: Chad Dupuis Signed-off-by: Laurence Oberman Signed-off-by: Martin K. Petersen commit c941e0d172605731de9b4628bd4146d35cf2e7d6 Author: Bart Van Assche Date: Thu Nov 7 13:55:25 2019 -0800 scsi: target: core: Fix a pr_debug() argument Print the string for which conversion failed instead of printing the function name twice. Fixes: 2650d71e244f ("target: move transport ID handling to the core") Cc: Christoph Hellwig Link: https://lore.kernel.org/r/20191107215525.64415-1-bvanassche@acm.org Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 238191d65d7217982d69e21c1d623616da34b281 Author: Anatol Pomazau Date: Fri Nov 15 19:47:35 2019 -0500 scsi: iscsi: Don't send data to unbound connection If a faulty initiator fails to bind the socket to the iSCSI connection before emitting a command, for instance, a subsequent send_pdu, it will crash the kernel due to a null pointer dereference in sock_sendmsg(), as shown in the log below. This patch makes sure the bind succeeded before trying to use the socket. BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.4.0-rc2.iscsi+ #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 24.158246] Workqueue: iscsi_q_0 iscsi_xmitworker [ 24.158883] RIP: 0010:apparmor_socket_sendmsg+0x5/0x20 [...] [ 24.161739] RSP: 0018:ffffab6440043ca0 EFLAGS: 00010282 [ 24.162400] RAX: ffffffff891c1c00 RBX: ffffffff89d53968 RCX: 0000000000000001 [ 24.163253] RDX: 0000000000000030 RSI: ffffab6440043d00 RDI: 0000000000000000 [ 24.164104] RBP: 0000000000000030 R08: 0000000000000030 R09: 0000000000000030 [ 24.165166] R10: ffffffff893e66a0 R11: 0000000000000018 R12: ffffab6440043d00 [ 24.166038] R13: 0000000000000000 R14: 0000000000000000 R15: ffff9d5575a62e90 [ 24.166919] FS: 0000000000000000(0000) GS:ffff9d557db80000(0000) knlGS:0000000000000000 [ 24.167890] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.168587] CR2: 0000000000000018 CR3: 000000007a838000 CR4: 00000000000006e0 [ 24.169451] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.170320] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.171214] Call Trace: [ 24.171537] security_socket_sendmsg+0x3a/0x50 [ 24.172079] sock_sendmsg+0x16/0x60 [ 24.172506] iscsi_sw_tcp_xmit_segment+0x77/0x120 [ 24.173076] iscsi_sw_tcp_pdu_xmit+0x58/0x170 [ 24.173604] ? iscsi_dbg_trace+0x63/0x80 [ 24.174087] iscsi_tcp_task_xmit+0x101/0x280 [ 24.174666] iscsi_xmit_task+0x83/0x110 [ 24.175206] iscsi_xmitworker+0x57/0x380 [ 24.175757] ? __schedule+0x2a2/0x700 [ 24.176273] process_one_work+0x1b5/0x360 [ 24.176837] worker_thread+0x50/0x3c0 [ 24.177353] kthread+0xf9/0x130 [ 24.177799] ? process_one_work+0x360/0x360 [ 24.178401] ? kthread_park+0x90/0x90 [ 24.178915] ret_from_fork+0x35/0x40 [ 24.179421] Modules linked in: [ 24.179856] CR2: 0000000000000018 [ 24.180327] ---[ end trace b4b7674b6df5f480 ]--- Signed-off-by: Anatol Pomazau Co-developed-by: Frank Mayhar Signed-off-by: Frank Mayhar Co-developed-by: Bharath Ravi Signed-off-by: Bharath Ravi Co-developed-by: Khazhimsel Kumykov Signed-off-by: Khazhimsel Kumykov Co-developed-by: Gabriel Krisman Bertazi Signed-off-by: Gabriel Krisman Bertazi Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen commit e9d3009cb936bd0faf0719f68d98ad8afb1e613b Author: Bart Van Assche Date: Wed Nov 13 14:05:08 2019 -0800 scsi: target: iscsi: Wait for all commands to finish before freeing a session The iSCSI target driver is the only target driver that does not wait for ongoing commands to finish before freeing a session. Make the iSCSI target driver wait for ongoing commands to finish before freeing a session. This patch fixes the following KASAN complaint: BUG: KASAN: use-after-free in __lock_acquire+0xb1a/0x2710 Read of size 8 at addr ffff8881154eca70 by task kworker/0:2/247 CPU: 0 PID: 247 Comm: kworker/0:2 Not tainted 5.4.0-rc1-dbg+ #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: target_completion target_complete_ok_work [target_core_mod] Call Trace: dump_stack+0x8a/0xd6 print_address_description.constprop.0+0x40/0x60 __kasan_report.cold+0x1b/0x33 kasan_report+0x16/0x20 __asan_load8+0x58/0x90 __lock_acquire+0xb1a/0x2710 lock_acquire+0xd3/0x200 _raw_spin_lock_irqsave+0x43/0x60 target_release_cmd_kref+0x162/0x7f0 [target_core_mod] target_put_sess_cmd+0x2e/0x40 [target_core_mod] lio_check_stop_free+0x12/0x20 [iscsi_target_mod] transport_cmd_check_stop_to_fabric+0xd8/0xe0 [target_core_mod] target_complete_ok_work+0x1b0/0x790 [target_core_mod] process_one_work+0x549/0xa40 worker_thread+0x7a/0x5d0 kthread+0x1bc/0x210 ret_from_fork+0x24/0x30 Allocated by task 889: save_stack+0x23/0x90 __kasan_kmalloc.constprop.0+0xcf/0xe0 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0xf6/0x360 transport_alloc_session+0x29/0x80 [target_core_mod] iscsi_target_login_thread+0xcd6/0x18f0 [iscsi_target_mod] kthread+0x1bc/0x210 ret_from_fork+0x24/0x30 Freed by task 1025: save_stack+0x23/0x90 __kasan_slab_free+0x13a/0x190 kasan_slab_free+0x12/0x20 kmem_cache_free+0x146/0x400 transport_free_session+0x179/0x2f0 [target_core_mod] transport_deregister_session+0x130/0x180 [target_core_mod] iscsit_close_session+0x12c/0x350 [iscsi_target_mod] iscsit_logout_post_handler+0x136/0x380 [iscsi_target_mod] iscsit_response_queue+0x8de/0xbe0 [iscsi_target_mod] iscsi_target_tx_thread+0x27f/0x370 [iscsi_target_mod] kthread+0x1bc/0x210 ret_from_fork+0x24/0x30 The buggy address belongs to the object at ffff8881154ec9c0 which belongs to the cache se_sess_cache of size 352 The buggy address is located 176 bytes inside of 352-byte region [ffff8881154ec9c0, ffff8881154ecb20) The buggy address belongs to the page: page:ffffea0004553b00 refcount:1 mapcount:0 mapping:ffff888101755400 index:0x0 compound_mapcount: 0 flags: 0x2fff000000010200(slab|head) raw: 2fff000000010200 dead000000000100 dead000000000122 ffff888101755400 raw: 0000000000000000 0000000080130013 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881154ec900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881154ec980: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb >ffff8881154eca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881154eca80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881154ecb00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc Cc: Mike Christie Link: https://lore.kernel.org/r/20191113220508.198257-3-bvanassche@acm.org Reviewed-by: Roman Bolshakov Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 80647a89eaf3f2549741648f3230cd6ff68c23b4 Author: Bart Van Assche Date: Wed Nov 13 14:05:07 2019 -0800 scsi: target: core: Release SPC-2 reservations when closing a session The SCSI specs require releasing SPC-2 reservations when a session is closed. Make sure that the target core does this. Running the libiscsi tests triggers the KASAN complaint shown below. This patch fixes that use-after-free. BUG: KASAN: use-after-free in target_check_reservation+0x171/0x980 [target_core_mod] Read of size 8 at addr ffff88802ecd1878 by task iscsi_trx/17200 CPU: 0 PID: 17200 Comm: iscsi_trx Not tainted 5.4.0-rc1-dbg+ #1 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack+0x8a/0xd6 print_address_description.constprop.0+0x40/0x60 __kasan_report.cold+0x1b/0x34 kasan_report+0x16/0x20 __asan_load8+0x58/0x90 target_check_reservation+0x171/0x980 [target_core_mod] __target_execute_cmd+0xb1/0xf0 [target_core_mod] target_execute_cmd+0x22d/0x4d0 [target_core_mod] transport_generic_new_cmd+0x31f/0x5b0 [target_core_mod] transport_handle_cdb_direct+0x6f/0x90 [target_core_mod] iscsit_execute_cmd+0x381/0x3f0 [iscsi_target_mod] iscsit_sequence_cmd+0x13b/0x1f0 [iscsi_target_mod] iscsit_process_scsi_cmd+0x4c/0x130 [iscsi_target_mod] iscsit_get_rx_pdu+0x8e8/0x15f0 [iscsi_target_mod] iscsi_target_rx_thread+0x105/0x1b0 [iscsi_target_mod] kthread+0x1bc/0x210 ret_from_fork+0x24/0x30 Allocated by task 1079: save_stack+0x23/0x90 __kasan_kmalloc.constprop.0+0xcf/0xe0 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0xfe/0x3a0 transport_alloc_session+0x29/0x80 [target_core_mod] iscsi_target_login_thread+0xceb/0x1920 [iscsi_target_mod] kthread+0x1bc/0x210 ret_from_fork+0x24/0x30 Freed by task 17193: save_stack+0x23/0x90 __kasan_slab_free+0x13a/0x190 kasan_slab_free+0x12/0x20 kmem_cache_free+0xc8/0x3e0 transport_free_session+0x179/0x2f0 [target_core_mod] transport_deregister_session+0x121/0x170 [target_core_mod] iscsit_close_session+0x12c/0x350 [iscsi_target_mod] iscsit_logout_post_handler+0x136/0x380 [iscsi_target_mod] iscsit_response_queue+0x8fa/0xc00 [iscsi_target_mod] iscsi_target_tx_thread+0x28e/0x390 [iscsi_target_mod] kthread+0x1bc/0x210 ret_from_fork+0x24/0x30 The buggy address belongs to the object at ffff88802ecd1860 which belongs to the cache se_sess_cache of size 352 The buggy address is located 24 bytes inside of 352-byte region [ffff88802ecd1860, ffff88802ecd19c0) The buggy address belongs to the page: page:ffffea0000bb3400 refcount:1 mapcount:0 mapping:ffff8880bef2ed00 index:0x0 compound_mapcount: 0 flags: 0x1000000000010200(slab|head) raw: 1000000000010200 dead000000000100 dead000000000122 ffff8880bef2ed00 raw: 0000000000000000 0000000080270027 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88802ecd1700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802ecd1780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802ecd1800: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb ^ ffff88802ecd1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802ecd1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Cc: Mike Christie Link: https://lore.kernel.org/r/20191113220508.198257-2-bvanassche@acm.org Reviewed-by: Roman Bolshakov Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 11bf1d14b2d6fd4f144d8ee3ac2e71057fc0ec35 Author: Bart Van Assche Date: Thu Nov 7 13:54:58 2019 -0800 scsi: target: core: Document target_cmd_size_check() Since it is nontrivial to derive the meaning of the size argument from the code, add a documentation header above target_cmd_size_check(). Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Nicholas Bellinger Link: https://lore.kernel.org/r/20191107215458.64242-1-bvanassche@acm.org Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 29d28f2b8d3736ac61c28ef7e20fda63795b74d9 Author: Pan Bian Date: Wed Nov 6 20:32:21 2019 +0800 scsi: bnx2i: fix potential use after free The member hba->pcidev may be used after its reference is dropped. Move the put function to where it is never used to avoid potential use after free issues. Fixes: a77171806515 ("[SCSI] bnx2i: Removed the reference to the netdev->base_addr") Link: https://lore.kernel.org/r/1573043541-19126-1-git-send-email-bianpan2016@163.com Signed-off-by: Pan Bian Signed-off-by: Martin K. Petersen commit 5a993e507ee65a28eca6690ee11868555c4ca46b Author: Martin K. Petersen Date: Mon Nov 18 23:55:45 2019 -0500 Revert "scsi: qla2xxx: Fix memory leak when sending I/O fails" This reverts commit 2f856d4e8c23f5ad5221f8da4a2f22d090627f19. This patch was found to introduce a double free regression. The issue it originally attempted to address was fixed in patch f45bca8c5052 ("scsi: qla2xxx: Fix double scsi_done for abort path"). Link: https://lore.kernel.org/r/4BDE2B95-835F-43BE-A32C-2629D7E03E0A@marvell.com Requested-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 0b7a223552d455bcfba6fb9cfc5eef2b5fce1491 Author: Finn Thain Date: Sat Nov 16 14:36:57 2019 +1100 scsi: NCR5380: Add disconnect_mask module parameter Add a module parameter to inhibit disconnect/reselect for individual targets. This gains compatibility with Aztec PowerMonster SCSI/SATA adapters with buggy firmware. (No fix is available from the vendor.) Apparently these adapters pass-through the product/vendor of the attached SATA device. Since they can't be identified from the response to an INQUIRY command, a device blacklist flag won't work. Cc: Michael Schmitz Link: https://lore.kernel.org/r/993b17545990f31f9fa5a98202b51102a68e7594.1573875417.git.fthain@telegraphics.com.au Reviewed-and-tested-by: Michael Schmitz Signed-off-by: Finn Thain Signed-off-by: Martin K. Petersen commit d04fc41af247a2ce993155bce7995d857464a096 Author: Finn Thain Date: Sat Nov 16 14:36:57 2019 +1100 scsi: NCR5380: Unconditionally clear ICR after do_abort() When do_abort() succeeds, the target will go to BUS FREE phase and there will be no connected command. Therefore, that function should clear the Initiator Command Register before returning. It already does so in case of NCR5380_poll_politely() failure; do the same for the other error case too, that is, NCR5380_transfer_pio() failure. Cc: Michael Schmitz Cc: Ondrej Zary Link: https://lore.kernel.org/r/4277b28ee2551f884aefa85965ef3c498344f301.1573875417.git.fthain@telegraphics.com.au Reviewed-and-tested-by: Michael Schmitz Tested-by: Ondrej Zary Signed-off-by: Finn Thain Signed-off-by: Martin K. Petersen commit 350767f20be86ee58f862caddadcfa192b9b976d Author: Finn Thain Date: Sat Nov 16 14:36:57 2019 +1100 scsi: NCR5380: Call scsi_set_resid() on command completion Most NCR5380 drivers calculate the residual for every data transfer. (A few drivers just set it to zero.) Pass this quantity back to the scsi mid-layer on command completion. Cc: Michael Schmitz Cc: Ondrej Zary Link: https://lore.kernel.org/r/1f26ead9dd0dc053fcd27979d69a7ca74b6589b4.1573875417.git.fthain@telegraphics.com.au Reviewed-and-tested-by: Michael Schmitz Tested-by: Ondrej Zary Signed-off-by: Finn Thain Signed-off-by: Martin K. Petersen commit aa5334c4f3014940f11bf876e919c956abef4089 Author: Maurizio Lombardi Date: Fri Nov 15 17:37:27 2019 +0100 scsi: scsi_debug: num_tgts must be >= 0 Passing the parameter "num_tgts=-1" will start an infinite loop that exhausts the system memory Link: https://lore.kernel.org/r/20191115163727.24626-1-mlombard@redhat.com Signed-off-by: Maurizio Lombardi Acked-by: Douglas Gilbert Signed-off-by: Martin K. Petersen commit 4583a4f66b323c6e4d774be2649e83a4e7c7b78c Author: James Smart Date: Fri Nov 15 16:38:47 2019 -0800 scsi: lpfc: use hdwq assigned cpu for allocation Looking at the recent conversion from smp_processor_id() to raw_smp_processor_id(), realized that the allocation should be based on the cpu the hdwq is bound to, not the executing cpu. Revise to pull cpu number from the hdwq Fixes: 765ab6cdac3b ("scsi: lpfc: Fix a kernel warning triggered by lpfc_get_sgl_per_hdwq()") Link: https://lore.kernel.org/r/20191116003847.6141-1-jsmart2021@gmail.com Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 9b44ffab49e337982d4717cfa6799eceaf7359a3 Author: Colin Ian King Date: Thu Nov 14 18:00:07 2019 +0000 scsi: arcmsr: fix indentation issues There are a few statements that are indented incorrectly, fix these. Link: https://lore.kernel.org/r/20191114180007.325856-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit 3fe3d2428b62822b7b030577cd612790bdd8c941 Author: Pan Bian Date: Tue Nov 5 17:25:27 2019 +0800 scsi: qla4xxx: fix double free bug The variable init_fw_cb is released twice, resulting in a double free bug. The call to the function dma_free_coherent() before goto is removed to get rid of potential double free. Fixes: 2a49a78ed3c8 ("[SCSI] qla4xxx: added IPv6 support.") Link: https://lore.kernel.org/r/1572945927-27796-1-git-send-email-bianpan2016@163.com Signed-off-by: Pan Bian Acked-by: Manish Rangankar Signed-off-by: Martin K. Petersen commit 044f59de3a3de9c193cfc600c7a3045b24b3079f Author: Deepak Ukey Date: Thu Nov 14 15:39:10 2019 +0530 scsi: pm80xx: Modified the logic to collect fatal dump Added the correct method to collect the fatal dump. Link: https://lore.kernel.org/r/20191114100910.6153-14-deepak.ukey@microchip.com Reported-by: kbuild test robot Acked-by: Jack Wang Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit 7295493682aaa68e0826b61af4b88941363075ca Author: Vikram Auradkar Date: Thu Nov 14 15:39:09 2019 +0530 scsi: pm80xx: Tie the interrupt name to the module instance With MSI-x enabled, the interrupt instances are where the prefix is fixed for all module instances, making it a little harder to track down what's what. Link: https://lore.kernel.org/r/20191114100910.6153-13-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: Vikram Auradkar Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit e2773c67e24a6ae93355767eb236e0a22200993e Author: Deepak Ukey Date: Thu Nov 14 15:39:08 2019 +0530 scsi: pm80xx: Controller fatal error through sysfs Added support to check controller fatal error through sysfs. Link: https://lore.kernel.org/r/20191114100910.6153-12-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit 3e253d9657b06b20ab289caba81941c6249afd0b Author: peter chang Date: Thu Nov 14 15:39:07 2019 +0530 scsi: pm80xx: Do not request 12G sas speeds Occasionally, 6G capable drives fail to train at 6G on links that look good from a signal-integrity perspective. PMC suggests configuring the port to not even expect 12G. Link: https://lore.kernel.org/r/20191114100910.6153-11-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: peter chang Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit 51c1c5f6ed64c2b65a8cf89dac136273d25ca540 Author: peter chang Date: Thu Nov 14 15:39:06 2019 +0530 scsi: pm80xx: Cleanup command when a reset times out Added the fix so the if driver properly sent the abort it tries to remove it from the firmware's list of outstanding commands regardless of the abort status. This means that the task gets freed 'now' rather than possibly getting freed later when the scsi layer thinks it's leaked but still valid. Link: https://lore.kernel.org/r/20191114100910.6153-10-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: peter chang Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit 91a43fa61f102e045d9bac07a4b7739a4bbe623a Author: peter chang Date: Thu Nov 14 15:39:05 2019 +0530 scsi: pm80xx: Fix command issue sizing The commands to the controller are sent in fixed sized chunks which are set per-chip-generation and stashed in iomb_size. The driver fills in structs matching the register layout and memcpy this to memory shared with the controller. However, there are two problem cases: 1) Things like phy_start_req are too large because they share the sas_identify_frame definition with libsas, and it includes the crc word. This means that it's overwriting the start of the next command block, that's ok except if it happens at the end of the shared memory area. 2) Things like set_nvm_data_req which are shared between the HAL layers. This means that it's sending 'random' data for things that are in the reserved area. So far we haven't found a case where the controller FW cares, but sending possible gibberish (for most of the structures this is in the reserved area so previously zeroed) is not recommended. Link: https://lore.kernel.org/r/20191114100910.6153-9-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: peter chang Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit a88d9db94c4c9fb2b6ce9f5748928bef46aa9885 Author: Vikram Auradkar Date: Thu Nov 14 15:39:04 2019 +0530 scsi: pm80xx: Fix dereferencing dangling pointer sas_task structure should not be used after task_done is called. If the device is gone or not attached, we call task_done on t and continue to use in the sas_task in rest of the function. task_done is pointing to sas_ata_task_done, may free the memory associated with the task before returning. Link: https://lore.kernel.org/r/20191114100910.6153-8-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: Vikram Auradkar Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit e90e236250e9edd2584a3405d0b2482ef687a637 Author: ianyar Date: Thu Nov 14 15:39:03 2019 +0530 scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check The function mpi_uninit_check takes longer for inbound doorbell register to be cleared. Increased the timeout substantially so that the driver does not fail to load. Link: https://lore.kernel.org/r/20191114100910.6153-7-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: ianyar Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit 7370672dc3e7e4bf73cc2bb5ece8ad47fdb00e39 Author: peter chang Date: Thu Nov 14 15:39:02 2019 +0530 scsi: pm80xx: Squashed logging cleanup changes The default logging doesn't include the device name, so it's difficult to determine which controller is being logged about in error scenarios. The logging level was only settable via sysfs, which made it inconvenient for actual debugging. This changes the default to only cover error handling. Link: https://lore.kernel.org/r/20191114100910.6153-6-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: peter chang Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit 4daf1ef3c681754159411bd7ee0aecf2d43acf59 Author: Vikram Auradkar Date: Thu Nov 14 15:39:01 2019 +0530 scsi: pm80xx: Convert 'long' mdelay to msleep For delays longer than 20ms [um]delay isn't recommended. pm80xx_chip_soft_rst starts off with a 500ms delay before it even gets around to checking for the results of the reset. As long as it's at least 500ms it doesn't matter what the scheduler is doing. The delay in the pm8001_exec_internal_task_abort does nothing, and theory is this is a delay to avoid a double-free. Link: https://lore.kernel.org/r/20191114100910.6153-5-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: Vikram Auradkar Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit cef1538456ba1f965289c778c418460106d0c1c7 Author: John Sperbeck Date: Thu Nov 14 15:39:00 2019 +0530 scsi: pm80xx: Initialize variable used as return status In pm8001_task_exec(), if the PHY is down, then we return the current value of 'rc'. We need to make sure it's initialized. Link: https://lore.kernel.org/r/20191114100910.6153-4-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: John Sperbeck Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit e703977b505ff010c3e99c4793c353c5d5e28f84 Author: peter chang Date: Thu Nov 14 15:38:59 2019 +0530 scsi: pm80xx: Make phy enable completion as NULL After the completing the mpi_phy_start_resp, make phy enable completion as NULL. Link: https://lore.kernel.org/r/20191114100910.6153-3-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: peter chang Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit ce21c63ee995b7a8b7b81245f2cee521f8c3c220 Author: peter chang Date: Thu Nov 14 15:38:58 2019 +0530 scsi: pm80xx: Fix for SATA device discovery Driver was missing complete() call in mpi_sata_completion which result in SATA abort error handling timing out. That causes the device to be left in the in_recovery state so subsequent commands sent to the device fail and the OS removes access to it. Link: https://lore.kernel.org/r/20191114100910.6153-2-deepak.ukey@microchip.com Acked-by: Jack Wang Signed-off-by: peter chang Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen commit 6d303e4b19d694cdbebf76bcdb51ada664ee953d Author: Subhash Jadavani Date: Thu Nov 14 22:09:30 2019 -0800 scsi: ufs: Fix error handing during hibern8 enter During clock gating (ufshcd_gate_work()), we first put the link hibern8 by calling ufshcd_uic_hibern8_enter() and if ufshcd_uic_hibern8_enter() returns success (0) then we gate all the clocks. Now let’s zoom in to what ufshcd_uic_hibern8_enter() does internally: It calls __ufshcd_uic_hibern8_enter() and if failure is encountered, link recovery shall put the link back to the highest HS gear and returns success (0) to ufshcd_uic_hibern8_enter() which is the issue as link is still in active state due to recovery! Now ufshcd_uic_hibern8_enter() returns success to ufshcd_gate_work() and hence it goes ahead with gating the UFS clock while link is still in active state hence I believe controller would raise UIC error interrupts. But when we service the interrupt, clocks might have already been disabled! This change fixes for this by returning failure from __ufshcd_uic_hibern8_enter() if recovery succeeds as link is still not in hibern8, upon receiving the error ufshcd_hibern8_enter() would initiate retry to put the link state back into hibern8. Link: https://lore.kernel.org/r/1573798172-20534-8-git-send-email-cang@codeaurora.org Reviewed-by: Avri Altman Reviewed-by: Bean Huo Signed-off-by: Subhash Jadavani Signed-off-by: Can Guo Signed-off-by: Martin K. Petersen commit 18f01374b55b4595ad7f56250891bdbdb9d7a052 Author: Asutosh Das Date: Thu Nov 14 22:09:29 2019 -0800 scsi: ufs: Abort gating if clock on request is pending This change attempts to abort gating of clocks if a request to turn-on clocks is pending. This would in turn avoid turning OFF and back ON the clocks. Link: https://lore.kernel.org/r/1573798172-20534-7-git-send-email-cang@codeaurora.org Reviewed-by: Bean Huo Signed-off-by: Asutosh Das Signed-off-by: Can Guo Signed-off-by: Martin K. Petersen commit 9333d77573485c827b4c0fc960c840df3e5ce719 Author: Venkat Gopalakrishnan Date: Thu Nov 14 22:09:28 2019 -0800 scsi: ufs: Fix irq return code Return IRQ_HANDLED only if the irq is really handled, this will help in catching spurious interrupts that go unhandled. Link: https://lore.kernel.org/r/1573798172-20534-6-git-send-email-cang@codeaurora.org Reviewed-by: Avri Altman Signed-off-by: Venkat Gopalakrishnan Signed-off-by: Can Guo Signed-off-by: Martin K. Petersen commit b2e2f0e6a6f910c906c083584b6e0afd12266f22 Author: YueHaibing Date: Tue Nov 19 22:21:13 2019 +0800 bpf: Make array_map_mmap static Fix sparse warning: kernel/bpf/arraymap.c:481:5: warning: symbol 'array_map_mmap' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191119142113.15388-1-yuehaibing@huawei.com commit 24f65050276a4f82d5832e974dabfb5be5c07c39 Author: Andrii Nakryiko Date: Tue Nov 19 16:25:10 2019 -0800 selftests/bpf: Enforce no-ALU32 for test_progs-no_alu32 With the most recent Clang, alu32 is enabled by default if -mcpu=probe or -mcpu=v3 is specified. Use a separate build rule with -mcpu=v2 to enforce no ALU32 mode. Suggested-by: Yonghong Song Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20191120002510.4130605-1-andriin@fb.com commit 272630feb4c0d274cc4f018c5dcc24bc94f685c7 Author: Rahul Lakkireddy Date: Tue Nov 19 13:00:56 2019 +0530 cxgb4: remove unneeded semicolon for switch block Semicolon is not required at the end of switch block. So, remove it. Addresses coccinelle warning: drivers/net/ethernet/chelsio/cxgb4/sge.c:2260:2-3: Unneeded semicolon Fixes: 4846d5330daf ("cxgb4: add Tx and Rx path for ETHOFLD traffic") Reported-by: kbuild test robot Signed-off-by: Rahul Lakkireddy Signed-off-by: David S. Miller commit b8fc7177d8aef1cc9c83b98e29097861adc84b49 Author: Vladimir Oltean Date: Mon Nov 18 20:16:57 2019 +0200 net: dsa: felix: Fix CPU port assignment when not last port On the NXP LS1028A, there are 2 Ethernet links between the Felix switch and the ENETC: - eno2 <-> swp4, at 2.5G - eno3 <-> swp5, at 1G Only one of the above Ethernet port pairs can act as a DSA link for tagging. When adding initial support for the driver, it was tested only on the 1G eno3 <-> swp5 interface, due to the necessity of using PHYLIB initially (which treats fixed-link interfaces as emulated C22 PHYs, so it doesn't support fixed-link speeds higher than 1G). After making PHYLINK work, it appears that swp4 still can't act as CPU port. So it looks like ocelot_set_cpu_port was being called for swp4, but then it was called again for swp5, overwriting the CPU port assigned in the DT. It appears that when you call dsa_upstream_port for a port that is not defined in the device tree (such as swp5 when using swp4 as CPU port), its dp->cpu_dp pointer is not initialized by dsa_tree_setup_default_cpu, and this trips up the following condition in dsa_upstream_port: if (!cpu_dp) return port; So the moral of the story is: don't call dsa_upstream_port for a port that is not defined in the device tree, and therefore its dsa_port structure is not completely initialized (ds->num_ports is still 6). Fixes: 56051948773e ("net: dsa: ocelot: add driver for Felix switch family") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit a0d7da26ce86a25e97ae191cb90574ada6daea98 Author: Andrii Nakryiko Date: Tue Nov 19 14:44:47 2019 -0800 libbpf: Fix call relocation offset calculation bug When relocating subprogram call, libbpf doesn't take into account relo->text_off, which comes from symbol's value. This generally works fine for subprograms implemented as static functions, but breaks for global functions. Taking a simplified test_pkt_access.c as an example: __attribute__ ((noinline)) static int test_pkt_access_subprog1(volatile struct __sk_buff *skb) { return skb->len * 2; } __attribute__ ((noinline)) static int test_pkt_access_subprog2(int val, volatile struct __sk_buff *skb) { return skb->len + val; } SEC("classifier/test_pkt_access") int test_pkt_access(struct __sk_buff *skb) { if (test_pkt_access_subprog1(skb) != skb->len * 2) return TC_ACT_SHOT; if (test_pkt_access_subprog2(2, skb) != skb->len + 2) return TC_ACT_SHOT; return TC_ACT_UNSPEC; } When compiled, we get two relocations, pointing to '.text' symbol. .text has st_value set to 0 (it points to the beginning of .text section): 0000000000000008 000000050000000a R_BPF_64_32 0000000000000000 .text 0000000000000040 000000050000000a R_BPF_64_32 0000000000000000 .text test_pkt_access_subprog1 and test_pkt_access_subprog2 offsets (targets of two calls) are encoded within call instruction's imm32 part as -1 and 2, respectively: 0000000000000000 test_pkt_access_subprog1: 0: 61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0) 1: 64 00 00 00 01 00 00 00 w0 <<= 1 2: 95 00 00 00 00 00 00 00 exit 0000000000000018 test_pkt_access_subprog2: 3: 61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0) 4: 04 00 00 00 02 00 00 00 w0 += 2 5: 95 00 00 00 00 00 00 00 exit 0000000000000000 test_pkt_access: 0: bf 16 00 00 00 00 00 00 r6 = r1 ===> 1: 85 10 00 00 ff ff ff ff call -1 2: bc 01 00 00 00 00 00 00 w1 = w0 3: b4 00 00 00 02 00 00 00 w0 = 2 4: 61 62 00 00 00 00 00 00 r2 = *(u32 *)(r6 + 0) 5: 64 02 00 00 01 00 00 00 w2 <<= 1 6: 5e 21 08 00 00 00 00 00 if w1 != w2 goto +8 7: bf 61 00 00 00 00 00 00 r1 = r6 ===> 8: 85 10 00 00 02 00 00 00 call 2 9: bc 01 00 00 00 00 00 00 w1 = w0 10: 61 62 00 00 00 00 00 00 r2 = *(u32 *)(r6 + 0) 11: 04 02 00 00 02 00 00 00 w2 += 2 12: b4 00 00 00 ff ff ff ff w0 = -1 13: 1e 21 01 00 00 00 00 00 if w1 == w2 goto +1 14: b4 00 00 00 02 00 00 00 w0 = 2 0000000000000078 LBB0_3: 15: 95 00 00 00 00 00 00 00 exit Now, if we compile example with global functions, the setup changes. Relocations are now against specifically test_pkt_access_subprog1 and test_pkt_access_subprog2 symbols, with test_pkt_access_subprog2 pointing 24 bytes into its respective section (.text), i.e., 3 instructions in: 0000000000000008 000000070000000a R_BPF_64_32 0000000000000000 test_pkt_access_subprog1 0000000000000048 000000080000000a R_BPF_64_32 0000000000000018 test_pkt_access_subprog2 Calls instructions now encode offsets relative to function symbols and are both set ot -1: 0000000000000000 test_pkt_access_subprog1: 0: 61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0) 1: 64 00 00 00 01 00 00 00 w0 <<= 1 2: 95 00 00 00 00 00 00 00 exit 0000000000000018 test_pkt_access_subprog2: 3: 61 20 00 00 00 00 00 00 r0 = *(u32 *)(r2 + 0) 4: 0c 10 00 00 00 00 00 00 w0 += w1 5: 95 00 00 00 00 00 00 00 exit 0000000000000000 test_pkt_access: 0: bf 16 00 00 00 00 00 00 r6 = r1 ===> 1: 85 10 00 00 ff ff ff ff call -1 2: bc 01 00 00 00 00 00 00 w1 = w0 3: b4 00 00 00 02 00 00 00 w0 = 2 4: 61 62 00 00 00 00 00 00 r2 = *(u32 *)(r6 + 0) 5: 64 02 00 00 01 00 00 00 w2 <<= 1 6: 5e 21 09 00 00 00 00 00 if w1 != w2 goto +9 7: b4 01 00 00 02 00 00 00 w1 = 2 8: bf 62 00 00 00 00 00 00 r2 = r6 ===> 9: 85 10 00 00 ff ff ff ff call -1 10: bc 01 00 00 00 00 00 00 w1 = w0 11: 61 62 00 00 00 00 00 00 r2 = *(u32 *)(r6 + 0) 12: 04 02 00 00 02 00 00 00 w2 += 2 13: b4 00 00 00 ff ff ff ff w0 = -1 14: 1e 21 01 00 00 00 00 00 if w1 == w2 goto +1 15: b4 00 00 00 02 00 00 00 w0 = 2 0000000000000080 LBB2_3: 16: 95 00 00 00 00 00 00 00 exit Thus the right formula to calculate target call offset after relocation should take into account relocation's target symbol value (offset within section), call instruction's imm32 offset, and (subtracting, to get relative instruction offset) instruction index of call instruction itself. All that is shifted by number of instructions in main program, given all sub-programs are copied over after main program. Convert few selftests relying on bpf-to-bpf calls to use global functions instead of static ones. Fixes: 48cca7e44f9f ("libbpf: add support for bpf_call") Reported-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191119224447.3781271-1-andriin@fb.com commit 7c149057d044c52ed1e1d4ee50cf412c8d0f7295 Author: J. Bruce Fields Date: Tue Nov 19 16:05:33 2019 -0500 nfsd: restore NFSv3 ACL support An error in e333f3bbefe3 left the nfsd_acl_program->pg_vers array empty, which effectively turned off the server's support for NFSv3 ACLs. Fixes: e333f3bbefe3 "nfsd: Allow containers to set supported nfs versions" Cc: stable@vger.kernel.org Cc: Trond Myklebust Signed-off-by: J. Bruce Fields commit 677017d196ba2a4cfff13626b951cc9a206b8c7c Author: Sahitya Tummala Date: Wed Nov 13 16:01:03 2019 +0530 f2fs: Fix deadlock in f2fs_gc() context during atomic files handling The FS got stuck in the below stack when the storage is almost full/dirty condition (when FG_GC is being done). schedule_timeout io_schedule_timeout congestion_wait f2fs_drop_inmem_pages_all f2fs_gc f2fs_balance_fs __write_node_page f2fs_fsync_node_pages f2fs_do_sync_file f2fs_ioctl The root cause for this issue is there is a potential infinite loop in f2fs_drop_inmem_pages_all() for the case where gc_failure is true and when there an inode whose i_gc_failures[GC_FAILURE_ATOMIC] is not set. Fix this by keeping track of the total atomic files currently opened and using that to exit from this condition. Fix-suggested-by: Chao Yu Signed-off-by: Chao Yu Signed-off-by: Sahitya Tummala Signed-off-by: Jaegeuk Kim commit c45d6002ff7a322022560e9b19ad867b01fec77f Author: Chao Yu Date: Fri Nov 1 17:53:23 2019 +0800 f2fs: show f2fs instance in printk_ratelimited As Eric mentioned, bare printk{,_ratelimited} won't show which filesystem instance these message is coming from, this patch tries to show fs instance with sb->s_id field in all places we missed before. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 848a5e507e26176902e328bd8ae4a5e9c7d2bafe Author: Jin Yao Date: Mon Nov 18 22:08:49 2019 +0800 perf report: Jump to symbol source view from total cycles view This patch supports jumping from tui total cycles view to symbol source view. For example, perf record -b ./div perf report --total-cycles In total cycles view, we can select one entry and press 'a' or press ENTER key to jump to symbol source view. This patch also sets sort_order to NULL in cmd_report() which will use the default branch sort order. The percent value in new annotate view will be consistent with the percent in annotate view switched from perf report (we observed the original percent gap with previous patches). v2: --- Fix the 'make NO_SLANG=1' error. (set __maybe_unused to annotation_opts in block_hists_tui_browse()). Signed-off-by: Jin Yao Acked-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jin Yao Cc: Kan Liang Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20191118140849.20714-2-yao.jin@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 5cb456af99f58378fe90649d6faaab25e379be06 Author: Jin Yao Date: Mon Nov 18 22:08:48 2019 +0800 perf util: Move block TUI function to ui browsers It would be nice if we could jump to the assembler/source view (like the normal perf report) from total cycles view. This patch moves the block_hists_tui_browse from block-info.c to ui/browsers/hists.c in order to reuse some browser codes (i.e do_annotate) for implementing new annotation view. v2: --- Fix the 'make NO_SLANG=1' error. (Change 'int block_hists_tui_browse()' to 'static inline int block_hists_tui_browse()') Signed-off-by: Jin Yao Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jin Yao Cc: Kan Liang Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20191118140849.20714-1-yao.jin@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit bb1835a3b86c73aa534ef6430ad40223728dfbc0 Author: Alexey Budankov Date: Mon Nov 18 17:21:03 2019 +0300 perf session: Fix decompression of PERF_RECORD_COMPRESSED records Avoid termination of trace loading in case the last record in the decompressed buffer partly resides in the following mmaped PERF_RECORD_COMPRESSED record. In this case NULL value returned by fetch_mmaped_event() means to proceed to the next mmaped record then decompress it and load compressed events. The issue can be reproduced like this: $ perf record -z -- some_long_running_workload $ perf report --stdio -vv decomp (B): 44519 to 163000 decomp (B): 48119 to 174800 decomp (B): 65527 to 131072 fetch_mmaped_event: head=0x1ffe0 event->header_size=0x28, mmap_size=0x20000: fuzzed perf.data? Error: failed to process sample ... Testing: 71: Zstd perf.data compression/decompression : Ok $ tools/perf/perf report -vv --stdio decomp (B): 59593 to 262160 decomp (B): 4438 to 16512 decomp (B): 285 to 880 Looking at the vmlinux_path (8 entries long) Using vmlinux for symbols decomp (B): 57474 to 261248 prefetch_event: head=0x3fc78 event->header_size=0x28, mmap_size=0x3fc80: fuzzed or compressed perf.data? decomp (B): 25 to 32 decomp (B): 52 to 120 ... Fixes: 57fc032ad643 ("perf session: Avoid infinite loop when seeing invalid header.size") Link: https://marc.info/?l=linux-kernel&m=156580812427554&w=2 Co-developed-by: Jiri Olsa Acked-by: Jiri Olsa Signed-off-by: Alexey Budankov Cc: Alexander Shishkin Cc: Andi Kleen Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/cf782c34-f3f8-2f9f-d6ab-145cee0d5322@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 564f86d384755e3fbb5c00703d3695df89c1e049 Author: Rasmus Villemoes Date: Fri Oct 4 11:48:25 2019 +0200 clk: mark clk_disable_unused() as __init clk_disable_unused is only called once, as a late_initcall, so reclaim a bit of memory by marking it (and the functions and data it is the sole user of) as __init/__initdata. This moves ~1900 bytes from .text to .init.text for a imx_v6_v7_defconfig. Signed-off-by: Rasmus Villemoes Link: https://lkml.kernel.org/r/20191004094826.8320-1-linux@rasmusvillemoes.dk Reviewed-by: Geert Uytterhoeven Signed-off-by: Stephen Boyd commit 8247470772beb38822f226c99a2ed8c195f6b438 Author: Kishon Vijay Abraham I Date: Tue Oct 22 12:41:53 2019 +0530 clk: Fix memory leak in clk_unregister() Memory allocated in alloc_clk() for 'struct clk' and 'const char *con_id' while invoking clk_register() is never freed in clk_unregister(), resulting in kmemleak showing the following backtrace. backtrace: [<00000000546f5dd0>] kmem_cache_alloc+0x18c/0x270 [<0000000073a32862>] alloc_clk+0x30/0x70 [<0000000082942480>] __clk_register+0xc8/0x760 [<000000005c859fca>] devm_clk_register+0x54/0xb0 [<00000000868834a8>] 0xffff800008c60950 [<00000000d5a80534>] platform_drv_probe+0x50/0xa0 [<000000001b3889fc>] really_probe+0x108/0x348 [<00000000953fa60a>] driver_probe_device+0x58/0x100 [<0000000008acc17c>] device_driver_attach+0x6c/0x90 [<0000000022813df3>] __driver_attach+0x84/0xc8 [<00000000448d5443>] bus_for_each_dev+0x74/0xc8 [<00000000294aa93f>] driver_attach+0x20/0x28 [<00000000e5e52626>] bus_add_driver+0x148/0x1f0 [<000000001de21efc>] driver_register+0x60/0x110 [<00000000af07c068>] __platform_driver_register+0x40/0x48 [<0000000060fa80ee>] 0xffff800008c66020 Fix it here. Cc: Tomi Valkeinen Cc: Tero Kristo Signed-off-by: Kishon Vijay Abraham I Link: https://lkml.kernel.org/r/20191022071153.21118-1-kishon@ti.com Fixes: 1df4046a93e0 ("clk: Combine __clk_get() and __clk_create_clk()") Signed-off-by: Stephen Boyd commit 0e3149f86b99ddabde8c5029eea0a9267e34f1a0 Author: Arnaldo Carvalho de Melo Date: Tue Nov 19 18:44:22 2019 -0300 perf dso: Move dso_id from 'struct map' to 'struct dso' And take it into account when looking up DSOs when we have the dso_id fields obtained from somewhere, like from PERF_RECORD_MMAP2 records. Instances of struct map pointing to the same DSO pathname but with anything in dso_id different are in fact different DSOs, so better have different 'struct dso' instances to reflect that. At some point we may want to get copies of the contents of the different objects if we want to do correct annotation or other analysis. With this we get 'struct map' 24 bytes leaner: $ pahole -C map ~/bin/perf struct map { union { struct rb_node rb_node __attribute__((__aligned__(8))); /* 0 24 */ struct list_head node; /* 0 16 */ } __attribute__((__aligned__(8))); /* 0 24 */ u64 start; /* 24 8 */ u64 end; /* 32 8 */ _Bool erange_warned:1; /* 40: 0 1 */ _Bool priv:1; /* 40: 1 1 */ /* XXX 6 bits hole, try to pack */ /* XXX 3 bytes hole, try to pack */ u32 prot; /* 44 4 */ u64 pgoff; /* 48 8 */ u64 reloc; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ u64 (*map_ip)(struct map *, u64); /* 64 8 */ u64 (*unmap_ip)(struct map *, u64); /* 72 8 */ struct dso * dso; /* 80 8 */ refcount_t refcnt; /* 88 4 */ u32 flags; /* 92 4 */ /* size: 96, cachelines: 2, members: 13 */ /* sum members: 92, holes: 1, sum holes: 3 */ /* sum bitfield members: 2 bits, bit holes: 1, sum bit holes: 6 bits */ /* forced alignments: 1 */ /* last cacheline: 32 bytes */ } __attribute__((__aligned__(8))); $ Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-g4hxxmraplo7wfjmk384mfsb@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 3de88c9113f88c04abda339f1aa629397bf89e02 Author: Luigi Rizzo Date: Mon Nov 18 16:19:51 2019 -0800 net-af_xdp: Use correct number of channels from ethtool Drivers use different fields to report the number of channels, so take the maximum of all data channels (rx, tx, combined) when determining the size of the xsk map. The current code used only 'combined' which was set to 0 in some drivers e.g. mlx4. Tested: compiled and run xdpsock -q 3 -r -S on mlx4 Signed-off-by: Luigi Rizzo Signed-off-by: Alexei Starovoitov Reviewed-by: Jakub Kicinski Acked-by: Magnus Karlsson Link: https://lore.kernel.org/bpf/20191119001951.92930-1-lrizzo@google.com commit 922eea2ce5c799228d9ff1be9890e6873ce8fff6 Author: Jan Beulich Date: Mon Nov 11 15:32:59 2019 +0100 x86/xen/32: Simplify ring check in xen_iret_crit_fixup() This can be had with two instead of six insns, by just checking the high CS.RPL bit. Also adjust the comment - there would be no #GP in the mentioned cases, as there's no segment limit violation or alike. Instead there'd be #PF, but that one reports the target EIP of said branch, not the address of the branch insn itself. Signed-off-by: Jan Beulich Signed-off-by: Thomas Gleixner Reviewed-by: Juergen Gross Link: https://lkml.kernel.org/r/a5986837-01eb-7bf8-bf42-4d3084d6a1f5@suse.com commit 29b810f5a5ec127d3143770098e05981baa3eb77 Author: Jan Beulich Date: Mon Nov 11 15:32:12 2019 +0100 x86/xen/32: Make xen_iret_crit_fixup() independent of frame layout Now that SS:ESP always get saved by SAVE_ALL, this also needs to be accounted for in xen_iret_crit_fixup(). Otherwise the old_ax value gets interpreted as EFLAGS, and hence VM86 mode appears to be active all the time, leading to random "vm86_32: no user_vm86: BAD" log messages alongside processes randomly crashing. Since following the previous model (sitting after SAVE_ALL) would further complicate the code _and_ retain the dependency of xen_iret_crit_fixup() on frame manipulations done by entry_32.S, switch things around and do the adjustment ahead of SAVE_ALL. Fixes: 3c88c692c287 ("x86/stackframe/32: Provide consistent pt_regs") Signed-off-by: Jan Beulich Signed-off-by: Thomas Gleixner Reviewed-by: Juergen Gross Cc: Stable Team Link: https://lkml.kernel.org/r/32d8713d-25a7-84ab-b74b-aa3e88abce6b@suse.com commit 81ff2c37f9e5d77593928df0536d86443195fd64 Author: Jan Beulich Date: Mon Nov 18 16:21:12 2019 +0100 x86/stackframe/32: Repair 32-bit Xen PV Once again RPL checks have been introduced which don't account for a 32-bit kernel living in ring 1 when running in a PV Xen domain. The case in FIXUP_FRAME has been preventing boot. Adjust BUG_IF_WRONG_CR3 as well to guard against future uses of the macro on a code path reachable when running in PV mode under Xen; I have to admit that I stopped at a certain point trying to figure out whether there are present ones. Fixes: 3c88c692c287 ("x86/stackframe/32: Provide consistent pt_regs") Signed-off-by: Jan Beulich Signed-off-by: Thomas Gleixner Cc: Stable Team Link: https://lore.kernel.org/r/0fad341f-b7f5-f859-d55d-f0084ee7087e@suse.com commit 1f74b100c9d9406fa12b22675c6b2111e5f60e9c Author: Arnaldo Carvalho de Melo Date: Tue Nov 19 17:51:34 2019 -0300 perf dsos: Remove unused dsos__find() method Not used anywhere, nuke it. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-teqz0eqcw43mnt7i3me44esw@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d8c313d75abfbbfb4382f4f4cba409089110d42d Author: Krzysztof Kozlowski Date: Mon Oct 21 18:02:07 2019 +0200 dt-bindings: pwm: Convert Samsung PWM bindings to json-schema Convert Samsung PWM (S3C, S5P and Exynos SoCs) bindings to DT schema format using json-schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Signed-off-by: Rob Herring commit 89650a1e3b6f877517121b67063f53d20a233deb Author: Krzysztof Kozlowski Date: Mon Oct 21 18:02:06 2019 +0200 dt-bindings: pwm: Convert PWM bindings to json-schema Convert generic PWM controller bindings to DT schema format using json-schema. The consumer bindings are provided by dt-schema. Signed-off-by: Krzysztof Kozlowski Acked-by: Stephen Boyd Acked-by: Paul Walmsley Signed-off-by: Rob Herring commit 83ededdb72ca125ddb9a6270b966ef0c26b5cf5a Author: Leonard Crestez Date: Tue Nov 19 18:38:56 2019 +0200 docs: Add initial documentation for devfreq The devfreq subsystem has plenty of kernel-doc comments but they're not currently included in sphinx documentation. Add a minimal devfreq.rst file which mostly just includes kernel-doc comments from devfreq source. This also exposes a number of kernel-doc warnings on `make htmldocs` Signed-off-by: Leonard Crestez Link: https://lore.kernel.org/r/e32fa9de8a60060a6ee5fc42f163111034f9a550.1574181341.git.leonard.crestez@nxp.com Signed-off-by: Jonathan Corbet commit a25984f3baaa97079ce3e75c5a1d362155915a31 Author: Michal Kalderon Date: Mon Nov 18 17:06:45 2019 +0200 RDMA/qedr: Fix null-pointer dereference when calling rdma_user_mmap_get_offset When running against rdma-core that doesn't support doorbell recovery, the rdma_user_mmap_entry won't be allocated for doorbell recovery related mappings. We have a flag indicating whether rdma-core supports doorbell recovery or not which was used during initialization, however some cases didn't check that the rdma_user_mmap_entry exists before attempting to acquire it's offset. Fixes: 97f612509294 ("RDMA/qedr: Add doorbell overflow recovery support") Link: https://lore.kernel.org/r/20191118150645.26602-1-michal.kalderon@marvell.com Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: Jason Gunthorpe commit 291084904eb0d0e9dd15d7204b62bf809ea800ea Author: Linus Walleij Date: Mon Nov 18 23:30:19 2019 +0100 Documentation: Document how to get links with git am This adds Kees' clever apply hook to the kernel documentation so it can be easily references when needed. Cc: Kees Cook Link: https://lists.linuxfoundation.org/pipermail/ksummit-discuss/2019-July/006608.html Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20191118223019.81708-1-linus.walleij@linaro.org Signed-off-by: Jonathan Corbet commit 0acc637dacb6bf12a17c9ad0c41d9ff3696d8b05 Author: Danit Goldberg Date: Sun Nov 17 15:33:21 2019 +0200 RDMA/cm: Use refcount_t type for refcount variable This atomic in struct cm_id_private is being used as a refcount, change it to refcount_t for better clarity and to get the refcount protections. Link: https://lore.kernel.org/r/1573997601-4502-1-git-send-email-danitg@mellanox.com Signed-off-by: Danit Goldberg Reviewed-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit c16339b69c0d58f456154b43fc396b1f1c3dc055 Author: Mark Zhang Date: Fri Nov 15 17:45:55 2019 +0200 IB/mlx5: Support extended number of strides for Striding RQ Extends the minimum single WQE strides from 64 to 8, which is exposed by the "min_single_wqe_log_num_of_strides" field of striding_rq_caps. Choose right number of strides based on FW capability. Link: https://lore.kernel.org/r/20191115154555.247856-1-leon@kernel.org Signed-off-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 2c47c1be51fbded1f7baa2ceaed90f97932f79be Author: Bob Peterson Date: Tue Nov 19 11:40:46 2019 -0500 gfs2: clean up iopen glock mess in gfs2_create_inode Before this patch, gfs2_create_inode had a use-after-free for the iopen glock in some error paths because it did this: gfs2_glock_put(io_gl); fail_gunlock2: if (io_gl) clear_bit(GLF_INODE_CREATING, &io_gl->gl_flags); In some cases, the io_gl was used for create and only had one reference, so the glock might be freed before the clear_bit(). This patch tries to straighten it out by only jumping to the error paths where iopen is properly set, and moving the gfs2_glock_put after the clear_bit. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit ff3195b3ed85d0068fb9a80eaa2a1471a04df76a Author: Danit Goldberg Date: Fri Nov 15 17:44:57 2019 +0200 IB/mlx4: Update HW GID table while adding vlan GID When adding a new GID compare the vlan along with the GID and type. This allows vlan's to have GIDs that alias each other, such as the default GID. Otherwise they the GID cache view can become inconsistent with the HW view. Link: https://lore.kernel.org/r/20191115154457.247763-1-leon@kernel.org Signed-off-by: Danit Goldberg Reviewed-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 7b59a82493b49b715224bfe3b35fae52e48e5fa1 Author: Arnaldo Carvalho de Melo Date: Tue Nov 19 16:30:56 2019 -0300 perf map: Move comparision of map's dso_id to a separate function We'll use it when doing DSO lookups using dso_ids. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-u2nr1oq03o0i29w2ay9jx03s@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 3f1a9e630b6e124c387cc57f6fea517cec68b44f Author: Andreas Kemnade Date: Wed Nov 13 19:26:43 2019 +0100 regulator: rn5t618: fix rc5t619 ldo10 enable LDO9 and LDO10 were listed with the same enable bits. That looks insane and there are no provisions in the code for handling such a special case. Also other out-of-tree drivers use a separate bit to enable it. Example: https://github.com/brunotl/kernel-kobo-mx6sl-ntx/blob/master/drivers/regulator/ricoh619-regulator.c So it seems to be clearly a bug. I cannot fully check it on my board without schematics and just discovered this during code analysis for another problem. Signed-off-by: Andreas Kemnade Link: https://lore.kernel.org/r/20191113182643.23885-1-andreas@kemnade.info Signed-off-by: Mark Brown commit 0ced7b050224b18ca73e38e7068f36be8e708c06 Author: Kuninori Morimoto Date: Mon Nov 18 10:51:11 2019 +0900 ASoC: soc-pcm: remove soc_pcm_private_free() soc-topology adds extra dai_link by using snd_soc_add_dai_link(), and removes it by snd_soc_romove_dai_link(). This snd_soc_add/remove_dai_link() and/or its related functions are unbalanced before, and now, these are balance-uped. But, it finds the random operation issue, and it is reported by Pierre-Louis. When card was released, topology will call snd_soc_remove_dai_link() via (A). static void soc_cleanup_card_resources(struct snd_soc_card *card) { struct snd_soc_dai_link *link, *_link; /* This should be called before snd_card_free() */ (A) soc_remove_link_components(card); /* free the ALSA card at first; this syncs with pending operations */ if (card->snd_card) { (B) snd_card_free(card->snd_card); card->snd_card = NULL; } /* remove and free each DAI */ (X) soc_remove_link_dais(card); for_each_card_links_safe(card, link, _link) (C) snd_soc_remove_dai_link(card, link); ... } At (A), topology calls snd_soc_remove_dai_link(). Then topology rtd, and its related all data are freed. Next, (B) is called, and then, pcm->private_free = soc_pcm_private_free() is called. static void soc_pcm_private_free(struct snd_pcm *pcm) { struct snd_soc_pcm_runtime *rtd = pcm->private_data; /* need to sync the delayed work before releasing resources */ flush_delayed_work(&rtd->delayed_work); snd_soc_pcm_component_free(rtd); } Here, it gets rtd via pcm->private_data. But, topology related rtd are already freed at (A). Normal sound card has no damage, becase it frees rtd at (C). These are finalizing rtd related data. Thus, these should be called when rtd was freed, not sound card was freed. It is very natural and understandable. In other words, pcm->private_free = soc_pcm_private_free() is no longer needed. Extra issue is that there is zero chance to call soc_remove_dai() for topology related dai at (X). Because (A) removes rtd connection from card too, and, (X) is based on card connected rtd. This means, (X) need to be called before (C) (= for normal sound) and (A) (= for topology). Now, I want to focus this patch which is the reason why snd_card_free() = (B) is located there. commit 4efda5f2130da033aeedc5b3205569893b910de2 ("ASoC: Fix use-after-free at card unregistration") Original snd_card_free() was called last of this function. But moved to top to avoid use-after-free issue. The issue was happen at soc_pcm_free() which was pcm->private_free, today it is updated/renamed to soc_pcm_private_free(). In other words, (B) need to be called before (C) (= for normal sound) and (A) (= for topology), because it needs (not yet freed) rtd. But, (A) need to be called before (B), because it needs card->snd_card pointer. If we call flush_delayed_work() and snd_soc_pcm_component_free() (= same as soc_pcm_private_free()) when rtd was freed (= (C), (A)), there is no reason to call snd_card_free() at top of this function. It can be called end of this function, again. But, in such case, it will likely break unbind again, as Takashi-san reported. When unbind is performed in a busy state, the code may release still-in-use resources. At least we need to call snd_card_disconnect_sync() at the first place. The final code will be... static void soc_cleanup_card_resources(struct snd_soc_card *card) { struct snd_soc_dai_link *link, *_link; if (card->snd_card) (Z) snd_card_disconnect_sync(card->snd_card); (X) soc_remove_link_dais(card); (A) soc_remove_link_components(card); for_each_card_links_safe(card, link, _link) (C) snd_soc_remove_dai_link(card, link); ... if (card->snd_card) { (B) snd_card_free(card->snd_card); card->snd_card = NULL; } } To avoid release still-in-use resources, call snd_card_disconnect_sync() at (Z). (X) is needed for both non-topology and topology. topology removes rtd via (A), and non topology removes rtd via (C). snd_card_free() is no longer related to use-after-free issue. Thus, locating (B) is no problem. Fixes: df95a16d2a9626 ("ASoC: soc-core: fix RIP warning on card removal") Fixes: bc7a9091e5b927 ("ASoC: soc-core: add soc_unbind_dai_link()") Reported-by: Pierre-Louis Bossart Signed-off-by: Kuninori Morimoto Tested-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/87o8xax88g.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit b2b2afbb48eac7215f951a8a462aa6837e0d495f Author: Kuninori Morimoto Date: Mon Nov 18 10:50:32 2019 +0900 ASoC: soc-component: tidyup snd_soc_pcm_component_new/free() parameter This patch uses rtd instead of pcm at snd_soc_pcm_component_new/free() parameter. This is prepare for dai_link remove bug fix on topology. Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87pnhqx89j.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0bb887709eb16bdc4b5baddd8337abf3de72917f Author: Hans de Goede Date: Tue Nov 19 15:51:38 2019 +0100 ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 2-in-1 When the Acer Switch 10 SW5-012 quirk was added we did not have jack-detection support yet; and the builtin microphone selection of the original quirk is wrong too. Fix the microphone-input quirk and add jack-detection info so that the internal-microphone and headphone/set jack on the Switch 10 work properly. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191119145138.59162-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit 9a5d847c0bdadb67892b7d176a028578aaed0c3a Author: Wei Yongjun Date: Mon Nov 18 11:52:07 2019 -0700 coresight: replicator: Fix missing spin_lock_init() The driver allocates the spinlock but not initialize it. Use spin_lock_init() on it to initialize it correctly. This is detected by Coccinelle semantic patch. Signed-off-by: Wei Yongjun Tested-by: Yabin Cui Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20191118185207.30441-3-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 9def5dc10d3e21cf7673731be21224b6cc0eb16a Author: Wei Yongjun Date: Mon Nov 18 11:52:06 2019 -0700 coresight: funnel: Fix missing spin_lock_init() The driver allocates the spinlock but not initialize it. Use spin_lock_init() on it to initialize it correctly. This is detected by Coccinelle semantic patch. Signed-off-by: Wei Yongjun Tested-by: Yabin Cui Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20191118185207.30441-2-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 4a7380a52ec90fbb1565dd638ee7f5b6e709f7fb Author: Arnaldo Carvalho de Melo Date: Tue Nov 19 12:40:29 2019 -0300 perf map: Pass a dso_id to map__new() Instead of the 4 fields, a step in the direction of moving this to struct dso. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-gp5s1xgxacurmih5d1l94ymy@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 99459a84d5870a88274b4f10bc85c3e39e1d642c Author: Arnaldo Carvalho de Melo Date: Tue Nov 19 12:26:19 2019 -0300 perf map: Move maj/min/ino/ino_generation to separate struct And this patch highlights where these fields are being used: in the sort order where it uses it to compare maps and classify samples taking into account not just the DSO, but those DSO id fields. I think these should be used to differentiate DSOs with the same name but different 'struct dso_id' fields, i.e. these fields should move to 'struct dso' and then be used as part of the key when doing lookups for DSOs, in addition to the DSO name. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-8v5isitqy0dup47nnwkpc80f@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit bcba0c45471269d98cdbf53830694acf5a9792fc Author: Dan Williams Date: Sun Nov 17 09:45:45 2019 -0800 libnvdimm: Export the target_node attribute for regions and namespaces Aneesh points out that some platforms may have "local" attached persistent memory and "remote" persistent memory that map to the same "online" node, or persistent memory devices with different performance properties. In this case 'numa_node' is identical for the two instances, but 'target_node' is differentiated so platform firmware can communicate distinct performance properties per range. Expose 'target_node' by default to allow for disambiguation of devices that share the same numa_map_to_online_node() result. Reported-by: "Aneesh Kumar K.V" Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157401274500.43284.2369509941678577768.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit cb4dd729ee6ccc67ad604b1750990eb8c18783fa Author: Dan Williams Date: Tue Nov 12 17:13:31 2019 -0800 dax: Add numa_node to the default device-dax attributes It is confusing that device-dax instances publish a 'target_node' attribute, but not a 'numa_node'. The 'numa_node' information is available elsewhere in the sysfs device hierarchy, but it is not obvious and not reliable from one device-dax instance-type (e.g. child devices of nvdimm namespaces) to the next (e.g. 'hmem' devices defined by EFI Specific Purpose Memory and the ACPI HMAT). Cc: Ira Weiny Cc: Vishal Verma Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309906102.1582359.4262088001244476001.stgit@dwillia2-desk3.amr.corp.intel.com commit bfd2e9140656a061138ecdc6a5485d5e2a7a3333 Author: Dan Williams Date: Tue Nov 12 17:13:14 2019 -0800 libnvdimm: Simplify root read-only definition for the 'resource' attribute Rather than update the permission in ->is_visible() set the permission directly at declaration time. Cc: Ira Weiny Cc: Vishal Verma Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309905534.1582359.13927459228885931097.stgit@dwillia2-desk3.amr.corp.intel.com commit 153dd28647d63086dc6e1df5ee06fd0a5d6435a5 Author: Dan Williams Date: Tue Nov 12 17:12:38 2019 -0800 dax: Simplify root read-only definition for the 'resource' attribute Rather than update the permission in ->is_visible() set the permission directly at declaration time. Cc: Ira Weiny Cc: Vishal Verma Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309904959.1582359.7281180042781955506.stgit@dwillia2-desk3.amr.corp.intel.com commit 770619a95106340230a72a725c958c037284ec1f Author: Dan Williams Date: Tue Nov 12 17:12:23 2019 -0800 dax: Create a dax device_type Move the open coded release method and attribute groups to a 'struct device_type' instance. Cc: Ira Weiny Cc: Vishal Verma Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309904365.1582359.5451327195246651379.stgit@dwillia2-desk3.amr.corp.intel.com commit e755799aefa9385469bec49b2c2ccf1aaa33829a Author: Dan Williams Date: Tue Nov 12 17:08:56 2019 -0800 libnvdimm: Move nvdimm_bus_attribute_group to device_type A 'struct device_type' instance can carry default attributes for the device. Use this facility to remove the export of nvdimm_bus_attribute_group and put the responsibility on the core rather than leaf implementations to define this attribute. Cc: Ira Weiny Cc: Michael Ellerman Cc: "Oliver O'Halloran" Cc: Vishal Verma Cc: Aneesh Kumar K.V Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309903815.1582359.6418211876315050283.stgit@dwillia2-desk3.amr.corp.intel.com commit 360eba7ebdf716194ed2ede1ebc3ce0f9790a91c Author: Dan Williams Date: Tue Nov 12 17:08:04 2019 -0800 libnvdimm: Move nvdimm_attribute_group to device_type A 'struct device_type' instance can carry default attributes for the device. Use this facility to remove the export of nvdimm_attribute_group and put the responsibility on the core rather than leaf implementations to define this attribute. Cc: Ira Weiny Cc: Michael Ellerman Cc: "Oliver O'Halloran" Cc: Vishal Verma Cc: Aneesh Kumar K.V Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309903201.1582359.10966209746585062329.stgit@dwillia2-desk3.amr.corp.intel.com commit 4ce79fa97e6a54ee028063381346dc2fea91a76b Author: Dan Williams Date: Tue Nov 12 17:07:39 2019 -0800 libnvdimm: Move nd_mapping_attribute_group to device_type A 'struct device_type' instance can carry default attributes for the device. Use this facility to remove the export of nd_mapping_attribute_group and put the responsibility on the core rather than leaf implementations to define this attribute. Cc: Ira Weiny Cc: Michael Ellerman Cc: "Oliver O'Halloran" Cc: Vishal Verma Cc: Aneesh Kumar K.V Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309902686.1582359.6749533709859492704.stgit@dwillia2-desk3.amr.corp.intel.com commit 7c4fc8cde1641e3213eb1dafc6854331e9e0828c Author: Dan Williams Date: Tue Nov 12 17:07:16 2019 -0800 libnvdimm: Move nd_region_attribute_group to device_type A 'struct device_type' instance can carry default attributes for the device. Use this facility to remove the export of nd_region_attribute_group and put the responsibility on the core rather than leaf implementations to define this attribute. Cc: Ira Weiny Cc: Michael Ellerman Cc: "Oliver O'Halloran" Cc: Vishal Verma Cc: Aneesh Kumar K.V Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309902169.1582359.16828508538444551337.stgit@dwillia2-desk3.amr.corp.intel.com commit e2f6a0e34870ff1bdb1411e250dd2f03908cfa9f Author: Dan Williams Date: Tue Nov 19 09:51:54 2019 -0800 libnvdimm: Move nd_numa_attribute_group to device_type A 'struct device_type' instance can carry default attributes for the device. Use this facility to remove the export of nd_numa_attribute_group and put the responsibility on the core rather than leaf implementations to define this attribute. Cc: Ira Weiny Cc: Michael Ellerman Cc: "Oliver O'Halloran" Cc: Vishal Verma Cc: Aneesh Kumar K.V Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157401269537.43284.14411189404186877352.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit dfdeeb41fb08fbe11d3cfefba9c0fcd00c95a36d Merge: 3c845acd0237 c7df4a1ecb85 Author: Theodore Ts'o Date: Tue Nov 19 12:25:42 2019 -0500 Merge branch 'tt/misc' into dev commit c7df4a1ecb8579838ec8c56b2bb6a6716e974f37 Author: Theodore Ts'o Date: Mon Nov 11 22:18:13 2019 -0500 ext4: work around deleting a file with i_nlink == 0 safely If the file system is corrupted such that a file's i_links_count is too small, then it's possible that when unlinking that file, i_nlink will already be zero. Previously we were working around this kind of corruption by forcing i_nlink to one; but we were doing this before trying to delete the directory entry --- and if the file system is corrupted enough that ext4_delete_entry() fails, then we exit with i_nlink elevated, and this causes the orphan inode list handling to be FUBAR'ed, such that when we unmount the file system, the orphan inode list can get corrupted. A better way to fix this is to simply skip trying to call drop_nlink() if i_nlink is already zero, thus moving the check to the place where it makes the most sense. https://bugzilla.kernel.org/show_bug.cgi?id=205433 Link: https://lore.kernel.org/r/20191112032903.8828-1-tytso@mit.edu Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Reviewed-by: Andreas Dilger commit 4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a Author: Theodore Ts'o Date: Thu Nov 7 21:43:41 2019 -0500 ext4: add more paranoia checking in ext4_expand_extra_isize handling It's possible to specify a non-zero s_want_extra_isize via debugging option, and this can cause bad things(tm) to happen when using a file system with an inode size of 128 bytes. Add better checking when the file system is mounted, as well as when we are actually doing the trying to do the inode expansion. Link: https://lore.kernel.org/r/20191110121510.GH23325@mit.edu Reported-by: syzbot+f8d6f8386ceacdbfff57@syzkaller.appspotmail.com Reported-by: syzbot+33d7ea72e47de3bdf4e1@syzkaller.appspotmail.com Reported-by: syzbot+44b6763edfc17144296f@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 119a3cb6d687259f2be333351c1c5d634204e68b Author: Daniel Campello Date: Wed Nov 6 09:33:19 2019 -0700 platform/chrome: wilco_ec: Add keyboard backlight LED support The EC is in charge of controlling the keyboard backlight on the Wilco platform. We expose a standard LED class device named platform::kbd_backlight. Since the EC will never change the backlight level of its own accord, we don't need to implement a brightness_get() method. Signed-off-by: Nick Crews Signed-off-by: Daniel Campello Reviewed-by: Daniel Campello Signed-off-by: Enric Balletbo i Serra commit 3c4d77b68928df6c2bf07f4c3ba8e5d5e490bf4e Author: Nick Crews Date: Thu Oct 24 16:28:05 2019 -0600 platform/chrome: wilco_ec: Add charging config driver Add a device to control the charging algorithm used on Wilco devices, which will be picked up by the drivers/power/supply/wilco-charger.c driver. See Documentation/ABI/testing/sysfs-class-power-wilco for the userspace interface and other info. Signed-off-by: Nick Crews Signed-off-by: Enric Balletbo i Serra commit 7a7ebfa85f4fac349f3ab219538c44efe18b0cf6 Author: Mika Westerberg Date: Mon Nov 11 13:25:44 2019 +0300 thunderbolt: Power cycle the router if NVM authentication fails On zang's Dell XPS 13 9370 after Thunderbolt NVM firmware upgrade the Thunderbolt controller did not come back as expected. Only after the system was rebooted it became available again. It is not entirely clear what happened but I suspect the new NVM firmware image authentication failed for some reason. Regardless of this the router needs to be power cycled if NVM authentication fails in order to get it fully functional again. This modifies the driver to issue a power cycle in case the NVM authentication fails immediately when dma_port_flash_update_auth() returns. We also need to call tb_switch_set_uuid() earlier to be able to fetch possible NVM authentication failure when DMA port is added. Link: https://bugzilla.kernel.org/show_bug.cgi?id=205457 Reported-by: zang Cc: stable Signed-off-by: Mika Westerberg Signed-off-by: Greg Kroah-Hartman commit 545886fead7abfdbeb46d3ac62256e1db72739a3 Author: Chengguang Xu Date: Sat Nov 16 06:49:00 2019 +0800 ext2: code cleanup for descriptor_loc() Code cleanup by removing unnecessary variable in descriptor_loc(). Link: https://lore.kernel.org/r/20191115224900.2613-1-cgxu519@mykernel.net Signed-off-by: Chengguang Xu Signed-off-by: Jan Kara commit dabad1ff856116a14773aa81aa5de0591d6875e9 Author: Qianggui Song Date: Fri Nov 15 20:03:48 2019 +0800 pinctrl: meson: add pinctrl driver support for Meson-A1 SoC Meson A1 SoC share the same register layout of pinmux with previous Meson-G12A, however there is difference for gpio and pin config register in A1. The main difference is that registers before A1 are grouped by function while those of A1 are by bank. The new register layout is as below: /* first bank */ /* addr */ - P_PADCTRL_GPIOP_I base + 0x00 << 2 - P_PADCTRL_GPIOP_O base + 0x01 << 2 - P_PADCTRL_GPIOP_OEN base + 0x02 << 2 - P_PADCTRL_GPIOP_PULL_EN base + 0x03 << 2 - P_PADCTRL_GPIOP_PULL_UP base + 0x04 << 2 - P_PADCTRL_GPIOP_DS base + 0x05 << 2 /* second bank */ - P_PADCTRL_GPIOB_I base + 0x10 << 2 - P_PADCTRL_GPIOB_O base + 0x11 << 2 - P_PADCTRL_GPIOB_OEN base + 0x12 << 2 - P_PADCTRL_GPIOB_PULL_EN base + 0x13 << 2 - P_PADCTRL_GPIOB_PULL_UP base + 0x14 << 2 - P_PADCTRL_GPIOB_DS base + 0x15 << 2 Each bank contains at least 6 registers to be configured, if one bank has more than 16 gpios, an extra P_PADCTRL_GPIO[X]_DS_EXT is included. Between two adjacent P_PADCTRL_GPIO[X]_I, there is an offset 0x10, that is to say, for third bank, the offsets will be 0x20,0x21,0x22,0x23,0x24 ,0x25 according to above register layout. For previous chips, registers are grouped according to their functions while registers of A1 are according to bank.Also note that there is no AO bank any more in A1. Current Meson pinctrl driver can cover such change by using base address of GPIO as that of drive-strength. While simply giving reg_ds = reg_pullen make wrong value to reg_ds for Socs that do not support drive-strength like AXG.To make things simple, add an extra dt parser function for a1 and remain the old dt parser function for only reg parsing. Signed-off-by: Qianggui Song Link: https://lore.kernel.org/r/1573819429-6937-3-git-send-email-qianggui.song@amlogic.com Reviewed-by: Neil Armstrong Signed-off-by: Linus Walleij commit fd422964071f94783ef10366749c7810ae304488 Author: Qianggui Song Date: Fri Nov 15 20:03:47 2019 +0800 pinctrl: meson: add a new callback for SoCs fixup In meson_pinctrl_parse_dt, it contains two parts: reg parsing and SoC relative fixup for AO. Several fixups in the same code make it hard to maintain, so move all fixups to each SoC's callback and make meson_pinctrl_parse_dt just do the reg parsing, separate these two parts.Overview of all current Meson SoCs fixup is as below: +------+--------------------------------------+--------------------------+ | | | | | SoC | EE domain | AO domain | +------+--------------------------------------+--------------------------+ |m8 | parse regs: | parse regs: | |m8b | gpio,mux,pull,pull-enable(skip ds) | gpio,mux,pull(skip ds)| |gxl | fixup: | fixup: | |gxbb | no | pull-enable = pull; | |axg | | | +------+--------------------------------------+--------------------------+ |g12a | parse regs: | parse regs: | |sm1 | gpio,mux,pull,pull-enable,ds | gpio,mux,ds | | | fixup: | fixup: | | | no | pull = gpio; | | | | pull-enable = gpio; | +------+--------------------------------------+--------------------------+ |a1 or | parse regs: | |later | gpio/mux (without ao domain) | |SoCs | fixup: | | | pull = gpio; pull-enable = gpio; ds = gpio; | +------+-----------------------------------------------------------------+ Since m8-axg share the same ao fixup, make a common function meson8_aobus_parse_dt_extra to do the job. Signed-off-by: Qianggui Song Link: https://lore.kernel.org/r/1573819429-6937-2-git-send-email-qianggui.song@amlogic.com Reviewed-by: Neil Armstrong Signed-off-by: Linus Walleij commit 58afa801ef22bdc47ed4a1f1d4d9e52ca25777e7 Author: Stephan Gerhold Date: Sun Nov 17 21:54:39 2019 +0100 pinctrl: nomadik: db8500: Add mc0_a_2 pin group without direction control Some devices do not make use of the CMD0/DAT0/DAT2 direction control pins of the MMC/SD card 0 interface. In this case we should leave those pins unconfigured. A similar case already exists for "mc1_a_1" vs "mc1_a_2" when the MC1_FBCLK pin is not used. Add a new "mc0_a_2" pin group which is equal to "mc0_a_1" except with the MC0_CMDDIR, MC0_DAT0DIR and MC0_DAT2DIR pins removed. Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20191117205439.239211-1-stephan@gerhold.net Signed-off-by: Linus Walleij commit a20db58f3e6e6770362614c488e5426f972de97e Author: Mika Westerberg Date: Tue Nov 19 15:58:37 2019 +0300 regmap: regmap-w1: Drop unreachable code Both init functions have a stray "return NULL" at the end which is never reached so drop them. Signed-off-by: Mika Westerberg Link: https://lore.kernel.org/r/20191119125837.47619-1-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit 8f6ee51d772d0dab407d868449d2c5d9c8d2b6fc Merge: b0aeb45bad84 a910e4666d61 Author: Ingo Molnar Date: Tue Nov 19 12:59:03 2019 +0100 Merge tag 'perf-core-for-mingo-5.5-20191119' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: x86/insn: Adrian Hunter: - Add some more Intel instructions to the opcode map: cldemote, encls, enclu, enclv, enqcmd, enqcmds, movdir64b, movdiri, pconfig, tpause, umonitor, umwait, wbnoinvd. - The instruction decoding can be tested using the perf tools' "x86 instruction decoder - new instructions" test as folllows: $ perf test -v "new " 2>&1 | grep -i cldemote Decoded ok: 0f 1c 00 cldemote (%eax) Decoded ok: 0f 1c 05 78 56 34 12 cldemote 0x12345678 Decoded ok: 0f 1c 84 c8 78 56 34 12 cldemote 0x12345678(%eax,%ecx,8) Decoded ok: 0f 1c 00 cldemote (%rax) Decoded ok: 41 0f 1c 00 cldemote (%r8) Decoded ok: 0f 1c 04 25 78 56 34 12 cldemote 0x12345678 Decoded ok: 0f 1c 84 c8 78 56 34 12 cldemote 0x12345678(%rax,%rcx,8) Decoded ok: 41 0f 1c 84 c8 78 56 34 12 cldemote 0x12345678(%r8,%rcx,8) $ perf test -v "new " 2>&1 | grep -i tpause Decoded ok: 66 0f ae f3 tpause %ebx Decoded ok: 66 0f ae f3 tpause %ebx Decoded ok: 66 41 0f ae f0 tpause %r8d callchains: Adrian Hunter: - Fix segfault in thread__resolve_callchain_sample(). perf probe: - Line fixes to show only lines where probes can be used with 'perf probe -L', and when reporting them via 'perf probe -l'. - Support multiprobe events. perf scripts python: Adrian Hunter: - Fix use of TRUE with SQLite < 3.23 in exported-sql-viewer.py. perf maps: - Trim 'struct map' by removing the rb_node member for sorting by map name, as that is only needed for processing kernel maps, and only when classifying symbols by section at load time. Sort them by name using qsort() and do lookups using bsearch() when map_groups__find_by_name() is used. perf parse: Ian Rogers: - Report initial event parsing error, providing a less cryptic message to state that a PMU wasn't found in the system. perf vendor events: James Clark: - Fix commas so that PMU event files for arm64, power8 and power nine become valid JSON. libtraceevent: Konstantin Khlebnikov: - Fix parsing of event %o and %X argument types. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 5398e94fb753d022301825ebfa5f7cf8a660d8eb Author: Nikhil Mahale Date: Tue Nov 19 14:17:10 2019 +0530 ALSA: hda - Add DP-MST support for NVIDIA codecs This patch adds DP-MST support for GK104+ NVIDIA codecs. GK104+ NVIDIA codecs support DP-MST audio. These codecs have 4 output converters and 4 pin widgets, with 4 device entries per pin widget for a total of 16 device entries. This patch moves the existing patch_nvhdmi() definition to patch_nvhdmi_legacy(), used by pre-GK104 NVIDIA codecs. Redefine patch_nvhdmi() to enable DP-MST support by setting codec->dp_mst and spec->dyn_pcm_assign. Introduce fresh logic for dynamic pcm assignment, making sure that new pcm assignments are compatible with the legacy static per_pin-pmc assignment that existed in the days before DP-MST. Signed-off-by: Nikhil Mahale Reviewed-by: Aaron Plattner Link: https://lore.kernel.org/r/20191119084710.29267-5-nmahale@nvidia.com Signed-off-by: Takashi Iwai commit 9c32fea836928d7a25a83b337f268e533cfc5c3d Author: Nikhil Mahale Date: Tue Nov 19 14:17:09 2019 +0530 ALSA: hda - Add DP-MST support for non-acomp codecs This patch make it possible for non-acomp codecs to set dyn_pcm_assign/dp_mst and get DP-MST audio support. Document change notification HDA040-A for the Intel High Definition Audio 1.0a specification introduces a Device Select verb for Digital Display Pin Widgets that are multi-stream capable. This verb selects a Device Entry that is used by subsequent Pin Widget verbs. Once the Device Entry is selected, all subsequent Pin Widget verbs controlling the sink device will be directed to the selected Device Entry until the Device Select verb is updated with a new value. These Pin Widget verbs include: * Connection Select * Get Connection List Entry * Amplifier Gain/Mute * Power State * Pin Widget Control * ELD Data * DIP-Size * DIP-Index * DIP-Data * DIP-XmitCtrl * Content Protection Control * ASP Channel Mapping This patch adds calls to snd_hda_set_dev_select() to direct each of these Pin Widget control verbs to the correct Device Entry. snd_hda_get_connections() does not return per-device connection list, therefore make use snd_hda_get_raw_connections() instead of snd_hda_get_connections(). Signed-off-by: Nikhil Mahale Reviewed-by: Aaron Plattner Link: https://lore.kernel.org/r/20191119084710.29267-4-nmahale@nvidia.com Signed-off-by: Takashi Iwai commit 5204a05d70d9354e6dd27219275c4b6725443dc4 Author: Nikhil Mahale Date: Tue Nov 19 14:17:08 2019 +0530 ALSA: hda - Add DP-MST jack support This patch adds DP-MST jack support which will be used on NVIDIA platforms. Today, DP-MST audio is supported only if the codec has acomp support. This patch makes it possible to add DP-MST support for non-acomp codecs. For the codecs supporting DP-MST audio, each pin can contain several device entries. Each device entry is a virtual pin, described by pin_nid and dev_id in struct hdmi_spec_per_pin. For monitor hotplug event handling, non-acomp codecs enable and register jack-detection for every hdmi_spec_per_pin. This patch updates every relevant function in hda_jack.h and its implementation in hda_jack.c, to consider dev_id along with pin_nid. Changes to the HD Audio specification to support DP-MST audio are described in the Intel Document Change Notification (DCN) number HDA040-A. From HDA040-A, "For the case of multi stream capable Digital Display Pin Widget, [the Get Pin Sense verb] can be used to read a specific Device Entry state as reported in Get Device List Entry verb." This patch updates the read_pin_sense() function to take the dev_id as an argument and pass it as a parameter to the Get Pin Sense verb. Bits 15 through 20 from the Unsolicited Response for intrinsic events contain the index of the Device Entry that generated the event. This patch updates the Unsolicited Response event handlers to extract the device entry index from the response and pass it to snd_hda_jack_tbl_get_from_tag(). This patch updates snd_hda_jack_tbl_new() to take a dev_id argument and store it in the jack structure, and to make sure not to generate a different tag when called more than once for the same nid. Signed-off-by: Nikhil Mahale Link: https://lore.kernel.org/r/20191119084710.29267-3-nmahale@nvidia.com Signed-off-by: Takashi Iwai commit 80b917a8dd8f62ca00178d5a74d05d7471f21b47 Author: Nikhil Mahale Date: Tue Nov 19 14:17:07 2019 +0530 ALSA: hda - Rename snd_hda_pin_sense to snd_hda_jack_pin_sense s/snd_hda_pin_sense/snd_hda_jack_pin_sense/g This aligns the snd_hda_pin_sense function name with the names of other functions in hda_jack.h. Signed-off-by: Nikhil Mahale Reviewed-by: Aaron Plattner Link: https://lore.kernel.org/r/20191119084710.29267-2-nmahale@nvidia.com Signed-off-by: Takashi Iwai commit cbda56d5fefcebc01448982a55836c88a825b34c Author: Rafael J. Wysocki Date: Mon Nov 18 12:11:24 2019 +0100 cpuidle: Introduce cpuidle_driver_state_disabled() for driver quirks Commit 99e98d3fb100 ("cpuidle: Consolidate disabled state checks") overlooked the fact that the imx6q and tegra20 cpuidle drivers use the "disabled" field in struct cpuidle_state for quirks which trigger after the initialization of cpuidle, so reading the initial value of that field is not sufficient for those drivers. In order to allow them to implement the quirks without using the "disabled" field in struct cpuidle_state, introduce a new helper function and modify them to use it. Fixes: 99e98d3fb100 ("cpuidle: Consolidate disabled state checks") Reported-by: Len Brown Signed-off-by: Rafael J. Wysocki commit a7583e72a5f22470d3e6fd3b6ba912892242339f Author: Yunfeng Ye Date: Thu Nov 14 15:16:24 2019 +0800 ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100 The commit 0f27cff8597d ("ACPI: sysfs: Make ACPI GPE mask kernel parameter cover all GPEs") says: "Use a bitmap of size 0xFF instead of a u64 for the GPE mask so 256 GPEs can be masked" But the masking of GPE 0xFF it not supported and the check condition "gpe > ACPI_MASKABLE_GPE_MAX" is not valid because the type of gpe is u8. So modify the macro ACPI_MASKABLE_GPE_MAX to 0x100, and drop the "gpe > ACPI_MASKABLE_GPE_MAX" check. In addition, update the docs "Format" for acpi_mask_gpe parameter. Fixes: 0f27cff8597d ("ACPI: sysfs: Make ACPI GPE mask kernel parameter cover all GPEs") Signed-off-by: Yunfeng Ye [ rjw: Use u16 as gpe data type in acpi_gpe_apply_masked_gpes() ] Signed-off-by: Rafael J. Wysocki commit 6b7c095a51e1bad8b27fa1bc8753af0b613464a3 Author: Christophe Leroy Date: Mon Sep 16 20:25:41 2019 +0000 powerpc/83xx: map IMMR with a BAT. On mpc83xx with a QE, IMMR is 2Mbytes and aligned on 2Mbytes boundarie. On mpc83xx without a QE, IMMR is 1Mbyte and 1Mbyte aligned. Each driver will map a part of it to access the registers it needs. Some drivers will map the same part of IMMR as other drivers. In order to reduce TLB misses, map the full IMMR with a BAT. If it is 2Mbytes aligned, map 2Mbytes. If there is no QE, the upper part will remain unused, but it doesn't harm as it is mapped as guarded memory. When the IMMR is not aligned on a 2Mbytes boundarie, only map 1Mbyte. Signed-off-by: Christophe Leroy Acked-by: Scott Wood Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/269a00951328fb6fa1be2fa3cbc76c19745019b7.1568665466.git.christophe.leroy@c-s.fr commit cbcaff7d27ad5c5d2c2db113ec489be88adb815a Author: Christophe Leroy Date: Mon Sep 16 20:25:39 2019 +0000 powerpc/32s: automatically allocate BAT in setbat() If no BAT is given to setbat(), select an available BAT. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/a212bd36fbd6179e0929b6c727febc35132ac25c.1568665466.git.christophe.leroy@c-s.fr commit d538aadc2718a95bfd80095c66ea814824535b34 Author: Christophe Leroy Date: Thu Sep 12 13:49:44 2019 +0000 powerpc/ioremap: warn on early use of ioremap() Powerpc now has EARLY_IOREMAP. Next step is to convert all early users of ioremap() to early_ioremap(). Add a warning to help locate those users. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b4f03a68ee8e68773c8973d74ec35f9c82c72871.1568295907.git.christophe.leroy@c-s.fr commit 265c3491c4bc8d40587996d6ee2f447a7ccfb4f3 Author: Christophe Leroy Date: Thu Sep 12 13:49:43 2019 +0000 powerpc: Add support for GENERIC_EARLY_IOREMAP Add support for GENERIC_EARLY_IOREMAP. Let's define 16 slots of 256Kbytes each for early ioremap. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/412c7eaa6a373d8f82a3c3ee01e6a65a1a6589de.1568295907.git.christophe.leroy@c-s.fr commit 77693a5fb57be4606a6024ec8e3076f9499b906b Author: Christophe Leroy Date: Thu Sep 12 13:49:42 2019 +0000 powerpc/fixmap: Use __fix_to_virt() instead of fix_to_virt() Modify back __set_fixmap() to using __fix_to_virt() instead of fix_to_virt() otherwise the following happens because it seems GCC doesn't see idx as a builtin const. CC mm/early_ioremap.o In file included from ./include/linux/kernel.h:11:0, from mm/early_ioremap.c:11: In function ‘fix_to_virt’, inlined from ‘__set_fixmap’ at ./arch/powerpc/include/asm/fixmap.h:87:2, inlined from ‘__early_ioremap’ at mm/early_ioremap.c:156:4: ./include/linux/compiler.h:350:38: error: call to ‘__compiletime_assert_32’ declared with attribute error: BUILD_BUG_ON failed: idx >= __end_of_fixed_addresses _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__) ^ ./include/linux/compiler.h:331:4: note: in definition of macro ‘__compiletime_assert’ prefix ## suffix(); \ ^ ./include/linux/compiler.h:350:2: note: in expansion of macro ‘_compiletime_assert’ _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__) ^ ./include/linux/build_bug.h:39:37: note: in expansion of macro ‘compiletime_assert’ #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) ^ ./include/linux/build_bug.h:50:2: note: in expansion of macro ‘BUILD_BUG_ON_MSG’ BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition) ^ ./include/asm-generic/fixmap.h:32:2: note: in expansion of macro ‘BUILD_BUG_ON’ BUILD_BUG_ON(idx >= __end_of_fixed_addresses); ^ Signed-off-by: Christophe Leroy Fixes: 4cfac2f9c7f1 ("powerpc/mm: Simplify __set_fixmap()") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/f4984c615f90caa3277775a68849afeea846850d.1568295907.git.christophe.leroy@c-s.fr commit eafd687e689acd99d780e468d6a0622f4694d0bc Author: Christophe Leroy Date: Thu Sep 12 13:29:07 2019 +0000 powerpc/8xx: use the fixmapped IMMR in cpm_reset() Since commit f86ef74ed919 ("powerpc/8xx: Fix vaddr for IMMR early remap"), the IMMR area has been mapped at startup with fixmap. Use that fixmap directly instead of calling ioremap(), this avoids calling ioremap() early before the slab is available. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/f816ccdbd15b97cf43c5a8c7cc8dfa8db58ff036.1568294935.git.christophe.leroy@c-s.fr commit 132f92fdc42782fd297e076ef74bedeb8ce774e4 Author: Christophe Leroy Date: Thu Sep 12 13:22:55 2019 +0000 powerpc/8xx: add __init to cpm1 init functions Functions cpm1_clk_setup(), cpm1_set_pin(), cpm_pic_init() and mpc8xx_pic_init() are only called from __init functions, so mark them __init as well. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c27168ef054f3a52edcf0ff91652700d53b3e32d.1568294563.git.christophe.leroy@c-s.fr commit df66499a1fab340c167250a5743931dc50d5f0fa Author: Dan Carpenter Date: Tue Nov 19 09:17:05 2019 +0300 Bluetooth: delete a stray unlock We used to take a lock in amp_physical_cfm() but then we moved it to the caller function. Unfortunately the unlock on this error path was overlooked so it leads to a double unlock. Fixes: a514b17fab51 ("Bluetooth: Refactor locking in amp_physical_cfm") Signed-off-by: Dan Carpenter Signed-off-by: Marcel Holtmann commit 9f4813b531a0b8cc502fcfb142937fe4e9104d77 Merge: 44e09568cf2d af42d3466bdc Author: Ingo Molnar Date: Tue Nov 19 09:00:45 2019 +0100 Merge tag 'v5.4-rc8' into WIP.x86/mm, to pick up fixes Signed-off-by: Ingo Molnar commit b8dc647657d523ea6d6f169992c99fc3680a5f81 Author: Stephan Gerhold Date: Sun Nov 17 21:39:46 2019 +0100 Bluetooth: btbcm: Add entry for BCM4334B0 UART Bluetooth Add the device ID for the WiFi/BT/FM combo chip BCM4334 (rev B0). The chip seems to use 43:34:b0:00:00:00 as default address, so add it to the list of default addresses and leave it up to the user to configure a valid one. Signed-off-by: Stephan Gerhold Signed-off-by: Marcel Holtmann commit 4a56e423e0e19b616c2f2615674a7dffdb77afd6 Author: Fabien Dessenne Date: Fri Nov 15 11:03:08 2019 +0100 remoteproc: stm32: fix probe error case If the rproc driver is probed before the mailbox driver and if the rproc Device Tree node has some mailbox properties, the rproc driver probe shall be deferred instead of being probed without mailbox support. Tested-by: Mathieu Poirier Signed-off-by: Fabien Dessenne Link: https://lore.kernel.org/r/1573812188-19842-1-git-send-email-fabien.dessenne@st.com Signed-off-by: Bjorn Andersson commit 553671b7685972ca671da5f71cf6414b54376e13 Author: Linus Walleij Date: Fri Nov 15 23:59:11 2019 +0100 firmware_loader: Fix labels with comma for builtin firmware Some firmware images contain a comma, such as: EXTRA_FIRMWARE "brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt" as Broadcom firmware simply tags the device tree compatible string at the end of the firmware parameter file. And the compatible string contains a comma. This doesn't play well with gas: drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.S: Assembler messages: drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.S:4: Error: bad instruction `_fw_brcm_brcmfmac4334_sdio_samsung,gt_s7710_txt_bin:' drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.S:9: Error: bad instruction `_fw_brcm_brcmfmac4334_sdio_samsung,gt_s7710_txt_name:' drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.S:15: Error: can't resolve `.rodata' {.rodata section} - `_fw_brcm_brcmfmac4334_sdio_samsung' {*UND* section} make[6]: *** [../scripts/Makefile.build:357: drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.o] Error 1 We need to get rid of the comma from the labels used by the assembly stub generator. Replacing a comma using GNU Make subst requires a helper variable. Cc: Stephan Gerhold Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20191115225911.3260-1-linus.walleij@linaro.org Acked-by: Luis Chamberlain Signed-off-by: Greg Kroah-Hartman commit cddaebaf3d81584180d647e9cbda4ecbf8e8e71c Author: Can Guo Date: Thu Nov 14 22:09:27 2019 -0800 scsi: ufs: Fix register dump caused sleep in atomic context ufshcd_print_host_regs() can be called by interrupt handler, but it may sleep due to ufshcd_dump_regs() allocates the dump buffer memory with flag GFP_KERNEL. Fix it by changing GFP_KERNEL to GFP_ATMOIC. Link: https://lore.kernel.org/r/1573798172-20534-5-git-send-email-cang@codeaurora.org Reviewed-by: Bean Huo Signed-off-by: Can Guo Signed-off-by: Martin K. Petersen commit 71d848b8d97ec0f8e993d63cf9de6ac8b3f7c43d Author: Can Guo Date: Thu Nov 14 22:09:26 2019 -0800 scsi: ufs: Fix up auto hibern8 enablement Fix up possible unclocked register access to auto hibern8 register in resume path and through sysfs entry. Meanwhile, enable auto hibern8 only after device is fully initialized in probe path. Link: https://lore.kernel.org/r/1573798172-20534-4-git-send-email-cang@codeaurora.org Reviewed-by: Stanley Chu Signed-off-by: Can Guo Signed-off-by: Martin K. Petersen commit 870b1279c7a0344c99d85a9cb1619f6023e752ed Author: Can Guo Date: Thu Nov 14 22:09:25 2019 -0800 scsi: ufs-qcom: Add reset control support for host controller Add reset control for host controller so that host controller can be reset as required in its power up sequence. Link: https://lore.kernel.org/r/1573798172-20534-3-git-send-email-cang@codeaurora.org Reviewed-by: Avri Altman Signed-off-by: Can Guo Signed-off-by: Martin K. Petersen commit ebdd1dfde5d2c9b2532ee5b393d66d8bc5f56177 Author: Can Guo Date: Thu Nov 14 22:09:24 2019 -0800 scsi: ufs: Add device reset in link recovery path In order to recover from hibern8 exit failure, perform a reset in link recovery path before issuing link start-up. Link: https://lore.kernel.org/r/1573798172-20534-2-git-send-email-cang@codeaurora.org Reviewed-by: Bean Huo Reviewed-by: Stanley Chu Signed-off-by: Can Guo Signed-off-by: Martin K. Petersen commit 0424c5a4dda5608a2910474e3e8f0fd8e7126f42 Merge: a25ecd9d1e60 d1242b10ff03 Author: Alexei Starovoitov Date: Mon Nov 18 19:51:17 2019 -0800 Merge branch 'remove-jited-size-limits' Ilya Leoshkevich says: ==================== This patch series introduces usage of relative long jumps and loads in order to lift 64/512k size limits on JITed BPF programs on s390. Patch 1 introduces long relative branches. Patch 2 changes the way literal pool is arranged in order to be compatible with long relative loads. Patch 3 changes the way literal pool base register is loaded for large programs. Patch 4 replaces regular loads with long relative loads where they are totally superior. Patch 5 introduces long relative loads as an alternative way to load constants in large programs. Regular loads are kept and still used for small programs. Patch 6 removes the size limit check. ==================== Signed-off-by: Alexei Starovoitov commit d1242b10ff03a40ae095e6dd54aac4a6f0f547d5 Author: Ilya Leoshkevich Date: Mon Nov 18 19:03:40 2019 +0100 s390/bpf: Remove JITed image size limitations Now that jump and long displacement ranges are no longer a problem, remove the limit on JITed image size. In practice it's still limited by 2G, but with verifier allowing "only" 1M instructions, it's not an issue. Signed-off-by: Ilya Leoshkevich Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191118180340.68373-7-iii@linux.ibm.com commit b25c57b6b7dda3799aaebc5f463776e4a0555927 Author: Ilya Leoshkevich Date: Mon Nov 18 19:03:39 2019 +0100 s390/bpf: Use lg(f)rl when long displacement cannot be used If literal pool grows past 524287 mark, it's no longer possible to use long displacement to reference literal pool entries. In JIT setting maintaining multiple literal pool registers is next to impossible, since we operate on one instruction at a time. Therefore, fall back to loading literal pool entry using PC-relative addressing, and then using a register-register form of the following machine instruction. Signed-off-by: Ilya Leoshkevich Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191118180340.68373-6-iii@linux.ibm.com commit 451e448ff4bb137da3d4b8b26a8260a2ff66869a Author: Ilya Leoshkevich Date: Mon Nov 18 19:03:38 2019 +0100 s390/bpf: Use lgrl instead of lg where possible lg and lgrl have the same performance characteristics, but the former requires a base register and is subject to long displacement range limits, while the latter does not. Therefore, lgrl is totally superior to lg and should be used instead whenever possible. Signed-off-by: Ilya Leoshkevich Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191118180340.68373-5-iii@linux.ibm.com commit c1aff5682da2977c26fc087cf6a28e31a430174b Author: Ilya Leoshkevich Date: Mon Nov 18 19:03:37 2019 +0100 s390/bpf: Load literal pool register using larl Currently literal pool register is loaded using basr, which makes it point not to the beginning of the literal pool, but rather to the next instruction. In case JITed code is larger than 512k, this renders literal pool register absolutely useless due to long displacement range restrictions. The solution is to use larl to make literal pool register point to the very beginning of the literal pool. This makes it always possible to address 512k worth of literal pool entries using long displacement. However, for short programs, in which the entire literal pool is covered by basr-generated base, it is still beneficial to use basr, since it is 4 bytes shorter than larl. Detect situations when basr-generated base does not cover the entire literal pool, and in such cases use larl instead. Signed-off-by: Ilya Leoshkevich Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191118180340.68373-4-iii@linux.ibm.com commit e0491f64795bfc71ef6b13ba6b6fa6e176fa3c23 Author: Ilya Leoshkevich Date: Mon Nov 18 19:03:36 2019 +0100 s390/bpf: Align literal pool entries When literal pool size exceeds 512k, it's no longer possible to reference all the entries in it using a single base register and long displacement. Therefore, PC-relative lgfrl and lgrl instructions need to be used. Unfortunately, they require their arguments to be aligned to 4- and 8-byte boundaries respectively. This generates certain overhead due to necessary padding bytes. Grouping 4- and 8-byte entries together reduces the maximum overhead to 6 bytes (2 for aligning 4-byte entries and 4 for aligning 8-byte entries). While in theory it is possible to detect whether or not alignment is needed by comparing the literal pool size with 512k, in practice this leads to having two ways of emitting constants, making the code more complicated. Prefer code simplicity over trivial size saving, and always group and align literal pool entries. Signed-off-by: Ilya Leoshkevich Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191118180340.68373-3-iii@linux.ibm.com commit 4e9b4a6883dd97aff53ae3b08eb900716a5469dc Author: Ilya Leoshkevich Date: Mon Nov 18 19:03:35 2019 +0100 s390/bpf: Use relative long branches Currently maximum JITed code size is limited to 64k, because JIT can emit only relative short branches, whose range is limited by 64k in both directions. Teach JIT to use relative long branches. There are no compare+branch relative long instructions, so using relative long branches consumes more space due to having to having to emit an explicit comparison instruction. Therefore do this only when relative short branch is not enough. Signed-off-by: Ilya Leoshkevich Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191118180340.68373-2-iii@linux.ibm.com commit a25ecd9d1e60241df905b29fb84765eb74545c4f Author: Colin Ian King Date: Mon Nov 18 11:40:59 2019 +0000 bpf: Fix memory leak on object 'data' The error return path on when bpf_fentry_test* tests fail does not kfree 'data'. Fix this by adding the missing kfree. Addresses-Coverity: ("Resource leak") Fixes: faeb2dce084a ("bpf: Add kernel test functions for fentry testing") Signed-off-by: Colin Ian King Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20191118114059.37287-1-colin.king@canonical.com commit c21709e744b482baab544a893a3a1a9370d51850 Author: Colin Ian King Date: Mon Nov 18 11:48:35 2019 +0000 net: phy: dp83869: fix return of uninitialized variable ret In the case where the call to phy_interface_is_rgmii returns zero the variable ret is left uninitialized and this is returned at the end of the function dp83869_configure_rgmii. Fix this by returning 0 instead of the uninitialized value in ret. Addresses-Coverity: ("Uninitialized scalar variable") Fixes: 01db923e8377 ("net: phy: dp83869: Add TI dp83869 phy") Signed-off-by: Colin Ian King Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 3132174b4b5c999d383f047eebdcd8a326431802 Author: Xin Long Date: Mon Nov 18 18:10:12 2019 +0800 lwtunnel: change to use nla_put_u8 for LWTUNNEL_IP_OPT_ERSPAN_VER LWTUNNEL_IP_OPT_ERSPAN_VER is u8 type, and nla_put_u8 should have been used instead of nla_put_u32(). This is a copy-paste error. Fixes: b0a21810bd5e ("lwtunnel: add options setting and dumping for erspan") Signed-off-by: Xin Long Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit bec39a9fbbfa52dc8e6b213b1bde57313b252dd6 Merge: c4154cffa390 642aebdee4a1 Author: David S. Miller Date: Mon Nov 18 17:13:29 2019 -0800 Merge branch 'bnxt_en-Updates' Michael Chan says: ==================== bnxt_en: Updates. This series has the firmware interface update that changes the aRFS/ntuple interface on 57500 chips. The 2nd patch adds a counter and improves the hardware buffer error handling on the 57500 chips. The rest of the series is mainly enhancements on error recovery and firmware reset. ==================== Signed-off-by: David S. Miller commit 642aebdee4a1f53b713becb3b7df8896fbaeda33 Author: Pavan Chebbi Date: Mon Nov 18 03:56:43 2019 -0500 bnxt_en: Abort waiting for firmware response if there is no heartbeat. This is especially beneficial during the NVRAM related firmware commands that have longer timeouts. If the BNXT_STATE_FW_FATAL_COND flag gets set while waiting for firmware response, abort and return error. Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit a2b31e27f6269af8bbda4be2199c2af7c4dcb5a3 Author: Vasundhara Volam Date: Mon Nov 18 03:56:42 2019 -0500 bnxt_en: Add a warning message for driver initiated reset During loss of heartbeat, log this warning message. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 05069dd4c577f9b143dfd243d55834333c4470c5 Author: Vasundhara Volam Date: Mon Nov 18 03:56:41 2019 -0500 bnxt_en: Return proper error code for non-existent NVM variable For NVM params that are not supported in the current NVM configuration, return the error as -EOPNOTSUPP. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit e4e38237d7e39e84d4db4a5cf0aa1ce7fbfaa5d6 Author: Vasundhara Volam Date: Mon Nov 18 03:56:40 2019 -0500 bnxt_en: Report health status update after reset is done Report health status update to devlink health reporter, once reset is completed. Cc: Jiri Pirko Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit e633a32935a315b8e1f742622dcb254076a42352 Author: Vasundhara Volam Date: Mon Nov 18 03:56:39 2019 -0500 bnxt_en: Set MASTER flag during driver registration. The Linux driver is capable of being the master function to handle resets, so we set the flag to let firmware know. Some other drivers, such as DPDK, is not capable and will not set the flag. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 0a3f4e4f342c070312d799f7998d2f916c502c6e Author: Vasundhara Volam Date: Mon Nov 18 03:56:38 2019 -0500 bnxt_en: Extend ETHTOOL_RESET to hot reset driver. If firmware supports hot reset, extend ETHTOOL_RESET to support hot reset driver which does not require a driver reload after ETHTOOL_RESET. The driver will go through the same coordinated reset sequence as a firmware initiated fatal/non-fatal reset. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 5b306bde2b46964d604924ec085d619ffc331e09 Author: Vasundhara Volam Date: Mon Nov 18 03:56:37 2019 -0500 bnxt_en: Increase firmware response timeout for coredump commands. Use the larger HWRM_COREDUMP_TIMEOUT value for coredump related data response from the firmware. These commands take longer than normal commands. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 19b3751ffa713d04290effb26fe01009010f2206 Author: Michael Chan Date: Mon Nov 18 03:56:36 2019 -0500 bnxt_en: Improve RX buffer error handling. When hardware reports RX buffer errors, the latest 57500 chips do not require reset. The packet is discarded by the hardware and the ring will continue to operate. Also, add an rx_buf_errors counter for this type of error. It can help the user to identify if the aggregation ring is too small. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 41136ab35888c4007c6aad2f86e35afb97003e69 Author: Michael Chan Date: Mon Nov 18 03:56:35 2019 -0500 bnxt_en: Update firmware interface spec to 1.10.1.12. The aRFS ring table interface has changed for the 57500 chips. Updating it accordingly so it will work with the latest production firmware. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit c4154cffa390ab59681a6ece4ea4ab41f9a393dd Merge: 6960f7e3b2d7 64916b57c0b1 Author: David S. Miller Date: Mon Nov 18 17:11:54 2019 -0800 Merge branch 'selftests-Add-ethtool-and-scale-tests' Ido Schimmel says: ==================== selftests: Add ethtool and scale tests This patch set adds generic ethtool tests and a mlxsw-specific router scale test for Spectrum-2. Patches #1-#2 from Danielle add the router scale test for Spectrum-2. It re-uses the same test as Spectrum-1, but it is invoked with a different scale, according to what it is queried from devlink-resource. Patches #3-#5 from Amit are a re-work of the ethtool tests that were posted in the past [1]. Patches #3-#4 add the necessary library routines, whereas patch #5 adds the test itself. The test checks both good and bad flows with autoneg on and off. The test plan it detailed in the commit message. Last time Andrew and Florian (copied) provided very useful feedback that is incorporated in this set. Namely: * Parse the value of the different link modes from /usr/include/linux/ethtool.h * Differentiate between supported and advertised speeds and use the latter in autoneg tests * Make the test generic and move it to net/forwarding/ instead of being mlxsw-specific [1] https://patchwork.ozlabs.org/cover/1112903/ ==================== Signed-off-by: David S. Miller commit 64916b57c0b1f5576ae5973d6ff233731b9b3751 Author: Amit Cohen Date: Mon Nov 18 09:50:02 2019 +0200 selftests: forwarding: Add speed and auto-negotiation test Check configurations and packets transference with different variations of autoneg and speed. Test plan: 1. Test force of same speed with autoneg off 2. Test force of different speeds with autoneg off (should fail) 3. One side is autoneg on and other side sets force of common speeds 4. One side is autoneg on and other side only advertises a subset of the common speeds (one speed of the subset) 5. One side is autoneg on and other side only advertises a subset of the common speeds. Check that highest speed is negotiated 6. Test autoneg on, but each side advertises different speeds (should fail) Signed-off-by: Amit Cohen Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 8f72a9cf369090c3b94101a11cc4546f13f94925 Author: Amit Cohen Date: Mon Nov 18 09:50:01 2019 +0200 selftests: forwarding: lib.sh: Add wait for dev with timeout Add a function that waits for device with maximum number of iterations. It enables to limit the waiting and prevent infinite loop. This will be used by the subsequent patch which will set two ports to different speeds in order to make sure they cannot negotiate a link. Waiting for all the setup is limited with 10 minutes for each device. Signed-off-by: Amit Cohen Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 646cf7ed9abba7cc1a45f70243cd94808d4c8b6b Author: Amit Cohen Date: Mon Nov 18 09:50:00 2019 +0200 selftests: forwarding: Add ethtool_lib.sh Functions: 1. speeds_arr_get The function returns an array of speed values from /usr/include/linux/ethtool.h The array looks as follows: [10baseT/Half] = 0, [10baseT/Full] = 1, ... 2. ethtool_set: params: cmd The function runs ethtool by cmd (ethtool -s cmd) and checks if there was an error in configuration 3. dev_speeds_get: params: dev, with_mode (0 or 1), adver (0 or 1) return value: Array of supported/Advertised link modes with/without mode * Example 1: speeds_get swp1 0 0 return: 1000 10000 40000 * Example 2: speeds_get swp1 1 1 return: 1000baseKX/Full 10000baseKR/Full 40000baseCR4/Full 4. common_speeds_get: params: dev1, dev2, with_mode (0 or 1), adver (0 or 1) return value: Array of common speeds of dev1 and dev2 * Example: common_speeds_get swp1 swp2 0 0 return: 1000 10000 Assuming that swp1 supports 1000 10000 40000 and swp2 supports 1000 10000 Signed-off-by: Amit Cohen Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit b22b0b0b10aa16bfe020f0ce506ab78a4d8a5fd4 Author: Danielle Ratson Date: Mon Nov 18 09:49:59 2019 +0200 selftests: mlxsw: Check devlink device before running test The scale test for Spectrum-2 should only be invoked for Spectrum-2. Skip the test otherwise. Signed-off-by: Danielle Ratson Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 0fed96fa8342a14de7715fe37ae35cb5775bdced Author: Danielle Ratson Date: Mon Nov 18 09:49:58 2019 +0200 selftests: mlxsw: Add router scale test for Spectrum-2 Same as for Spectrum-1, test the ability to add the maximum number of routes possible to the switch. Invoke the test from the 'resource_scale' wrapper script. Signed-off-by: Danielle Ratson Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 6960f7e3b2d77ebcb20d5cecdd74d7ca1ed425aa Merge: b95e86d846b6 832ccf6f80cd Author: David S. Miller Date: Mon Nov 18 17:03:18 2019 -0800 Merge branch 'page_pool-followup-changes-to-restore-tracepoint-features' Jesper Dangaard says: ==================== page_pool: followup changes to restore tracepoint features This patchset is a followup to Jonathan patch, that do not release pool until inflight == 0. That changed page_pool to be responsible for its own delayed destruction instead of relying on xdp memory model. As the page_pool maintainer, I'm promoting the use of tracepoint to troubleshoot and help driver developers verify correctness when converting at driver to use page_pool. The role of xdp:mem_disconnect have changed, which broke my bpftrace tools for shutdown verification. With these changes, the same capabilities are regained. ==================== Signed-off-by: David S. Miller commit 832ccf6f80cda06ad2373cd1f40291b0183958b4 Author: Jesper Dangaard Brouer Date: Sat Nov 16 12:22:48 2019 +0100 page_pool: extend tracepoint to also include the page PFN The MM tracepoint for page free (called kmem:mm_page_free) doesn't provide the page pointer directly, instead it provides the PFN (Page Frame Number). This is annoying when writing a page_pool leak detector in BPF. This patch change page_pool tracepoints to also provide the PFN. The page pointer is still provided to allow other kinds of troubleshooting from BPF. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit 7c9e69428da39ed761c9d903c4850368fa4ef7bf Author: Jesper Dangaard Brouer Date: Sat Nov 16 12:22:43 2019 +0100 page_pool: add destroy attempts counter and rename tracepoint When Jonathan change the page_pool to become responsible to its own shutdown via deferred work queue, then the disconnect_cnt counter was removed from xdp memory model tracepoint. This patch change the page_pool_inflight tracepoint name to page_pool_release, because it reflects the new responsability better. And it reintroduces a counter that reflect the number of times page_pool_release have been tried. The counter is also used by the code, to only empty the alloc cache once. With a stuck work queue running every second and counter being 64-bit, it will overrun in approx 584 billion years. For comparison, Earth lifetime expectancy is 7.5 billion years, before the Sun will engulf, and destroy, the Earth. Signed-off-by: Jesper Dangaard Brouer Acked-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller commit c491eae8f9c0720520ebdeb4d335671f84b84b71 Author: Jesper Dangaard Brouer Date: Sat Nov 16 12:22:38 2019 +0100 xdp: remove memory poison on free for struct xdp_mem_allocator When looking at the details I realised that the memory poison in __xdp_mem_allocator_rcu_free doesn't make sense. This is because the SLUB allocator uses the first 16 bytes (on 64 bit), for its freelist, which overlap with members in struct xdp_mem_allocator, that were updated. Thus, SLUB already does the "poisoning" for us. I still believe that poisoning memory make sense in other cases. Kernel have gained different use-after-free detection mechanism, but enabling those is associated with a huge overhead. Experience is that debugging facilities can change the timing so much, that that a race condition will not be provoked when enabled. Thus, I'm still in favour of poisoning memory where it makes sense. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit b95e86d846b63b02ecdc94802ddbeaf9005fb6d9 Author: Russell King Date: Fri Nov 15 20:08:37 2019 +0000 net: phy: avoid matching all-ones clause 45 PHY IDs We currently match clause 45 PHYs using any ID read from a MMD marked as present in the "Devices in package" registers 5 and 6. However, this is incorrect. 45.2 says: "The definition of the term package is vendor specific and could be a chip, module, or other similar entity." so a package could be more or less than the whole PHY - a PHY could be made up of several modules instantiated onto a single chip such as the Marvell 88x3310, or some of the MMDs could be disabled according to chip configuration, such as the Broadcom 84881. In the case of Broadcom 84881, the "Devices in package" registers contain 0xc000009b, meaning that there is a PHYXS present in the package, but all registers in MMD 4 return 0xffff. This leads to our matching code incorrectly binding this PHY to one of our generic PHY drivers. This patch changes the way we determine whether to attempt to match a MMD identifier, or use it to request a module - if the identifier is all-ones, then we skip over it. When reading the identifiers, we initialise phydev->c45_ids.device_ids to all-ones, only reading the device ID if the "Devices in package" registers indicates we should. This avoids the generic drivers incorrectly matching on a PHY ID of 0xffffffff. Signed-off-by: Russell King Signed-off-by: David S. Miller commit e64dbb1ac078f04b21e980e0ea0e81eafba618e1 Merge: 99638e9d6c85 36023da1c704 Author: David S. Miller Date: Mon Nov 18 16:56:13 2019 -0800 Merge branch 'Add-support-for-SFPs-behind-PHYs' Russell King says: ==================== Add support for SFPs behind PHYs This series adds partial support for SFP cages connected to PHYs, specifically optical SFPs. We add core infrastructure to phylib for this, and arrange for minimal code in the PHY driver - currently, this is code to verify that the module is one that we can support for Marvell 10G PHYs. v2: add yaml binding patch ==================== Signed-off-by: David S. Miller commit 36023da1c704d56f2f264ccbfcfb7a15cdfd4d14 Author: Russell King Date: Fri Nov 15 19:56:56 2019 +0000 net: phy: marvell10g: add SFP+ support Add support for SFP+ cages to the Marvell 10G PHY driver. This is slightly complicated by the way phylib works in that we need to use a multi-step process to attach the SFP bus, and we also need to track the phylink state machine to know when the module's transmit disable signal should change state. With appropriate DT changes, this allows the SFP+ canges on the Macchiatobin platform to be functional. Signed-off-by: Russell King Signed-off-by: David S. Miller commit 298e54fa810e027f1b0800d789eb862592721f08 Author: Russell King Date: Fri Nov 15 19:56:51 2019 +0000 net: phy: add core phylib sfp support Add core phylib help for supporting SFP sockets on PHYs. This provides a mechanism to inform the SFP layer about PHY up/down events, and also unregister the SFP bus when the PHY is going away. Signed-off-by: Russell King Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit fb3d8bcde6df5565ba8a2d823eeb2928b6101d62 Author: Russell King Date: Fri Nov 15 19:56:46 2019 +0000 dt-bindings: net: add ethernet controller and phy sfp property Document the missing sfp property for ethernet controllers (which has existed for some time) which is being extended to ethernet PHYs. Signed-off-by: Russell King Reviewed-by: Rob Herring Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 99638e9d6c854c8b8da6beb06113b4c811c693fd Merge: 19b7e21c55c8 ff4bf2f42a40 Author: David S. Miller Date: Mon Nov 18 16:43:05 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Wildcard support for the net,iface set from Kristian Evensen. 2) Offload support for matching on the input interface. 3) Simplify matching on vlan header fields. 4) Add nft_payload_rebuild_vlan_hdr() function to rebuild the vlan header from the vlan sk_buff metadata. 5) Pass extack to nft_flow_cls_offload_setup(). 6) Add C-VLAN matching support. 7) Use time64_t in xt_time to fix y2038 overflow, from Arnd Bergmann. 8) Use time_t in nft_meta to fix y2038 overflow, also from Arnd. 9) Add flow_action_entry_next() helper function to flowtable offload infrastructure. 10) Add IPv6 support to the flowtable offload infrastructure. 11) Support for input interface matching from postrouting, from Phil Sutter. 12) Missing check for ndo callback in flowtable offload, from wenxu. 13) Remove conntrack parameter from flow_offload_fill_dir(), from wenxu. 14) Do not pass flow_rule object for rule removal, cookie is sufficient to achieve this. 15) Release flow_rule object in case of error from the offload commit path. 16) Undo offload ruleset updates if transaction fails. 17) Check for error when binding flowtable callbacks, from wenxu. 18) Always unbind flowtable callbacks when unregistering hooks. ==================== Signed-off-by: David S. Miller commit fa17ed069c61286b26382e23b57a62930657b9c1 Author: David Sterba Date: Thu Oct 3 17:29:05 2019 +0200 btrfs: drop bdev argument from submit_extent_page After previous patches removing bdev being passed around to set it to bio, it has become unused in submit_extent_page. So it now has "only" 13 parameters. Signed-off-by: David Sterba commit a019e9e197eaa68ffe2efeba00d685581b1a5416 Author: David Sterba Date: Fri Aug 30 15:40:53 2019 +0200 btrfs: remove extent_map::bdev We can now remove the bdev from extent_map. Previous patches made sure that bio_set_dev is correctly in all places and that we don't need to grab it from latest_bdev or pass it around inside the extent map. Signed-off-by: David Sterba commit 1a41802701ec78ca3272073e60463c13b17d121f Author: David Sterba Date: Fri Aug 30 19:39:19 2019 +0200 btrfs: drop bio_set_dev where not needed bio_set_dev sets a bdev to a bio and is not only setting a pointer bug also changing some state bits if there was a different bdev set before. This is one thing that's not needed. Another thing is that setting a bdev at bio allocation time is too early and actually does not work with plain redundancy profiles, where each time we submit a bio to a device, the bdev is set correctly. In many places the bio bdev is set to latest_bdev that seems to serve as a stub pointer "just to put something to bio". But we don't have to do that. Where do we know which bdev to set: * for regular IO: submit_stripe_bio that's called by btrfs_map_bio * repair IO: repair_io_failure, read or write from specific device * super block write (using buffer_heads but uses raw bdev) and barriers * scrub: this does not use all regular IO paths as it needs to reach all copies, verify and fixup eventually, and for that all bdev management is independent * raid56: rbio_add_io_page, for the RMW write * integrity-checker: does it's own low-level block tracking Signed-off-by: David Sterba commit 429aebc0a9a063667dba21244386f96e5b4d7330 Author: David Sterba Date: Mon Nov 18 23:27:55 2019 +0100 btrfs: get bdev directly from fs_devices in submit_extent_page This is preparatory patch to remove @bdev parameter from submit_extent_page. It can't be removed completely, because the cgroups need it for wbc when initializing the bio wbc_init_bio bio_associate_blkg_from_css dereference bdev->bi_disk->queue The bdev pointer is the same as latest_bdev, thus no functional change. We can retrieve it from fs_devices that's reachable through several dereferences. The local variable shadows the parameter, but that's only temporary. Signed-off-by: David Sterba commit a910e4666d61712840c78de33cc7f89de8affa78 Author: Ian Rogers Date: Fri Nov 15 23:46:52 2019 -0800 perf parse: Report initial event parsing error Record the first event parsing error and report. Implementing feedback from Jiri Olsa: https://lkml.org/lkml/2019/10/28/680 An example error is: $ tools/perf/perf stat -e c/c/ WARNING: multiple event parsing errors event syntax error: 'c/c/' \___ unknown term valid terms: event,filter_rem,filter_opc0,edge,filter_isoc,filter_tid,filter_loc,filter_nc,inv,umask,filter_opc1,tid_en,thresh,filter_all_op,filter_not_nm,filter_state,filter_nm,config,config1,config2,name,period,percore Initial error: event syntax error: 'c/c/' \___ Cannot find PMU `c'. Missing kernel support? Run 'perf list' for a list of valid events Usage: perf stat [] [] -e, --event event selector. use 'perf list' to list available events Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Allison Randal Cc: Andi Kleen Cc: Anju T Sudhakar Cc: Christian Borntraeger Cc: Davidlohr Bueso Cc: Jin Yao Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Thomas Richter Link: http://lore.kernel.org/lkml/20191116074652.9960-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit cb4027308570841869ec0c6bdafc9658c10f28a3 Author: Masami Hiramatsu Date: Mon Nov 18 17:12:49 2019 +0900 perf probe: Trace a magic number if variable is not found Trace a magic number as immediate value if the target variable is not found at some probe points which is based on one probe event. This feature is good for the case if you trace a source code line with some local variables, which is compiled into several instructions and some of the variables are optimized out on some instructions. Even if so, with this feature, perf probe trace a magic number instead of such disappeared variables and fold those probes on one event. E.g. without this patch: # perf probe -D "pud_page_vaddr pud" Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. Failed to find 'pud' in this function. p:probe/pud_page_vaddr _text+23480787 pud=%ax:x64 p:probe/pud_page_vaddr _text+23808453 pud=%bp:x64 p:probe/pud_page_vaddr _text+23558082 pud=%ax:x64 p:probe/pud_page_vaddr _text+328373 pud=%r8:x64 p:probe/pud_page_vaddr _text+348448 pud=%bx:x64 p:probe/pud_page_vaddr _text+23816818 pud=%bx:x64 With this patch: # perf probe -D "pud_page_vaddr pud" | head spurious_kernel_fault is blacklisted function, skip it. vmalloc_fault is blacklisted function, skip it. p:probe/pud_page_vaddr _text+23480787 pud=%ax:x64 p:probe/pud_page_vaddr _text+149051 pud=\deade12d:x64 p:probe/pud_page_vaddr _text+23808453 pud=%bp:x64 p:probe/pud_page_vaddr _text+315926 pud=\deade12d:x64 p:probe/pud_page_vaddr _text+23807209 pud=\deade12d:x64 p:probe/pud_page_vaddr _text+23557365 pud=%ax:x64 p:probe/pud_page_vaddr _text+314097 pud=%di:x64 p:probe/pud_page_vaddr _text+314015 pud=\deade12d:x64 p:probe/pud_page_vaddr _text+313893 pud=\deade12d:x64 p:probe/pud_page_vaddr _text+324083 pud=\deade12d:x64 Signed-off-by: Masami Hiramatsu Cc: Namhyung Kim Cc: Ravi Bangoria Cc: Steven Rostedt (VMware) Cc: Tom Zanussi Link: http://lore.kernel.org/lkml/157406476931.24476.6261475888681844285.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit 66f69b2197167cb99330c77a550da50f1f597abc Author: Masami Hiramatsu Date: Mon Nov 18 17:12:40 2019 +0900 perf probe: Support DW_AT_const_value constant value Support DW_AT_const_value for variable assignment instead of location. Note that this requires ftrace supporting immediate value. Signed-off-by: Masami Hiramatsu Cc: Namhyung Kim Cc: Ravi Bangoria Cc: Steven Rostedt (VMware) Cc: Tom Zanussi Link: http://lore.kernel.org/lkml/157406476012.24476.16096289871757175775.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit 72363540c009db5014252a1a15e149d30f88bcc3 Author: Masami Hiramatsu Date: Mon Nov 18 17:12:30 2019 +0900 perf probe: Support multiprobe event Support multiprobe event if the event is based on function and lines and kernel supports it. In this case, perf probe creates the first probe with an event, and tries to append following probes on that event, since those probes must be on the same source code line. Before this patch; # perf probe -a vfs_read:18 Added new events: probe:vfs_read_L18 (on vfs_read:18) probe:vfs_read_L18_1 (on vfs_read:18) You can now use it in all perf tools, such as: perf record -e probe:vfs_read_L18_1 -aR sleep 1 # After this patch (on multiprobe supported kernel) # perf probe -a vfs_read:18 Added new events: probe:vfs_read_L18 (on vfs_read:18) probe:vfs_read_L18 (on vfs_read:18) You can now use it in all perf tools, such as: perf record -e probe:vfs_read_L18 -aR sleep 1 # Committer testing: On a kernel that doesn't support multiprobe events, after this patch: # uname -a Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux # grep append /sys/kernel/debug/tracing/README be modified by appending '.descending' or '.ascending' to a can be modified by appending any of the following modifiers # # perf probe -a vfs_read:18 Added new events: probe:vfs_read_L18 (on vfs_read:18) probe:vfs_read_L18_1 (on vfs_read:18) You can now use it in all perf tools, such as: perf record -e probe:vfs_read_L18_1 -aR sleep 1 # perf probe -l probe:vfs_read_L18 (on vfs_read:18@fs/read_write.c) probe:vfs_read_L18_1 (on vfs_read:18@fs/read_write.c) # Signed-off-by: Masami Hiramatsu Tested-by: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Ravi Bangoria Cc: Steven Rostedt (VMware) Cc: Tom Zanussi Link: http://lore.kernel.org/lkml/157406475010.24476.586290752591512351.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit 15354d54698648e20454fc8f298a5b18b6debea7 Author: Masami Hiramatsu Date: Mon Nov 18 17:12:20 2019 +0900 perf probe: Generate event name with line number Generate event name from function name with line number as _L. Note that this is only for the new event which is defined by the line number of function (except for line 0). If there is another event on same line, you have to use "-f" option. In that case, the new event has "_1" suffix. e.g. # perf probe -a kernel_read:2 Added new event: probe:kernel_read_L2 (on kernel_read:2) You can now use it in all perf tools, such as: perf record -e probe:kernel_read_L2 -aR sleep 1 But if we omit the line number or 0th line, it will have no suffix. # perf probe -a kernel_read:0 Added new event: probe:kernel_read (on kernel_read) You can now use it in all perf tools, such as: perf record -e probe:kernel_read -aR sleep 1 probe:kernel_read (on kernel_read@linux-5.0.0/fs/read_write.c) probe:kernel_read_L2 (on kernel_read:2@linux-5.0.0/fs/read_write.c) Signed-off-by: Masami Hiramatsu Tested-by: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Ravi Bangoria Cc: Steven Rostedt (VMware) Cc: Tom Zanussi Link: http://lore.kernel.org/lkml/157406474026.24476.2828897745502059569.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit 499144c83d3b7e4f9e83916acfc97bbc3af891dc Author: Masami Hiramatsu Date: Mon Nov 18 17:12:10 2019 +0900 perf probe: Do not show non representive lines by perf-probe -L Since perf probe -L shows non representive lines, it can be mislead users where user can put probes. This prevents to show such non representive lines so that user can understand which lines user can probe. # perf probe -L kernel_read 0 ssize_t kernel_read(struct file *file, void *buf, size_t count, loff_t *pos) { 2 mm_segment_t old_fs; ssize_t result; old_fs = get_fs(); 6 set_fs(get_ds()); /* The cast to a user pointer is valid due to the set_fs() */ 8 result = vfs_read(file, (void __user *)buf, count, pos); 9 set_fs(old_fs); 10 return result; } EXPORT_SYMBOL(kernel_read); Committer testing: Before: # perf probe -L kernel_read 0 ssize_t kernel_read(struct file *file, void *buf, size_t count, loff_t *pos) 1 { 2 mm_segment_t old_fs; 3 ssize_t result; 5 old_fs = get_fs(); 6 set_fs(KERNEL_DS); /* The cast to a user pointer is valid due to the set_fs() */ 8 result = vfs_read(file, (void __user *)buf, count, pos); 9 set_fs(old_fs); 10 return result; } EXPORT_SYMBOL(kernel_read); # See the 1, 3, 5 lines? They shouldn't be there, after this patch: # perf probe -L kernel_read 0 ssize_t kernel_read(struct file *file, void *buf, size_t count, loff_t *pos) { 2 mm_segment_t old_fs; ssize_t result; old_fs = get_fs(); 6 set_fs(KERNEL_DS); /* The cast to a user pointer is valid due to the set_fs() */ 8 result = vfs_read(file, (void __user *)buf, count, pos); 9 set_fs(old_fs); 10 return result; } EXPORT_SYMBOL(kernel_read); # Signed-off-by: Masami Hiramatsu Reported-by: Arnaldo Carvalho de Melo Tested-by: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Ravi Bangoria Cc: Steven Rostedt (VMware) Cc: Tom Zanussi Link: http://lore.kernel.org/lkml/157406473064.24476.2913278267727587314.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit 1ae5d88a4eefacd4a3643170c20cf6403a24d254 Author: Masami Hiramatsu Date: Mon Nov 18 17:12:00 2019 +0900 perf probe: Verify given line is a representive line Verify user given probe line is a representive line (which doesn't share the address with other lines or the line is the least line among the lines which shares same address), and if not, it shows what is the representive line. Without this fix, user can put a probe on the lines which is not a a representive line. But since this is not a representive line, perf probe -l shows a representive line number instead of user given line number. e.g. (put kernel_read:3, but listed as kernel_read:2) # perf probe -a kernel_read:3 Added new event: probe:kernel_read (on kernel_read:3) You can now use it in all perf tools, such as: perf record -e probe:kernel_read -aR sleep 1 # perf probe -l probe:kernel_read (on kernel_read:2@linux-5.0.0/fs/read_write.c) With this fix, perf probe doesn't allow user to put a probe on a representive line, and tell what is the representive line. # perf probe -a kernel_read:3 This line is sharing the addrees with other lines. Please try to probe at kernel_read:2 instead. Error: Failed to add events. Signed-off-by: Masami Hiramatsu Reported-by: Arnaldo Carvalho de Melo Tested-by: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Ravi Bangoria Cc: Steven Rostedt (VMware) Cc: Tom Zanussi Link: http://lore.kernel.org/lkml/157406472071.24476.14915451439785001021.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit 57f95bf5f88295612871c36cb0de5069e50570f8 Author: Masami Hiramatsu Date: Mon Nov 18 17:11:50 2019 +0900 perf probe: Show correct statement line number by perf probe -l The dwarf_getsrc_die() can return the line which is not a statement nor the least line number among the lines which shares same address. This can lead perf probe --list shows incorrect line number for probed address. To fix this, this introduces cu_getsrc_die() which returns only a statement line and which is the least line number (we call it the representive line for an address), and use it in cu_find_lineinfo(). Also, if the given address is the entry address of a real function, cu_find_lineinfo() returns the function declared line number instead of the start line number of the function body. For example, without this change perf probe -l shows incorrect line as below. # perf probe -a kernel_read:2 Added new event: probe:kernel_read (on kernel_read:2) You can now use it in all perf tools, such as: perf record -e probe:kernel_read -aR sleep 1 # perf probe -l probe:kernel_read (on kernel_read:1@linux-5.0.0/fs/read_write.c) With this fix, it shows correct line number as below; # perf probe -l probe:kernel_read (on kernel_read:2@linux-5.0.0/fs/read_write.c) Reported-by: Arnaldo Carvalho de Melo Signed-off-by: Masami Hiramatsu Tested-by: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Ravi Bangoria Cc: Steven Rostedt (VMware) Cc: Tom Zanussi Link: http://lore.kernel.org/lkml/157406471067.24476.17463149618465494448.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo commit b980be189c9badba50634671e2303e92bf28e35a Author: Adrian Hunter Date: Fri Nov 15 15:54:47 2019 +0200 x86/insn: Add some Intel instructions to the opcode map Add to the opcode map the following instructions: cldemote tpause umonitor umwait movdiri movdir64b enqcmd enqcmds encls enclu enclv pconfig wbnoinvd For information about the instructions, refer Intel SDM May 2019 (325462-070US) and Intel Architecture Instruction Set Extensions May 2019 (319433-037). The instruction decoding can be tested using the perf tools' "x86 instruction decoder - new instructions" test as folllows: $ perf test -v "new " 2>&1 | grep -i cldemote Decoded ok: 0f 1c 00 cldemote (%eax) Decoded ok: 0f 1c 05 78 56 34 12 cldemote 0x12345678 Decoded ok: 0f 1c 84 c8 78 56 34 12 cldemote 0x12345678(%eax,%ecx,8) Decoded ok: 0f 1c 00 cldemote (%rax) Decoded ok: 41 0f 1c 00 cldemote (%r8) Decoded ok: 0f 1c 04 25 78 56 34 12 cldemote 0x12345678 Decoded ok: 0f 1c 84 c8 78 56 34 12 cldemote 0x12345678(%rax,%rcx,8) Decoded ok: 41 0f 1c 84 c8 78 56 34 12 cldemote 0x12345678(%r8,%rcx,8) $ perf test -v "new " 2>&1 | grep -i tpause Decoded ok: 66 0f ae f3 tpause %ebx Decoded ok: 66 0f ae f3 tpause %ebx Decoded ok: 66 41 0f ae f0 tpause %r8d $ perf test -v "new " 2>&1 | grep -i umonitor Decoded ok: 67 f3 0f ae f0 umonitor %ax Decoded ok: f3 0f ae f0 umonitor %eax Decoded ok: 67 f3 0f ae f0 umonitor %eax Decoded ok: f3 0f ae f0 umonitor %rax Decoded ok: 67 f3 41 0f ae f0 umonitor %r8d $ perf test -v "new " 2>&1 | grep -i umwait Decoded ok: f2 0f ae f0 umwait %eax Decoded ok: f2 0f ae f0 umwait %eax Decoded ok: f2 41 0f ae f0 umwait %r8d $ perf test -v "new " 2>&1 | grep -i movdiri Decoded ok: 0f 38 f9 03 movdiri %eax,(%ebx) Decoded ok: 0f 38 f9 88 78 56 34 12 movdiri %ecx,0x12345678(%eax) Decoded ok: 48 0f 38 f9 03 movdiri %rax,(%rbx) Decoded ok: 48 0f 38 f9 88 78 56 34 12 movdiri %rcx,0x12345678(%rax) $ perf test -v "new " 2>&1 | grep -i movdir64b Decoded ok: 66 0f 38 f8 18 movdir64b (%eax),%ebx Decoded ok: 66 0f 38 f8 88 78 56 34 12 movdir64b 0x12345678(%eax),%ecx Decoded ok: 67 66 0f 38 f8 1c movdir64b (%si),%bx Decoded ok: 67 66 0f 38 f8 8c 34 12 movdir64b 0x1234(%si),%cx Decoded ok: 66 0f 38 f8 18 movdir64b (%rax),%rbx Decoded ok: 66 0f 38 f8 88 78 56 34 12 movdir64b 0x12345678(%rax),%rcx Decoded ok: 67 66 0f 38 f8 18 movdir64b (%eax),%ebx Decoded ok: 67 66 0f 38 f8 88 78 56 34 12 movdir64b 0x12345678(%eax),%ecx $ perf test -v "new " 2>&1 | grep -i enqcmd Decoded ok: f2 0f 38 f8 18 enqcmd (%eax),%ebx Decoded ok: f2 0f 38 f8 88 78 56 34 12 enqcmd 0x12345678(%eax),%ecx Decoded ok: 67 f2 0f 38 f8 1c enqcmd (%si),%bx Decoded ok: 67 f2 0f 38 f8 8c 34 12 enqcmd 0x1234(%si),%cx Decoded ok: f3 0f 38 f8 18 enqcmds (%eax),%ebx Decoded ok: f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%eax),%ecx Decoded ok: 67 f3 0f 38 f8 1c enqcmds (%si),%bx Decoded ok: 67 f3 0f 38 f8 8c 34 12 enqcmds 0x1234(%si),%cx Decoded ok: f2 0f 38 f8 18 enqcmd (%rax),%rbx Decoded ok: f2 0f 38 f8 88 78 56 34 12 enqcmd 0x12345678(%rax),%rcx Decoded ok: 67 f2 0f 38 f8 18 enqcmd (%eax),%ebx Decoded ok: 67 f2 0f 38 f8 88 78 56 34 12 enqcmd 0x12345678(%eax),%ecx Decoded ok: f3 0f 38 f8 18 enqcmds (%rax),%rbx Decoded ok: f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%rax),%rcx Decoded ok: 67 f3 0f 38 f8 18 enqcmds (%eax),%ebx Decoded ok: 67 f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%eax),%ecx $ perf test -v "new " 2>&1 | grep -i enqcmds Decoded ok: f3 0f 38 f8 18 enqcmds (%eax),%ebx Decoded ok: f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%eax),%ecx Decoded ok: 67 f3 0f 38 f8 1c enqcmds (%si),%bx Decoded ok: 67 f3 0f 38 f8 8c 34 12 enqcmds 0x1234(%si),%cx Decoded ok: f3 0f 38 f8 18 enqcmds (%rax),%rbx Decoded ok: f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%rax),%rcx Decoded ok: 67 f3 0f 38 f8 18 enqcmds (%eax),%ebx Decoded ok: 67 f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%eax),%ecx $ perf test -v "new " 2>&1 | grep -i encls Decoded ok: 0f 01 cf encls Decoded ok: 0f 01 cf encls $ perf test -v "new " 2>&1 | grep -i enclu Decoded ok: 0f 01 d7 enclu Decoded ok: 0f 01 d7 enclu $ perf test -v "new " 2>&1 | grep -i enclv Decoded ok: 0f 01 c0 enclv Decoded ok: 0f 01 c0 enclv $ perf test -v "new " 2>&1 | grep -i pconfig Decoded ok: 0f 01 c5 pconfig Decoded ok: 0f 01 c5 pconfig $ perf test -v "new " 2>&1 | grep -i wbnoinvd Decoded ok: f3 0f 09 wbnoinvd Decoded ok: f3 0f 09 wbnoinvd Signed-off-by: Adrian Hunter Reviewed-by: Andi Kleen Acked-by: Masami Hiramatsu Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: x86@kernel.org Link: http://lore.kernel.org/lkml/20191115135447.6519-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 1e5f015442e7b700941f8cd0274bb14962b3d78e Author: Adrian Hunter Date: Fri Nov 15 15:54:46 2019 +0200 x86/insn: perf tools: Add some instructions to the new instructions test Add to the "x86 instruction decoder - new instructions" test the following instructions: cldemote tpause umonitor umwait movdiri movdir64b enqcmd enqcmds encls enclu enclv pconfig wbnoinvd For information about the instructions, refer Intel SDM May 2019 (325462-070US) and Intel Architecture Instruction Set Extensions May 2019 (319433-037). Signed-off-by: Adrian Hunter Reviewed-by: Andi Kleen Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: x86@kernel.org Link: http://lore.kernel.org/lkml/20191115135447.6519-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 2ea2612b987ad703235c92be21d4e98ee9c2c67c Author: Yonghong Song Date: Sun Nov 17 13:40:36 2019 -0800 selftests, bpf: Workaround an alu32 sub-register spilling issue Currently, with latest llvm trunk, selftest test_progs failed obj file test_seg6_loop.o with the following error in verifier: infinite loop detected at insn 76 The byte code sequence looks like below, and noted that alu32 has been turned off by default for better generated codes in general: 48: w3 = 100 49: *(u32 *)(r10 - 68) = r3 ... ; if (tlv.type == SR6_TLV_PADDING) { 76: if w3 == 5 goto -18 ... 85: r1 = *(u32 *)(r10 - 68) ; for (int i = 0; i < 100; i++) { 86: w1 += -1 87: if w1 == 0 goto +5 88: *(u32 *)(r10 - 68) = r1 The main reason for verification failure is due to partial spills at r10 - 68 for induction variable "i". Current verifier only handles spills with 8-byte values. The above 4-byte value spill to stack is treated to STACK_MISC and its content is not saved. For the above example: w3 = 100 R3_w=inv100 fp-64_w=inv1086626730498 *(u32 *)(r10 - 68) = r3 R3_w=inv100 fp-64_w=inv1086626730498 ... r1 = *(u32 *)(r10 - 68) R1_w=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) fp-64=inv1086626730498 To resolve this issue, verifier needs to be extended to track sub-registers in spilling, or llvm needs to enhanced to prevent sub-register spilling in register allocation phase. The former will increase verifier complexity and the latter will need some llvm "hacking". Let us workaround this issue by declaring the induction variable as "long" type so spilling will happen at non sub-register level. We can revisit this later if sub-register spilling causes similar or other verification issues. Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191117214036.1309510-1-yhs@fb.com commit 3b054b7133b4ad93671c82e8d6185258e3f1a7a5 Author: Jiri Benc Date: Fri Nov 15 13:43:23 2019 +0100 selftests, bpf: Fix test_tc_tunnel hanging When run_kselftests.sh is run, it hangs after test_tc_tunnel.sh. The reason is test_tc_tunnel.sh ensures the server ('nc -l') is run all the time, starting it again every time it is expected to terminate. The exception is the final client_connect: the server is not started anymore, which ensures no process is kept running after the test is finished. For a sit test, though, the script is terminated prematurely without the final client_connect and the 'nc' process keeps running. This in turn causes the run_one function in kselftest/runner.sh to hang forever, waiting for the runaway process to finish. Ensure a remaining server is terminated on cleanup. Fixes: f6ad6accaa99 ("selftests/bpf: expand test_tc_tunnel with SIT encap") Signed-off-by: Jiri Benc Signed-off-by: Daniel Borkmann Acked-by: Willem de Bruijn Link: https://lore.kernel.org/bpf/60919291657a9ee89c708d8aababc28ebe1420be.1573821780.git.jbenc@redhat.com commit 56bf877a508099f16fb78c71a348f39d0dc5fd72 Author: Jiri Benc Date: Mon Nov 18 21:25:26 2019 +0100 selftests, bpf: xdping is not meant to be run standalone The actual test to run is test_xdping.sh, which is already in TEST_PROGS. The xdping program alone is not runnable with 'make run_tests', it immediatelly fails due to missing arguments. Move xdping to TEST_GEN_PROGS_EXTENDED in order to be built but not run. Fixes: cd5385029f1d ("selftests/bpf: measure RTT from xdp using xdping") Signed-off-by: Jiri Benc Signed-off-by: Daniel Borkmann Reviewed-by: Alan Maguire Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/bpf/4365c81198f62521344c2215909634407184387e.1573821726.git.jbenc@redhat.com commit 7624e69465da809f8735d3f72d4fca540c275b7e Author: Arnaldo Carvalho de Melo Date: Mon Nov 18 16:51:00 2019 -0300 perf map: Move seldom used ->flags field to second cacheline So we start with: $ pahole -C map ~/bin/perf struct map { union { struct rb_node rb_node __attribute__((__aligned__(8))); /* 0 24 */ struct list_head node; /* 0 16 */ } __attribute__((__aligned__(8))); /* 0 24 */ u64 start; /* 24 8 */ u64 end; /* 32 8 */ _Bool erange_warned:1; /* 40: 0 1 */ _Bool priv:1; /* 40: 1 1 */ /* XXX 6 bits hole, try to pack */ /* XXX 3 bytes hole, try to pack */ u32 prot; /* 44 4 */ u32 flags; /* 48 4 */ /* XXX 4 bytes hole, try to pack */ u64 pgoff; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ u64 reloc; /* 64 8 */ u32 maj; /* 72 4 */ u32 min; /* 76 4 */ u64 ino; /* 80 8 */ u64 ino_generation; /* 88 8 */ u64 (*map_ip)(struct map *, u64); /* 96 8 */ u64 (*unmap_ip)(struct map *, u64); /* 104 8 */ struct dso * dso; /* 112 8 */ refcount_t refcnt; /* 120 4 */ /* size: 128, cachelines: 2, members: 17 */ /* sum members: 116, holes: 2, sum holes: 7 */ /* sum bitfield members: 2 bits, bit holes: 1, sum bit holes: 6 bits */ /* padding: 4 */ /* forced alignments: 1 */ } __attribute__((__aligned__(8))); $ and 'flags' is seldom used when printing details about the map or with the "cacheline" sort order, we can move them it to the second cacheline, that will allow combining it with 'refcnt', that is only four bytes: $ pahole -C map ~/bin/perf struct map { union { struct rb_node rb_node __attribute__((__aligned__(8))); /* 0 24 */ struct list_head node; /* 0 16 */ } __attribute__((__aligned__(8))); /* 0 24 */ u64 start; /* 24 8 */ u64 end; /* 32 8 */ _Bool erange_warned:1; /* 40: 0 1 */ _Bool priv:1; /* 40: 1 1 */ /* XXX 6 bits hole, try to pack */ /* XXX 3 bytes hole, try to pack */ u32 prot; /* 44 4 */ u64 pgoff; /* 48 8 */ u64 reloc; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ u32 maj; /* 64 4 */ u32 min; /* 68 4 */ u64 ino; /* 72 8 */ u64 ino_generation; /* 80 8 */ u64 (*map_ip)(struct map *, u64); /* 88 8 */ u64 (*unmap_ip)(struct map *, u64); /* 96 8 */ struct dso * dso; /* 104 8 */ refcount_t refcnt; /* 112 4 */ u32 flags; /* 116 4 */ /* size: 120, cachelines: 2, members: 17 */ /* sum members: 116, holes: 1, sum holes: 3 */ /* sum bitfield members: 2 bits, bit holes: 1, sum bit holes: 6 bits */ /* forced alignments: 1 */ /* last cacheline: 56 bytes */ } __attribute__((__aligned__(8))); $ Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-2cdw3zlw1mkamaf7nqtdlxfi@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5ca470a0c3886b80ec13c3a19e9aae4c2f469202 Author: Jonathan Corbet Date: Fri Oct 4 10:39:55 2019 -0600 docs: Add request_irq() documentation While checking the results of the :c:func: removal, I noticed that there was no documentation for request_irq(), and request_threaded_irq() was not mentioned at all. Add a kerneldoc comment for request_irq() and add request_threaded_irq() to the list of functions. Reviewed-by: Thomas Gleixner Signed-off-by: Jonathan Corbet commit dbc984c961667b1ce48a0337b5bcd3b8c9cb2098 Author: Arnaldo Carvalho de Melo Date: Mon Nov 18 16:26:29 2019 -0300 perf map: Use bitmap for booleans The map->priv and map->erange_warned are seldom used, the first only in tests/vmlinux-kallsyms.c, the later only when hist_entry__inc_addr_samples() returns -ERANGE in 'perf top', which are really rare occasions, so make them a bool bitfield. This will open up space for other members on the first cacheline. $ pahole -C map ~/bin/perf struct map { union { struct rb_node rb_node __attribute__((__aligned__(8))); /* 0 24 */ struct list_head node; /* 0 16 */ } __attribute__((__aligned__(8))); /* 0 24 */ u64 start; /* 24 8 */ u64 end; /* 32 8 */ _Bool erange_warned:1; /* 40: 0 1 */ _Bool priv:1; /* 40: 1 1 */ /* XXX 6 bits hole, try to pack */ /* XXX 3 bytes hole, try to pack */ u32 prot; /* 44 4 */ u32 flags; /* 48 4 */ /* XXX 4 bytes hole, try to pack */ u64 pgoff; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ u64 reloc; /* 64 8 */ u32 maj; /* 72 4 */ u32 min; /* 76 4 */ u64 ino; /* 80 8 */ u64 ino_generation; /* 88 8 */ u64 (*map_ip)(struct map *, u64); /* 96 8 */ u64 (*unmap_ip)(struct map *, u64); /* 104 8 */ struct dso * dso; /* 112 8 */ refcount_t refcnt; /* 120 4 */ /* size: 128, cachelines: 2, members: 17 */ /* sum members: 116, holes: 2, sum holes: 7 */ /* sum bitfield members: 2 bits, bit holes: 1, sum bit holes: 6 bits */ /* padding: 4 */ /* forced alignments: 1 */ } __attribute__((__aligned__(8))); $ Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-g5545pcq4ff0wr17tfb1piqt@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e8a9e30d721196951e1c82bae208296d066ac272 Author: Jaskaran Singh Date: Sun Nov 17 22:54:36 2019 +0530 docs: filesystems: Add mount map description in Content The second paragraph of the content section does not properly describe how mount points are determined by autofs. Replace the lines detailing how the determination of these mount points is "ad hoc" by a short description of the mount map syntax used by autofs. Signed-off-by: Jaskaran Singh Signed-off-by: Jonathan Corbet commit c11565e88790517647c675a91745478492310e79 Author: Jaskaran Singh Date: Sun Nov 17 22:54:35 2019 +0530 docs: filesystems: Update code snippets in autofs.rst Some of the struct definitions now have an autofs packet header. Reflect these changes by adding a definition of this header and place it wherever suitable. Signed-off-by: Jaskaran Singh Signed-off-by: Jonathan Corbet commit f11f2a3c543557d7f8ae8bb884c4b705b3b516cd Author: Jaskaran Singh Date: Sun Nov 17 22:54:34 2019 +0530 docs: filesystems: convert autofs.txt to reST Convert autofs.txt to reST. The following changes abound: - Introduce reST formatting for headings, lists et al. - Add an indentation of an 8 space tab wherever suitable, so as to maintain consistency. - Remove indentation of the description of the ioctls which are similar to the AUTOFS_IOC ioctls, as it does not come out quite right in HTML. - Add an entry for autofs in the index. Signed-off-by: Jaskaran Singh Signed-off-by: Jonathan Corbet commit 33c26ab4d6beec44bd5f525ffba1c23bf962d4a7 Author: Paul Cercueil Date: Wed Oct 23 19:47:14 2019 +0200 watchdog: jz4740: Drop dependency on MACH_JZ47xx Depending on MACH_JZ47xx prevent us from creating a generic kernel that works on more than one MIPS board. Instead, we just depend on MIPS being set. Signed-off-by: Paul Cercueil Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20191023174714.14362-3-paul@crapouillou.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6d532143c915b3525a64a5d23b21c1a4a0c515b1 Author: Paul Cercueil Date: Wed Oct 23 19:47:13 2019 +0200 watchdog: jz4740: Use regmap provided by TCU driver Since we broke the ABI by changing the clock, the driver was also updated to use the regmap provided by the TCU driver. Signed-off-by: Paul Cercueil Tested-by: Mathieu Malaterre Tested-by: Artur Rojek Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20191023174714.14362-2-paul@crapouillou.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 1d9c30745455c42bff07f500fc6ecaf4c10e942f Author: Paul Cercueil Date: Wed Oct 23 19:47:12 2019 +0200 watchdog: jz4740: Use WDT clock provided by TCU driver Instead of requesting the "ext" clock and handling the watchdog clock divider and gating in the watchdog driver, we now request and use the "wdt" clock that is supplied by the ingenic-timer "TCU" driver. The major benefit is that the watchdog's clock rate and parent can now be specified from within devicetree, instead of hardcoded in the driver. Also, this driver won't poke anymore into the TCU registers to enable/disable the clock, as this is now handled by the TCU driver. On the bad side, we break the ABI with devicetree - as we now request a different clock. In this very specific case it is still okay, as every Ingenic JZ47xx-based board out there compile the devicetree within the kernel; so it's still time to push breaking changes, in order to get a clean devicetree that won't break once it musn't. Signed-off-by: Paul Cercueil Tested-by: Mathieu Malaterre Tested-by: Artur Rojek Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20191023174714.14362-1-paul@crapouillou.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 74f078c333e96f0c2d7fe8d932773d39aceeca12 Author: Eugen Hristev Date: Mon Nov 18 08:50:33 2019 +0000 dt-bindings: watchdog: sama5d4_wdt: add microchip,sam9x60-wdt compatible The Atmel sama5d4_wdt needs to be compatible with microchip,sam9x60-wdt The sama5d4_wdt driver is updated to work with both hardware blocks (sama5d4/sama5d2 and sam9x60 based blocks) Signed-off-by: Eugen Hristev Acked-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1573806579-7981-2-git-send-email-eugen.hristev@microchip.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d615a6fd12b2f3cbc68f85bacafecde704b0d805 Author: Eugen Hristev Date: Mon Nov 18 08:50:31 2019 +0000 watchdog: sama5d4_wdt: cleanup the bit definitions Cleanup the macro definitions to use BIT and align with two spaces. Signed-off-by: Eugen Hristev Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1573806579-7981-1-git-send-email-eugen.hristev@microchip.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 3e1740993e43116b3bc71b0aad1e6872f6ccf341 Author: Josef Bacik Date: Fri Nov 15 15:43:06 2019 -0500 btrfs: record all roots for rename exchange on a subvol Testing with the new fsstress support for subvolumes uncovered a pretty bad problem with rename exchange on subvolumes. We're modifying two different subvolumes, but we only start the transaction on one of them, so the other one is not added to the dirty root list. This is caught by btrfs_cow_block() with a warning because the root has not been updated, however if we do not modify this root again we'll end up pointing at an invalid root because the root item is never updated. Fix this by making sure we add the destination root to the trans list, the same as we do with normal renames. This fixes the corruption. Fixes: cdd1fedf8261 ("btrfs: add support for RENAME_EXCHANGE and RENAME_WHITEOUT") CC: stable@vger.kernel.org # 4.9+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 39e68d9e7ab276880980ee5386301fb218202192 Author: Shuiqing Li Date: Fri Nov 8 18:57:12 2019 +0800 watchdog: sprd: Fix the incorrect pointer getting from driver data The device driver data saved the 'struct sprd_wdt' object, it is incorrect to get 'struct watchdog_device' object from the driver data, thus fix it. Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver") Reported-by: Dongwei Wang Signed-off-by: Shuiqing Li Signed-off-by: Baolin Wang Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/76d4687189ec940baa90cb8d679a8d4c8f02ee80.1573210405.git.baolin.wang@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c04571251b3d842096f1597f5d4badb508be016d Author: Joel Stanley Date: Fri Nov 8 13:59:05 2019 +1030 watchdog: aspeed: Fix clock behaviour for ast2600 The ast2600 no longer uses bit 4 in the control register to indicate a 1MHz clock (It now controls whether this watchdog is reset by a SOC reset). This means we do not want to set it. It also does not need to be set for the ast2500, as it is read-only on that SoC. The comment next to the clock rate selection wandered away from where it was set, so put it back next to the register setting it's describing. Fixes: b3528b487448 ("watchdog: aspeed: Add support for AST2600") Signed-off-by: Joel Stanley Reviewed-by: Cédric Le Goater Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191108032905.22463-1-joel@jms.id.au Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6083ab7b2f3f25022e2e8f4c42f14a8521f47873 Author: Fabio Estevam Date: Tue Oct 29 14:40:33 2019 -0300 watchdog: imx7ulp: Fix reboot hang The following hang is observed when a 'reboot' command is issued: # reboot # Stopping network: OK Stopping klogd: OK Stopping syslogd: OK umount: devtmpfs busy - remounted read-only [ 8.612079] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null) The system is going down NOW! Sent SIGTERM to all processes Sent SIGKILL to all processes Requesting system reboot [ 10.694753] reboot: Restarting system [ 11.699008] Reboot failed -- System halted Fix this problem by adding a .restart ops member. Fixes: 41b630f41bf7 ("watchdog: Add i.MX7ULP watchdog support") Signed-off-by: Fabio Estevam Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191029174037.25381-1-festevam@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit bc44fa734cef28e7ddb26bbf9e75e7f7449c9db2 Author: Rasmus Villemoes Date: Tue Nov 5 21:51:18 2019 +0100 watchdog: make nowayout sysfs file writable It can be useful to delay setting the nowayout feature for a watchdog device. Moreover, not every driver (notably gpio_wdt) implements a nowayout module parameter/otherwise respects CONFIG_WATCHDOG_NOWAYOUT, and modifying those drivers carries a risk of causing a regression for someone who has two watchdog devices, sets CONFIG_WATCHDOG_NOWAYOUT and somehow relies on the gpio_wdt driver being ignorant of that (i.e., allowing one to gracefully close a gpio_wdt but not the other watchdog in the system). So instead, simply make the nowayout sysfs file writable. Obviously, setting nowayout is a one-way street. Signed-off-by: Rasmus Villemoes Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191105205118.11359-1-linux@rasmusvillemoes.dk Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a19f89335f4bda3d77d991c96583e3e51856acbb Author: Julia Cartwright Date: Tue Nov 5 15:45:06 2019 +0100 watchdog: prevent deferral of watchdogd wakeup on RT When PREEMPT_RT is enabled, all hrtimer expiry functions are deferred for execution into the context of ksoftirqd unless otherwise annotated. Deferring the expiry of the hrtimer used by the watchdog core, however, is a waste, as the callback does nothing but queue a kthread work item and wakeup watchdogd. It's worst then that, too: the deferral through ksoftirqd also means that for correct behavior a user must adjust the scheduling parameters of both watchdogd _and_ ksoftirqd, which is unnecessary and has other side effects (like causing unrelated expiry functions to execute at potentially elevated priority). Instead, mark the hrtimer used by the watchdog core as being _HARD to allow it's execution directly from hardirq context. The work done in this expiry function is well-bounded and minimal. A user still must adjust the scheduling parameters of the watchdogd to be correct w.r.t. their application needs. Link: https://lkml.kernel.org/r/0e02d8327aeca344096c246713033887bc490dd7.1538089180.git.julia@ni.com Cc: Guenter Roeck Reported-and-tested-by: Steffen Trumtrar Reported-by: Tim Sander Signed-off-by: Julia Cartwright Acked-by: Guenter Roeck [bigeasy: use only HRTIMER_MODE_REL_HARD] Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191105144506.clyadjbvnn7b7b2m@linutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit eccb7fe5e72a88455b13c77bc3bc381dbb45bd9a Author: Fabio Estevam Date: Tue Oct 29 14:40:37 2019 -0300 watchdog: imx7ulp: Use definitions instead of magic values Use definitions instead of magic values in order to improve readability. Since the CLK field of the WDOG CS register is composed of two bits to select the watchdog clock source, use a shift representation instead of BIT(). Signed-off-by: Fabio Estevam Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191029174037.25381-5-festevam@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c37e358163d97d7e0f19e495c3dc374b4d08e797 Author: Fabio Estevam Date: Tue Oct 29 14:40:36 2019 -0300 watchdog: imx7ulp: Remove inline annotations Compiler is smart enough and knows when to inline, so there is no need to mark some of these functions as 'inline'. Remove such annotations. Signed-off-by: Fabio Estevam Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191029174037.25381-4-festevam@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9ab26e34bb62a304f1b7d83577d8e17f169b1cf7 Author: Fabio Estevam Date: Tue Oct 29 14:40:35 2019 -0300 watchdog: imx7ulp: Remove unused structure member The 'notifier_block' structure member is unused, so just remove it. Signed-off-by: Fabio Estevam Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191029174037.25381-3-festevam@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 747d88a1a88c1bfd0063ae01aa50bfa9e8ecb355 Author: Fabio Estevam Date: Tue Oct 29 14:40:34 2019 -0300 watchdog: imx7ulp: Pass the wdog instance inimx7ulp_wdt_enable() It is more natural to pass the watchdog instance inside imx7ulp_wdt_enable() instead of the base address. This also has the benefit to reduce the code a bit. Signed-off-by: Fabio Estevam Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191029174037.25381-2-festevam@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 4c0bfc039c8882cd6974c1c9fbf0596cdd58d2a6 Author: Geert Uytterhoeven Date: Thu Oct 24 17:28:56 2019 +0200 watchdog: wdat_wdt: Spelling s/configrable/configurable/ Fix misspelling of "configurable". Signed-off-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191024152856.30788-1-geert+renesas@glider.be Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 5b256b56885abfb5bfd6faf32c164ee26247b162 Author: Matti Vaittinen Date: Thu Oct 10 09:07:33 2019 +0300 watchdog: bd70528: Trivial function documentation fix The function documentation for the exported ROHM BD70528 WDG control functions used old argument names. Fix the names. Signed-off-by: Matti Vaittinen Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191010060733.GA9979@localhost.localdomain Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ef14cab2d85be583d5adeea96ae72ef329a2a62d Author: Michal Simek Date: Tue Oct 8 16:29:10 2019 +0200 watchdog: cadence: Do not show error in case of deferred probe There is no reason to show error message if clocks are not ready yet. Signed-off-by: Michal Simek Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/d3e295d5ba79f453b4aa4128c4fa63fbd6c16920.1570544944.git.michal.simek@xilinx.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 72139dfa2464e43957d330266994740bb7be2535 Author: Kevin Hao Date: Tue Oct 8 19:29:34 2019 +0800 watchdog: Fix the race between the release of watchdog_core_data and cdev The struct cdev is embedded in the struct watchdog_core_data. In the current code, we manage the watchdog_core_data with a kref, but the cdev is manged by a kobject. There is no any relationship between this kref and kobject. So it is possible that the watchdog_core_data is freed before the cdev is entirely released. We can easily get the following call trace with CONFIG_DEBUG_KOBJECT_RELEASE and CONFIG_DEBUG_OBJECTS_TIMERS enabled. ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x38 WARNING: CPU: 23 PID: 1028 at lib/debugobjects.c:481 debug_print_object+0xb0/0xf0 Modules linked in: softdog(-) deflate ctr twofish_generic twofish_common camellia_generic serpent_generic blowfish_generic blowfish_common cast5_generic cast_common cmac xcbc af_key sch_fq_codel openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 CPU: 23 PID: 1028 Comm: modprobe Not tainted 5.3.0-next-20190924-yoctodev-standard+ #180 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 00400009 (nzcv daif +PAN -UAO) pc : debug_print_object+0xb0/0xf0 lr : debug_print_object+0xb0/0xf0 sp : ffff80001cbcfc70 x29: ffff80001cbcfc70 x28: ffff800010ea2128 x27: ffff800010bad000 x26: 0000000000000000 x25: ffff80001103c640 x24: ffff80001107b268 x23: ffff800010bad9e8 x22: ffff800010ea2128 x21: ffff000bc2c62af8 x20: ffff80001103c600 x19: ffff800010e867d8 x18: 0000000000000060 x17: 0000000000000000 x16: 0000000000000000 x15: ffff000bd7240470 x14: 6e6968207473696c x13: 5f72656d6974203a x12: 6570797420746365 x11: 6a626f2029302065 x10: 7461747320657669 x9 : 7463612820657669 x8 : 3378302f3078302b x7 : 0000000000001d7a x6 : ffff800010fd5889 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff000bff948548 x1 : 276a1c9e1edc2300 x0 : 0000000000000000 Call trace: debug_print_object+0xb0/0xf0 debug_check_no_obj_freed+0x1e8/0x210 kfree+0x1b8/0x368 watchdog_cdev_unregister+0x88/0xc8 watchdog_dev_unregister+0x38/0x48 watchdog_unregister_device+0xa8/0x100 softdog_exit+0x18/0xfec4 [softdog] __arm64_sys_delete_module+0x174/0x200 el0_svc_handler+0xd0/0x1c8 el0_svc+0x8/0xc This is a common issue when using cdev embedded in a struct. Fortunately, we already have a mechanism to solve this kind of issue. Please see commit 233ed09d7fda ("chardev: add helper function to register char devs with a struct device") for more detail. In this patch, we choose to embed the struct device into the watchdog_core_data, and use the API provided by the commit 233ed09d7fda to make sure that the release of watchdog_core_data and cdev are in sequence. Signed-off-by: Kevin Hao Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20191008112934.29669-1-haokexin@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b6276d4e4bc3d74b37a918c231b19622f9f194a7 Author: Borislav Petkov Date: Sun Sep 29 13:46:49 2019 +0200 watchdog: sbc7240_wdt: Fix yet another -Wimplicit-fallthrough warning ... by moving the fall through comment outside of the code block so that gcc sees it. No functional changes. Signed-off-by: Borislav Petkov Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: linux-watchdog@vger.kernel.org Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20190929114649.22740-1-bp@alien8.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ff0aaacb6f26e72f6eb9220eb3b479ffb46b592d Author: Andy Shevchenko Date: Tue Sep 24 17:31:16 2019 +0300 watchdog: intel-mid_wdt: Add WATCHDOG_NOWAYOUT support Normally, the watchdog is disabled when /dev/watchdog is closed, but if CONFIG_WATCHDOG_NOWAYOUT is defined, then it means that the watchdog should remain enabled. So we should keep it enabled if CONFIG_WATCHDOG_NOWAYOUT is defined. Reported-by: Razvan Becheriu Cc: Ferry Toth Signed-off-by: Andy Shevchenko Reviewed-by: Guenter Roeck Tested-by: Razvan Becheriu Link: https://lore.kernel.org/r/20190924143116.69823-1-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 86865322d227c82dd6edc5970d5b554a391fb2eb Author: Anson Huang Date: Tue Sep 24 15:07:08 2019 +0800 watchdog: imx2_wdt: Use 'dev' instead of dereferencing it repeatedly Add helper variable dev = &pdev->dev to simply the code. Signed-off-by: Anson Huang Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1569308828-8320-3-git-send-email-Anson.Huang@nxp.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ebe66ded6d4cdf6fb48d8fec56c73acc631953e8 Author: Anson Huang Date: Tue Sep 24 15:07:07 2019 +0800 watchdog: imx2_wdt: Use __maybe_unused instead of #if CONFIG_PM_SLEEP Use __maybe_unused for power management related functions instead of #if CONFIG_PM_SLEEP to simply the code. Signed-off-by: Anson Huang Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1569308828-8320-1-git-send-email-Anson.Huang@nxp.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 87d184680dd8b12fe1347c0fb040e30b8cc6a9c8 Author: Anson Huang Date: Tue Sep 24 15:07:06 2019 +0800 watchdog: imx2_wdt: Remove unnecessary blank line Remove unnecessary blank line. Signed-off-by: Anson Huang Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/1569308828-8320-1-git-send-email-Anson.Huang@nxp.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e11cfc697601fe80b308fe9162649ab294013c32 Author: Srikanth Krishnakar Date: Wed Sep 18 19:12:15 2019 +0530 watchdog: w83627hf_wdt: Support NCT6116D The watchdog controller on NCT6116D is compatible with NCT6102D. Extend the support to enable SuperIO based NCT6116D watchdog device. Signed-off-by: Srikanth Krishnakar Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20190918160458.10108-1-Srikanth_Krishnakar@mentor.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 55ed51fff224a51dfb768cfac3e4498888474c87 Author: Sudip Mukherjee Date: Sun Nov 17 20:24:35 2019 +0000 {tty: serial, nand: onenand}: samsung: rename to fix build warning Any arm config which has 'CONFIG_MTD_ONENAND_SAMSUNG=m' and 'CONFIG_SERIAL_SAMSUNG=m' gives a build warning: warning: same module names found: drivers/tty/serial/samsung.ko drivers/mtd/nand/onenand/samsung.ko Rename both drivers/tty/serial/samsung.c to drivers/tty/serial/samsung_tty.c and drivers/mtd/nand/onenand/samsung.c drivers/mtd/nand/onenand/samsung_mtd.c to fix the warning. Signed-off-by: Sudip Mukherjee Acked-by: Richard Weinberger Link: https://lore.kernel.org/r/20191117202435.28127-1-sudipm.mukherjee@gmail.com Signed-off-by: Greg Kroah-Hartman commit ae7c2d342a10dbef1e054482f46498b6282a1df0 Author: Luhua Xu Date: Mon Nov 18 12:57:16 2019 +0800 spi: mediatek: add SPI_CS_HIGH support Change to use SPI_CS_HIGH to support spi CS polarity setting for chips support enhance_timing. Signed-off-by: Luhua Xu Link: https://lore.kernel.org/r/1574053037-26721-2-git-send-email-luhua.xu@mediatek.com Signed-off-by: Mark Brown commit 042528f8d840f42903d91d47e28c0e29da90c2d6 Author: Filipe Manana Date: Thu Nov 14 18:02:43 2019 +0000 Btrfs: fix block group remaining RO forever after error during device replace When doing a device replace, while at scrub.c:scrub_enumerate_chunks(), we set the block group to RO mode and then wait for any ongoing writes into extents of the block group to complete. While doing that wait we overwrite the value of the variable 'ret' and can break out of the loop if an error happens without turning the block group back into RW mode. So what happens is the following: 1) btrfs_inc_block_group_ro() returns 0, meaning it set the block group to RO mode (its ->ro field set to 1 or incremented to some value > 1); 2) Then btrfs_wait_ordered_roots() returns a value > 0; 3) Then if either joining or committing the transaction fails, we break out of the loop wihtout calling btrfs_dec_block_group_ro(), leaving the block group in RO mode forever. To fix this, just remove the code that waits for ongoing writes to extents of the block group, since it's not needed because in the initial setup phase of a device replace operation, before starting to find all chunks and their extents, we set the target device for replace while holding fs_info->dev_replace->rwsem, which ensures that after releasing that semaphore, any writes into the source device are made to the target device as well (__btrfs_map_block() guarantees that). So while at scrub_enumerate_chunks() we only need to worry about finding and copying extents (from the source device to the target device) that were written before we started the device replace operation. Fixes: f0e9b7d6401959 ("Btrfs: fix race setting block group readonly during device replace") Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit b12de52896c0e8213f70e3a168fde9e6eee95909 Author: Qu Wenruo Date: Fri Nov 15 10:09:00 2019 +0800 btrfs: scrub: Don't check free space before marking a block group RO [BUG] When running btrfs/072 with only one online CPU, it has a pretty high chance to fail: btrfs/072 12s ... _check_dmesg: something found in dmesg (see xfstests-dev/results//btrfs/072.dmesg) - output mismatch (see xfstests-dev/results//btrfs/072.out.bad) --- tests/btrfs/072.out 2019-10-22 15:18:14.008965340 +0800 +++ /xfstests-dev/results//btrfs/072.out.bad 2019-11-14 15:56:45.877152240 +0800 @@ -1,2 +1,3 @@ QA output created by 072 Silence is golden +Scrub find errors in "-m dup -d single" test ... And with the following call trace: BTRFS info (device dm-5): scrub: started on devid 1 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -27) WARNING: CPU: 0 PID: 55087 at fs/btrfs/block-group.c:1890 btrfs_create_pending_block_groups+0x3e6/0x470 [btrfs] CPU: 0 PID: 55087 Comm: btrfs Tainted: G W O 5.4.0-rc1-custom+ #13 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:btrfs_create_pending_block_groups+0x3e6/0x470 [btrfs] Call Trace: __btrfs_end_transaction+0xdb/0x310 [btrfs] btrfs_end_transaction+0x10/0x20 [btrfs] btrfs_inc_block_group_ro+0x1c9/0x210 [btrfs] scrub_enumerate_chunks+0x264/0x940 [btrfs] btrfs_scrub_dev+0x45c/0x8f0 [btrfs] btrfs_ioctl+0x31a1/0x3fb0 [btrfs] do_vfs_ioctl+0x636/0xaa0 ksys_ioctl+0x67/0x90 __x64_sys_ioctl+0x43/0x50 do_syscall_64+0x79/0xe0 entry_SYSCALL_64_after_hwframe+0x49/0xbe ---[ end trace 166c865cec7688e7 ]--- [CAUSE] The error number -27 is -EFBIG, returned from the following call chain: btrfs_end_transaction() |- __btrfs_end_transaction() |- btrfs_create_pending_block_groups() |- btrfs_finish_chunk_alloc() |- btrfs_add_system_chunk() This happens because we have used up all space of btrfs_super_block::sys_chunk_array. The root cause is, we have the following bad loop of creating tons of system chunks: 1. The only SYSTEM chunk is being scrubbed It's very common to have only one SYSTEM chunk. 2. New SYSTEM bg will be allocated As btrfs_inc_block_group_ro() will check if we have enough space after marking current bg RO. If not, then allocate a new chunk. 3. New SYSTEM bg is still empty, will be reclaimed During the reclaim, we will mark it RO again. 4. That newly allocated empty SYSTEM bg get scrubbed We go back to step 2, as the bg is already mark RO but still not cleaned up yet. If the cleaner kthread doesn't get executed fast enough (e.g. only one CPU), then we will get more and more empty SYSTEM chunks, using up all the space of btrfs_super_block::sys_chunk_array. [FIX] Since scrub/dev-replace doesn't always need to allocate new extent, especially chunk tree extent, so we don't really need to do chunk pre-allocation. To break above spiral, here we introduce a new parameter to btrfs_inc_block_group(), @do_chunk_alloc, which indicates whether we need extra chunk pre-allocation. For relocation, we pass @do_chunk_alloc=true, while for scrub, we pass @do_chunk_alloc=false. This should keep unnecessary empty chunks from popping up for scrub. Also, since there are two parameters for btrfs_inc_block_group_ro(), add more comment for it. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 7f0432d0d8dc1d29ab5276805d648c5b0a408105 Author: Johannes Thumshirn Date: Wed Nov 13 11:27:28 2019 +0100 btrfs: change btrfs_fs_devices::rotating to bool struct btrfs_fs_devices::rotating currently is declared as an integer variable but only used as a boolean. Change the variable definition to bool and update to code touching it to set 'true' and 'false'. Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0395d84f8edc6c28ce270e6eda5c7e6ff4c18545 Author: Johannes Thumshirn Date: Wed Nov 13 11:27:27 2019 +0100 btrfs: change btrfs_fs_devices::seeding to bool struct btrfs_fs_devices::seeding currently is declared as an integer variable but only used as a boolean. Change the variable definition to bool and update to code touching it to set 'true' and 'false'. Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 32da5386d9a4fd5c1155cecf703df104d918954c Author: David Sterba Date: Tue Oct 29 19:20:18 2019 +0100 btrfs: rename btrfs_block_group_cache The type name is misleading, a single entry is named 'cache' while this normally means a collection of objects. Rename that everywhere. Also the identifier was quite long, making function prototypes harder to format. Suggested-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit d49a2ddb1568d533ef3b77841a3ea1ff5bfa8b98 Author: Qu Wenruo Date: Tue Nov 5 09:35:35 2019 +0800 btrfs: block-group: Reuse the item key from caller of read_one_block_group() For read_one_block_group(), its only caller has already got the item key to search next block group item. So we can use that key directly without doing our own convertion on stack. Also, since that key used in btrfs_read_block_groups() is vital for block group item search, add 'const' keyword for that parameter to prevent read_one_block_group() to modify it. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit ffb9e0f05fab5f7fe62c5d6964825e59e91be0db Author: Qu Wenruo Date: Thu Oct 10 10:39:27 2019 +0800 btrfs: block-group: Refactor btrfs_read_block_groups() Refactor the work inside the loop of btrfs_read_block_groups() into one separate function, read_one_block_group(). This allows read_one_block_group to be reused for later BG_TREE feature. The refactor does the following extra fix: - Use btrfs_fs_incompat() to replace open-coded feature check Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit d4e253bbbc2036219807b07f6258027fc443670c Author: David Sterba Date: Wed Oct 16 18:29:10 2019 +0200 btrfs: document extent buffer locking Signed-off-by: David Sterba commit a4477988cfed18bdf1ad04d29b4b4a3c53269dfc Author: David Sterba Date: Fri Oct 11 00:03:14 2019 +0200 btrfs: access eb::blocking_writers according to ACCESS_ONCE policies A nice writeup of the LKMM (Linux Kernel Memory Model) rules for access once policies can be found here https://lwn.net/Articles/799218/#Access-Marking%20Policies . The locked and unlocked access to eb::blocking_writers should be annotated accordingly, following this: Writes: - locked write must use ONCE, may use plain read - unlocked write must use ONCE Reads: - unlocked read must use ONCE - locked read may use plain read iff not mixed with unlocked read - unlocked read then locked must use ONCE There's one difference on the assembly level, where btrfs_tree_read_lock_atomic and btrfs_try_tree_read_lock used the cached value and did not reevaluate it after taking the lock. This could have missed some opportunities to take the lock in case blocking writers changed between the calls, but the window is just a few instructions long. As this is in try-lock, the callers handle that. Signed-off-by: David Sterba commit 40d38f53d476238594c24c677593913695e6dec7 Author: David Sterba Date: Thu Oct 10 23:31:19 2019 +0200 btrfs: set blocking_writers directly, no increment or decrement The increment and decrement was inherited from previous version that used atomics, switched in commit 06297d8cefca ("btrfs: switch extent_buffer blocking_writers from atomic to int"). The only possible values are 0 and 1 so we can set them directly. The generated assembly (gcc 9.x) did the direct value assignment in btrfs_set_lock_blocking_write (asm diff after change in 06297d8cefca): 5d: test %eax,%eax 5f: je 62 61: retq - 62: lock incl 0x44(%rdi) - 66: add $0x50,%rdi - 6a: jmpq 6f + 62: movl $0x1,0x44(%rdi) + 69: add $0x50,%rdi + 6d: jmpq 72 The part in btrfs_tree_unlock did a decrement because BUG_ON(blockers > 1) is probably not a strong hint for the compiler, but otherwise the output looks safe: - lock decl 0x44(%rdi) + sub $0x1,%eax + mov %eax,0x44(%rdi) Signed-off-by: David Sterba commit f5c2a52590858d18f4a736d8062fe70f11988fa9 Author: David Sterba Date: Thu Oct 10 23:29:21 2019 +0200 btrfs: merge blocking_writers branches in btrfs_tree_read_lock There are two ifs that use eb::blocking_writers. As this is a variable modified inside and outside of locks, we could minimize number of accesses to avoid problems with getting different results at different times. The access here is locked so this can only race with btrfs_tree_unlock that sets blocking_writers to 0 without lock and unsets the lock owner. The first branch is taken only if the same thread already holds the lock, the second if checks for blocking writers. Here we'd either unlock and wait, or proceed. Both are valid states of the locking protocol. Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit 9c907446dce311dc7e7b8958425e92ac03d3d00c Author: David Sterba Date: Thu Oct 31 15:52:01 2019 +0100 btrfs: drop incompat bit for raid1c34 after last block group is gone When there are no raid1c3 or raid1c4 block groups left after balance (either convert or with other filters applied), remove the incompat bit. This is already done for RAID56, do the same for RAID1C34. Signed-off-by: David Sterba commit cfbb825c76198c9095428c5f9362fbf6ae06f417 Author: David Sterba Date: Tue Jul 10 18:15:05 2018 +0200 btrfs: add incompat for raid1 with 3, 4 copies The new raid1c3 and raid1c4 profiles are backward incompatible and the name shall be 'raid1c34', the status can be found in the global supported features in /sys/fs/btrfs/features or in the per-filesystem directory. Signed-off-by: David Sterba commit 8d6fac0087e538173f34ca7431ed9b58581acf28 Author: David Sterba Date: Fri Mar 2 22:56:53 2018 +0100 btrfs: add support for 4-copy replication (raid1c4) Add new block group profile to store 4 copies in a simliar way that current RAID1 does. The profile attributes and constraints are defined in the raid table and used by the same code that already handles the 2- and 3-copy RAID1. The minimum number of devices is 4, the maximum number of devices/chunks that can be lost/damaged is 3. There is no comparable traditional RAID level, the profile is added for future needs to accompany triple-parity and beyond. Signed-off-by: David Sterba commit 47e6f7423b9196ad6832d26cae52b7015f81ee7f Author: David Sterba Date: Fri Mar 2 22:56:53 2018 +0100 btrfs: add support for 3-copy replication (raid1c3) Add new block group profile to store 3 copies in a simliar way that current RAID1 does. The profile attributes and constraints are defined in the raid table and used by the same code that already handles the 2-copy RAID1. The minimum number of devices is 3, the maximum number of devices/chunks that can be lost/damaged is 2. Like RAID6 but with 33% space utilization. Signed-off-by: David Sterba commit fac07d2b091542f7169978e4c1413747d8d0e965 Author: David Sterba Date: Tue Oct 29 18:28:57 2019 +0100 btrfs: sink write flags to cow_file_range_async In commit "Btrfs: use REQ_CGROUP_PUNT for worker thread submitted bios", cow_file_range_async gained wbc as a parameter and this makes passing write flags redundant. Set it inside the function and remove the parameter. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 57e5ffeb8779a49202d48fb890f9d04fa0273c1e Author: David Sterba Date: Tue Oct 29 18:28:55 2019 +0100 btrfs: sink write_flags to __extent_writepage_io __extent_writepage reads write flags from wbc and passes both to __extent_writepage_io. This makes write_flags redundant and we can remove it. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit fd0ddbe2509568b00df364156f47561e9f469f15 Author: Filipe Manana Date: Wed Oct 30 12:23:01 2019 +0000 Btrfs: send, skip backreference walking for extents with many references Backreference walking, which is used by send to figure if it can issue clone operations instead of write operations, can be very slow and use too much memory when extents have many references. This change simply skips backreference walking when an extent has more than 64 references, in which case we fallback to a write operation instead of a clone operation. This limit is conservative and in practice I observed no signicant slowdown with up to 100 references and still low memory usage up to that limit. This is a temporary workaround until there are speedups in the backref walking code, and as such it does not attempt to add extra interfaces or knobs to tweak the threshold. Reported-by: Atemu Link: https://lore.kernel.org/linux-btrfs/CAE4GHgkvqVADtS4AzcQJxo0Q1jKQgKaW3JGp3SGdoinVo=C9eQ@mail.gmail.com/T/#me55dc0987f9cc2acaa54372ce0492c65782be3fa CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 11f2069c113e02971b8db6fda62f9b9cd31a030f Author: Filipe Manana Date: Wed Oct 30 12:23:11 2019 +0000 Btrfs: send, allow clone operations within the same file For send we currently skip clone operations when the source and destination files are the same. This is so because clone didn't support this case in its early days, but support for it was added back in May 2013 by commit a96fbc72884fcb ("Btrfs: allow file data clone within a file"). This change adds support for it. Example: $ mkfs.btrfs -f /dev/sdd $ mount /dev/sdd /mnt/sdd $ xfs_io -f -c "pwrite -S 0xab -b 64K 0 64K" /mnt/sdd/foobar $ xfs_io -c "reflink /mnt/sdd/foobar 0 64K 64K" /mnt/sdd/foobar $ btrfs subvolume snapshot -r /mnt/sdd /mnt/sdd/snap $ mkfs.btrfs -f /dev/sde $ mount /dev/sde /mnt/sde $ btrfs send /mnt/sdd/snap | btrfs receive /mnt/sde Without this change file foobar at the destination has a single 128Kb extent: $ filefrag -v /mnt/sde/snap/foobar Filesystem type is: 9123683e File size of /mnt/sde/snap/foobar is 131072 (32 blocks of 4096 bytes) ext: logical_offset: physical_offset: length: expected: flags: 0: 0.. 31: 0.. 31: 32: last,unknown_loc,delalloc,eof /mnt/sde/snap/foobar: 1 extent found With this we get a single 64Kb extent that is shared at file offsets 0 and 64K, just like in the source filesystem: $ filefrag -v /mnt/sde/snap/foobar Filesystem type is: 9123683e File size of /mnt/sde/snap/foobar is 131072 (32 blocks of 4096 bytes) ext: logical_offset: physical_offset: length: expected: flags: 0: 0.. 15: 3328.. 3343: 16: shared 1: 16.. 31: 3328.. 3343: 16: 3344: last,shared,eof /mnt/sde/snap/foobar: 2 extents found Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6b7faadd985c990324b5b5bd18cc4ba5c395eb65 Author: Qu Wenruo Date: Wed Oct 23 21:57:27 2019 +0800 btrfs: Ensure we trim ranges across block group boundary [BUG] When deleting large files (which cross block group boundary) with discard mount option, we find some btrfs_discard_extent() calls only trimmed part of its space, not the whole range: btrfs_discard_extent: type=0x1 start=19626196992 len=2144530432 trimmed=1073741824 ratio=50% type: bbio->map_type, in above case, it's SINGLE DATA. start: Logical address of this trim len: Logical length of this trim trimmed: Physically trimmed bytes ratio: trimmed / len Thus leaving some unused space not discarded. [CAUSE] When discard mount option is specified, after a transaction is fully committed (super block written to disk), we begin to cleanup pinned extents in the following call chain: btrfs_commit_transaction() |- btrfs_finish_extent_commit() |- find_first_extent_bit(unpin, 0, &start, &end, EXTENT_DIRTY); |- btrfs_discard_extent() However, pinned extents are recorded in an extent_io_tree, which can merge adjacent extent states. When a large file gets deleted and it has adjacent file extents across block group boundary, we will get a large merged range like this: |<--- BG1 --->|<--- BG2 --->| |//////|<-- Range to discard --->|/////| To discard that range, we have the following calls: btrfs_discard_extent() |- btrfs_map_block() | Returned bbio will end at BG1's end. As btrfs_map_block() | never returns result across block group boundary. |- btrfs_issuse_discard() Issue discard for each stripe. So we will only discard the range in BG1, not the remaining part in BG2. Furthermore, this bug is not that reliably observed, for above case, if there is no other extent in BG2, BG2 will be empty and btrfs will trim all space of BG2, covering up the bug. [FIX] - Allow __btrfs_map_block_for_discard() to modify @length parameter btrfs_map_block() uses its @length paramter to notify the caller how many bytes are mapped in current call. With __btrfs_map_block_for_discard() also modifing the @length, btrfs_discard_extent() now understands when to do extra trim. - Call btrfs_map_block() in a loop until we hit the range end Since we now know how many bytes are mapped each time, we can iterate through each block group boundary and issue correct trim for each range. Reviewed-by: Filipe Manana Reviewed-by: Nikolay Borisov Tested-by: Nikolay Borisov Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 2d974619a77f106f3d1341686dea95c0eaad601f Author: Qu Wenruo Date: Wed Oct 23 21:57:26 2019 +0800 btrfs: volumes: Use more straightforward way to calculate map length The old code goes: offset = logical - em->start; length = min_t(u64, em->len - offset, length); Where @length calculation is dependent on offset, it can take reader several more seconds to find it's just the same code as: offset = logical - em->start; length = min_t(u64, em->start + em->len - logical, length); Use above code to make the length calculate independent from other variable, thus slightly increase the readability. Reviewed-by: Johannes Thumshirn Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 153a6d299956983de890ffaf429e5904503eb94c Author: Qu Wenruo Date: Tue Sep 3 07:46:19 2019 +0800 btrfs: tree-checker: Check item size before reading file extent type In check_extent_data_item(), we read file extent type without verifying if the item size is valid. Add such check to ensure the file extent type we read is correct. The check is not as accurate as we need to cover both inline and regular extents, so it only checks if the item size is larger or equal to inline header. So the existing size checks on inline/regular extents are still needed. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3ec17a67cc340b7b0353d7ac6d2746dcf8983b43 Author: Dan Carpenter Date: Thu Oct 31 13:55:01 2019 +0300 btrfs: clean up locking name in scrub_enumerate_chunks() The "&fs_info->dev_replace.rwsem" and "&dev_replace->rwsem" refer to the same lock but Smatch is not clever enough to figure that out so it leads to static checker warnings. It's better to use it consistently anyway. Signed-off-by: Dan Carpenter Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6ef108dd0cda65d3031166222e64cdf71fdd3359 Author: Nikolay Borisov Date: Tue Oct 15 18:42:24 2019 +0300 btrfs: Streamline btrfs_fs_info::backup_root_index semantics The backup_root_index member stores the index at which the backup root should be saved upon next transaction commit. However, there is a small deviation from this behavior in the form of a check in backup_super_roots which checks if current root generation equals to the generation of the previous root. This can trigger in the following scenario: slot0: gen-2 slot1: gen-1 slot2: gen slot3: unused Now suppose slot3 (which is also the root specified in the super block) is corrupted hence init_tree_roots chooses to use the backup root at slot2, meaning read_backup_root will read slot2 and assign the superblock generation to gen-1. Despite this backup_root_index will point at slot3 because its init happens in init_backup_root_slot, long before any parsing of the backup roots occur. Then on next transaction start, gen-1 will be incremented by 1 making the root's generation equal gen. Subsequently, on transaction commit the following check triggers: if (btrfs_backup_tree_root_gen(root_backup) == btrfs_header_generation(info->tree_root->node)) This causes the 'next_backup', which is the index at which the backup is going to be written to, to set to last_backup, which will be slot2. All of this is a very confusing way of expressing the following invariant: Always write a backup root at the index following the last used backup root. This commit streamlines this logic by setting backup_root_index to the next index after the one used for mount. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4ac039ad75df3f5f5f5b2b7439f094ad5bd9dbbe Author: Nikolay Borisov Date: Tue Oct 15 18:42:23 2019 +0300 btrfs: Rename find_oldest_super_backup to init_backup_root_slot The old name name was an awful misnomer because it didn't really find the oldest super backup per-se but rather its slot. For example if we have: slot0: gen - 2 slot1: gen - 1 slot2: gen slot3: empty init_backup_root_slot will return slot3 and not slot0. The new name is more appropriate since the function doesn't care whether there is a valid backup in the returned slot or not. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 260eb11bd42b4b5bcd671a1f8cb7d7b9a3e36b8d Author: Nikolay Borisov Date: Tue Oct 15 18:42:22 2019 +0300 btrfs: Remove unused next_root_backup function This function has been superseded by previous commits and is no longer used so just remove it. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 336a0d8df1d9ec2480dc1790f0d7801c32318d1c Author: Nikolay Borisov Date: Tue Oct 15 18:42:21 2019 +0300 btrfs: Don't use objectid_mutex during mount Since the filesystem is not well formed and no trees are loaded it's pointless holding the objectid_mutex. Just remove its usage. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit b8522a1e5f421e003a8d2a8937eb3a095ce33f5d Author: Nikolay Borisov Date: Tue Oct 15 18:42:20 2019 +0300 btrfs: Factor out tree roots initialization during mount The code responsible for reading and initializing tree roots is scattered in open_ctree among 2 labels, emulating a loop. This is rather confusing to reason about. Instead, factor the code to a new function, init_tree_roots which implements the same logical flow. There are a couple of notable differences, namely: * Instead of using next_backup_root it's using the newly introduced read_backup_root. * If read_backup_root returns an error init_tree_roots propagates the error and there is no special handling of that case e.g. the code jumps straight to 'fail_tree_roots' label. The old code, however, was (erroneously) jumping to 'fail_block_groups' label if next_backup_root did fail, this was unnecessary since the tree roots init logic doesn't modify the state of block groups. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit bd2336b2ac119e65457261528883d9623d41315f Author: Nikolay Borisov Date: Tue Oct 15 18:42:19 2019 +0300 btrfs: Add read_backup_root This function will replace next_root_backup with a much saner/cleaner interface. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit fc2e4c5b3508f4d0ab981be9aa55bfb80bf971d1 Author: Nikolay Borisov Date: Tue Oct 15 18:42:18 2019 +0300 btrfs: Remove newest_gen argument from find_oldest_super_backup It's no longer needed following cleanups around find_newest_backup_root Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 01f0f9da9dc8b4d60921af92bc9329a1eb2fa8e0 Author: Nikolay Borisov Date: Tue Oct 15 18:42:17 2019 +0300 btrfs: Cleanup and simplify find_newest_super_backup Backup roots are always written in a circular manner. By definition we can only ever have 1 backup root whose generation equals to that of the superblock. Hence, the 'if' in the for loop will trigger at most once. This is sufficient to return the newest backup root. Furthermore the newest_gen parameter is always set to the generation of the superblock. This value can be obtained from the fs_info. This patch removes the unnecessary code dealing with the wraparound case and makes 'newest_gen' a local variable. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 16ad3be1752a7b8ea18f0f97e8383fec0e470e7c Author: Filipe Manana Date: Fri Oct 25 10:52:42 2019 +0100 Btrfs: remove unnecessary delalloc mutex for inodes The inode delalloc mutex was added a long time ago by commit f248679e86fea ("Btrfs: add a delalloc mutex to inodes for delalloc reservations"), and the reason for its introduction is not very clear from the change log. It claims it solves bogus warnings from lockdep, however it lacks an example report/warning from lockdep, or any explanation. Since we have enough concurrentcy protection from the locks of the space info and block reserve objects, and such lockdep warnings don't seem to exist anymore (at least on a 5.3 kernel I couldn't get them with fstests, ltp, fs_mark, etc), remove it, simplifying things a bit and decreasing the size of the btrfs_inode structure. With some quick fio tests doing direct IO and mmap writes I couldn't observe any significant performance increase either (direct IO writes that don't increase the file's size don't hold the inode's lock for their entire duration and mmap writes don't hold the inode's lock at all), which are the only type of writes that could see any performance gain due to less serialization. Review feedback from Josef: The problem was taking the i_mutex in mmap, which is how I was protecting delalloc reservations originally. The delalloc mutex didn't come with all of the other dependencies. That's what the lockdep messages were about, removing the lock isn't going to make them appear again. We _had_ to lock around this because we used to do tricks to keep from over-reserving, and if we didn't serialize delalloc reservations we'd end up with ugly accounting problems when we tried to clean things up. However with my recentish changes this isn't the case anymore. Every operation is responsible for reserving its space, and then adding it to the inode. Then cleaning up is straightforward and can't be mucked up by other users. So we no longer need the delalloc mutex to safe us from ourselves. Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit bf2df5aed1c881f79b001ee19642e386bcda6d80 Author: Filipe Manana Date: Fri Oct 25 10:53:12 2019 +0100 Btrfs: remove wait queue from space_info structure It is not used anymore since commit 957780eb2788d8 ("Btrfs: introduce ticketed enospc infrastructure"), so just remove it. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f5389f330d6f28d648c51624f059b0bfdd9b1806 Author: Johannes Thumshirn Date: Thu Oct 24 17:44:54 2019 +0200 btrfs: remove cached space_info in btrfs_statfs() In btrfs_statfs() we cache fs_info::space_info in a local variable only to use it once in a list_for_each_rcu() statement. Not only is the local variable unnecessary it even makes the code harder to follow as it's not clear which list it is iterating. Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit b3470b5dbe1300dea94191ae4b7d070be9a5cdc9 Author: David Sterba Date: Wed Oct 23 18:48:22 2019 +0200 btrfs: add dedicated members for start and length of a block group The on-disk format of block group item makes use of the key that stores the offset and length. This is further used in the code, although this makes thing harder to understand. The key is also packed so the offset/length is not properly aligned as u64. Add start (key.objectid) and length (key.offset) members to block group and remove the embedded key. When the item is searched or written, a local variable for key is used. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit 0222dfdd4af1be2e70db956db61f9b43386ab76b Author: David Sterba Date: Wed Oct 23 18:48:20 2019 +0200 btrfs: rename extent buffer block group item accessors Accessors defined by BTRFS_SETGET_FUNCS take a raw extent buffer and manipulate the items there, there's no special prefix required. The block group accessors had _disk_ because previously the names were occupied by the on-stack accessors. As this has been addressed in the previous patch, we can now unify the naming. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit de0dc456fd62d387a596508aac1c75736ef6c760 Author: David Sterba Date: Wed Oct 23 18:48:18 2019 +0200 btrfs: rename block_group_item on-stack accessors to follow naming All accessors defined by BTRFS_SETGET_STACK_FUNCS contain _stack_ in the name, the block group ones were not following that scheme, so let's switch them. Signed-off-by: David Sterba commit 3d976388daa9ed77c9d2ded914ad07385b37d97e Author: David Sterba Date: Wed Oct 23 18:48:15 2019 +0200 btrfs: remove embedded block_group_cache::item The members ::used and ::flags are now in the block group cache structure, the last one is chunk_objectid, but that's set to a fixed value and otherwise unused. The item is constructed from a local variable before write, so we can remove the embedded one from block group. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit f93c63e54730428f474267600fa3a901881d2829 Author: David Sterba Date: Wed Oct 23 18:48:13 2019 +0200 btrfs: move block_group_item::flags to block group The flags are read from the item that's embedded to block group struct, but the item will be removed. Use the ::flags after read and before write. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit bf38be65f3703d5ef3661c0a2802bc28e76b8f19 Author: David Sterba Date: Wed Oct 23 18:48:11 2019 +0200 btrfs: move block_group_item::used to block group For unknown reasons, the member 'used' in the block group struct is stored in the b-tree item and accessed everywhere using the special accessor helper. Let's unify it and make it a regular member and only update the item before writing it to the tree. The item is still being used for flags and chunk_objectid, there's some duplication until the item is removed in following patches. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit 34b127aecd4fe8e6a3903e10f204a7b7ffddca22 Author: Qu Wenruo Date: Thu Oct 24 09:38:29 2019 +0800 btrfs: Remove btrfs_bio::flags member The last user of btrfs_bio::flags was removed in commit 326e1dbb5736 ("block: remove management of bi_remaining when restoring original bi_end_io"), remove it. (Tagged for stable as the structure is heavily used and space savings are desirable.) CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 352ae07b599a03b08a2149d9c2ff9c3479591af2 Author: David Sterba Date: Mon Oct 7 11:11:02 2019 +0200 btrfs: add blake2b to checksumming algorithms Add blake2b (with 256 bit digest) to the list of possible checksumming algorithms used by BTRFS. Signed-off-by: David Sterba commit b4e967be431cf37f56cd1993592943007d7ab03b Author: David Sterba Date: Tue Oct 8 18:41:33 2019 +0200 btrfs: add member for a specific checksum driver Currently all the checksum algorithms generate a fixed size digest size and we use it. The on-disk format can hold up to BTRFS_CSUM_SIZE bytes and BLAKE2b produces digest of 512 bits by default. We can't do that and will use the blake2b-256, this needs to be passed to the crypto API. Separate that from the base algorithm name and add a member to request specific driver, in this case with the digest size. The only place that uses the driver name is the crypto API setup. Signed-off-by: David Sterba commit 41e6d2a808ad89d34c662ba8dd1209c4fefb1416 Author: Johannes Thumshirn Date: Mon Oct 7 11:11:04 2019 +0200 btrfs: sysfs: show used checksum driver per filesystem Show the used driver for the checksum algorithm for the filesystem in sysfs file /sys/fs/btrfs/UUID/features/checksum, eg. crc32c (crc32c-generic) Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit f7cea56c0fff95bd5a6cd21b9fa299f66193b604 Author: David Sterba Date: Mon Oct 7 11:11:03 2019 +0200 btrfs: sysfs: export supported checksums Export supported checksum algorithms via sysfs in the list of static features: /sys/fs/btrfs/features/supported_checksums Space spearated list of checksum algorithm names. Co-developed-by: Johannes Thumshirn Signed-off-by: David Sterba commit 3831bf0094abed51e71cbeca8b6edf8b88c2644b Author: Johannes Thumshirn Date: Mon Oct 7 11:11:02 2019 +0200 btrfs: add sha256 to checksumming algorithm Add sha256 to the list of possible checksumming algorithms used by BTRFS. Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3951e7f050ac6a38bbc859fc3cd6093890c31d1c Author: Johannes Thumshirn Date: Mon Oct 7 11:11:01 2019 +0200 btrfs: add xxhash64 to checksumming algorithms Add xxhash64 to the list of possible checksumming algorithms used by BTRFS. Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit c6da429ea988de8f9330405fc405ee32479b5bd5 Author: Revanth Rajashekar Date: Fri Nov 8 16:09:04 2019 -0700 block: sed-opal: Introduce SUM_SET_LIST parameter and append it using 'add_token_u64' In function 'activate_lsp', rather than hard-coding the short atom header(0x83), we need to let the function 'add_short_atom_header' append the header based on the parameter being appended. The parameter has been defined in Section 3.1.2.1 of https://trustedcomputinggroup.org/wp-content/uploads/TCG_Storage-Opal_Feature_Set_Single_User_Mode_v1-00_r1-00-Final.pdf Reviewed-by: Jon Derrick Signed-off-by: Revanth Rajashekar Signed-off-by: Jens Axboe commit 46f9469247c6f4697cbbf37e4b3961120bf07f29 Author: Steven Rostedt (VMware) Date: Mon Nov 18 10:41:29 2019 -0500 ftrace: Rename ftrace_graph_stub to ftrace_stub_graph The ftrace_graph_stub was created and points to ftrace_stub as a way to assign the functon graph tracer function pointer to a stub function with a different prototype than what ftrace_stub has and not trigger the C verifier. The ftrace_graph_stub was created via the linker script vmlinux.lds.h. Unfortunately, powerpc already uses the name ftrace_graph_stub for its internal implementation of the function graph tracer, and even though powerpc would still build, the change via the linker script broke function tracer on powerpc from working. By using the name ftrace_stub_graph, which does not exist anywhere else in the kernel, this should not be a problem. Link: https://lore.kernel.org/r/1573849732.5937.136.camel@lca.pw Fixes: b83b43ffc6e4 ("fgraph: Fix function type mismatches of ftrace_graph_return using ftrace_stub") Reorted-by: Qian Cai Signed-off-by: Steven Rostedt (VMware) commit ea806eb3eab35528b578a061b2c4b28f0f92c465 Author: Steven Rostedt (VMware) Date: Sun Nov 17 17:04:15 2019 -0500 ftrace: Add a helper function to modify_ftrace_direct() to allow arch optimization If a direct ftrace callback is at a location that does not have any other ftrace helpers attached to it, it is possible to simply just change the text to call the new caller (if the architecture supports it). But this requires special architecture code. Currently, modify_ftrace_direct() uses a trick to add a stub ftrace callback to the location forcing it to call the ftrace iterator. Then it can change the direct helper to call the new function in C, and then remove the stub. Removing the stub will have the location now call the new location that the direct helper is using. The new helper function does the registering the stub trick, but is a weak function, allowing an architecture to override it to do something a bit more direct. Link: https://lore.kernel.org/r/20191115215125.mbqv7taqnx376yed@ast-mbp.dhcp.thefacebook.com Suggested-by: Alexei Starovoitov Signed-off-by: Steven Rostedt (VMware) commit 6519f708cc355c4834edbe1885c8542c0e7ef907 Author: Darrick J. Wong Date: Sun Nov 17 10:36:52 2019 -0800 xfs: report corruption only as a regular error Redefine XFS_IS_CORRUPT so that it reports corruptions only via xfs_corruption_report. Since these are on-disk contents (and not checks of internal state), we don't ever want to panic the kernel. This also amends the corruption report to recommend unmounting and running xfs_repair. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit 377bcd5f3b7f46f50fdad1fed639c07f8c9f68cb Author: Carlos Maiolino Date: Thu Nov 14 12:43:04 2019 -0800 xfs: Remove kmem_zone_free() wrapper We can remove it now, without needing to rework the KM_ flags. Use kmem_cache_free() directly. Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino Signed-off-by: Darrick J. Wong commit aaf54eb8bc15de293b0fccf3be19100793b8ba67 Author: Carlos Maiolino Date: Thu Nov 14 12:43:04 2019 -0800 xfs: Remove kmem_zone_destroy() wrapper Use kmem_cache_destroy directly Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino Signed-off-by: Darrick J. Wong commit b1231760e44324d4cdb1b02116670c1ad2126e54 Author: Carlos Maiolino Date: Thu Nov 14 12:43:03 2019 -0800 xfs: Remove slab init wrappers Remove kmem_zone_init() and kmem_zone_init_flags() together with their specific KM_* to SLAB_* flag wrappers. Use kmem_cache_create() directly. Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino Signed-off-by: Darrick J. Wong commit eb65ccdb083639f8a9b6919c94d1df570396a9a1 Author: Li Xu Date: Fri Nov 15 13:54:13 2019 -0600 ASoC: wm_adsp: Expose mixer control API Expose mixer control API for reading and writing controls from the kernel. This API can be used by ALSA kernel drivers with ADSP support to read and write firmware-defined memory regions. Signed-off-by: Li Xu Signed-off-by: David Rhodes Acked-by: Charles Keepax Link: https://lore.kernel.org/r/1573847653-17094-2-git-send-email-david.rhodes@cirrus.com Signed-off-by: Mark Brown commit e48fdb53bd1fa50796b5a050e6e31fde3891a2c8 Author: Lucas Stach Date: Mon Nov 18 16:12:06 2019 +0100 ASoC: tlv320aic31xx: configure output common-mode voltage The tlv320aic31xx devices allow to adjust the output common-mode voltage for best analog performance. The datasheet states that the common mode voltage should be set to be <= AVDD/2. This changes allows to configure the output common-mode voltage via a DT property. If the property is absent the voltage is automatically chosen as the highest voltage below/equal to AVDD/2. Signed-off-by: Lucas Stach Link: https://lore.kernel.org/r/20191118151207.28576-1-l.stach@pengutronix.de Signed-off-by: Mark Brown commit 653c28afa76b45c570370c3c3a89975c68c5fc8e Author: Liam Girdwood Date: Mon Nov 11 16:29:00 2019 -0600 ASoC: SOF: Intel: Fix CFL and CML FW nocodec binary names. The manifest information is different between CNL, CML and CFL platforms hence we need to load different files. Signed-off-by: Liam Girdwood Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20191111222901.19892-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 10f64581b1b79f3b0121c987e9ef272195940bf7 Author: Konstantin Khlebnikov Date: Sun Nov 10 13:11:01 2019 +0300 libtraceevent: Fix parsing of event %o and %X argument types Add missing "%o" and "%X". Ext4 events use "%o" for printing i_mode. Signed-off-by: Konstantin Khlebnikov Reviewed-by: Steven Rostedt (VMware) Cc: Tzvetomir Stoyanov (VMware) Link: http://lore.kernel.org/lkml/157338066113.6548.11461421296091086041.stgit@buzz Signed-off-by: Arnaldo Carvalho de Melo commit aceb98261ea7d9fe38f9c140c5531f0b13623832 Author: Adrian Hunter Date: Thu Nov 14 16:25:38 2019 +0200 perf callchain: Fix segfault in thread__resolve_callchain_sample() Do not dereference 'chain' when it is NULL. $ perf record -e intel_pt//u -e branch-misses:u uname $ perf report --itrace=l --branch-history perf: Segmentation fault Fixes: e9024d519d89 ("perf callchain: Honour the ordering of PERF_CONTEXT_{USER,KERNEL,etc}") Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20191114142538.4097-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a7c2b572e217418ad34441202ad3addd8f94d2ea Author: Arnaldo Carvalho de Melo Date: Sun Nov 17 11:38:13 2019 -0300 perf map_groups: Auto sort maps by name, if needed There are still lots of lookups by name, even if just when loading vmlinux, till that code is studied to figure out if its possible to do away with those map lookup by names, provide a way to sort it using libc's qsort/bsearch. Doing it at the first lookup defers the sorting a bit, and as the code stands now, is never done for user maps, just for the kernel ones. # perf probe -l # perf probe -x ~/bin/perf -L __map_groups__find_by_name <__map_groups__find_by_name@/home/acme/git/perf/tools/perf/util/symbol.c:0> 0 static struct map *__map_groups__find_by_name(struct map_groups *mg, const char *name) 1 { struct map **mapp; 4 if (mg->maps_by_name == NULL && 5 map__groups__sort_by_name_from_rbtree(mg)) 6 return NULL; 8 mapp = bsearch(name, mg->maps_by_name, mg->nr_maps, sizeof(*mapp), map__strcmp_name); 9 if (mapp) 10 return *mapp; 11 return NULL; 12 } struct map *map_groups__find_by_name(struct map_groups *mg, const char *name) { # perf probe -x ~/bin/perf 'found=__map_groups__find_by_name:10 name:string' Added new event: probe_perf:found (on __map_groups__find_by_name:10 in /home/acme/bin/perf with name:string) You can now use it in all perf tools, such as: perf record -e probe_perf:found -aR sleep 1 # # perf probe -x ~/bin/perf -L map_groups__find_by_name 0 struct map *map_groups__find_by_name(struct map_groups *mg, const char *name) 1 { 2 struct maps *maps = &mg->maps; struct map *map; 5 down_read(&maps->lock); 7 if (mg->last_search_by_name && strcmp(mg->last_search_by_name->dso->short_name, name) == 0) { 8 map = mg->last_search_by_name; 9 goto out_unlock; } /* * If we have mg->maps_by_name, then the name isn't in the rbtree, * as mg->maps_by_name mirrors the rbtree when lookups by name are * made. */ 16 map = __map_groups__find_by_name(mg, name); 17 if (map || mg->maps_by_name != NULL) 18 goto out_unlock; /* Fallback to traversing the rbtree... */ 21 maps__for_each_entry(maps, map) 22 if (strcmp(map->dso->short_name, name) == 0) { 23 mg->last_search_by_name = map; 24 goto out_unlock; } 27 map = NULL; out_unlock: 30 up_read(&maps->lock); 31 return map; 32 } int dso__load_vmlinux(struct dso *dso, struct map *map, const char *vmlinux, bool vmlinux_allocated) # perf probe -x ~/bin/perf 'fallback=map_groups__find_by_name:21 name:string' Added new events: probe_perf:fallback (on map_groups__find_by_name:21 in /home/acme/bin/perf with name:string) probe_perf:fallback_1 (on map_groups__find_by_name:21 in /home/acme/bin/perf with name:string) You can now use it in all perf tools, such as: perf record -e probe_perf:fallback_1 -aR sleep 1 # # perf probe -l probe_perf:fallback (on map_groups__find_by_name:21@util/symbol.c in /home/acme/bin/perf with name_string) probe_perf:fallback_1 (on map_groups__find_by_name:21@util/symbol.c in /home/acme/bin/perf with name_string) probe_perf:found (on __map_groups__find_by_name:10@util/symbol.c in /home/acme/bin/perf with name_string) # # perf stat -e probe_perf:* Now run 'perf top' in another term and then, after a while, stop 'perf stat': Furthermore, if we ask for interval printing, we can see that that is done just at the start of the workload: # perf stat -I1000 -e probe_perf:* # time counts unit events 1.000319513 0 probe_perf:found 1.000319513 0 probe_perf:fallback_1 1.000319513 0 probe_perf:fallback 2.001868092 23,251 probe_perf:found 2.001868092 0 probe_perf:fallback_1 2.001868092 0 probe_perf:fallback 3.002901597 0 probe_perf:found 3.002901597 0 probe_perf:fallback_1 3.002901597 0 probe_perf:fallback 4.003358591 0 probe_perf:found 4.003358591 0 probe_perf:fallback_1 4.003358591 0 probe_perf:fallback ^C # Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-c5lmbyr14x448rcfii7y6t3k@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a94ab91a54c63b9101715b03171219279cc0ee26 Author: Arnaldo Carvalho de Melo Date: Thu Nov 14 12:28:41 2019 -0300 perf machine: No need to check if kernel module maps pre-exist We'only populating maps for kernel modules either from perf.data file PERF_RECORD_MMAP records or when parsing /proc/modules, so there is no need to first look if we already have those module maps in the list, that would mean the kernel has duplicate entries. So ditch one use of looking up maps by name. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-gnzjg2hhuz6jnrw91m35059y@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 03189e8ed5b3f17550b478043f671a9dbd2b3141 Author: Chris Down Date: Mon Nov 11 14:44:38 2019 +0000 docs: cgroup: mm: Fix spelling of "list" Signed-off-by: Chris Down Cc: Andrew Morton Cc: linux-kernel@vger.kernel.org Cc: cgroups@vger.kernel.org Cc: linux-mm@kvack.org Cc: kernel-team@fb.com Signed-off-by: Tejun Heo commit bc3bdb12bbb3492067c8719011576370e959a2e6 Author: Laura Abbott Date: Tue Sep 8 09:53:38 2015 -0700 usb-storage: Disable UAS on JMicron SATA enclosure Steve Ellis reported incorrect block sizes and alignement offsets with a SATA enclosure. Adding a quirk to disable UAS fixes the problems. Reported-by: Steven Ellis Cc: Pacho Ramos Signed-off-by: Laura Abbott Signed-off-by: Greg Kroah-Hartman commit 302ee055af0201e61be7670f957c1622d6ce176e Author: Mark Brown Date: Mon Nov 18 15:52:47 2019 +0000 ASoC: SOF: Intel: Fix build break Commit 130d3e9077 (Fix CFL and CML FW nocodec binary names.) broke the build in some configurations as it depends on changes in the development branch, revert it. Reported-by: Stephen Rothwell Signed-off-by: Mark Brown commit 496074f94b19574c77240d3b3f84cfb1097de51d Author: Tejun Heo Date: Thu Nov 14 14:31:28 2019 -0800 blk-cgroup: cgroup_rstat_updated() shouldn't be called on cgroup1 Currently, cgroup rstat is supported only on cgroup2 hierarchy and rstat functions shouldn't be called on cgroup1 cgroups. While converting blk-cgroup core statistics to rstat, f73316482977 ("blk-cgroup: reimplement basic IO stats using cgroup rstat") accidentally ended up calling cgroup_rstat_updated() on cgroup1 cgroups causing crashes. Longer term, we probably should add cgroup1 support to rstat but for now let's mask the call directly. Fixes: f73316482977 ("blk-cgroup: reimplement basic IO stats using cgroup rstat") Tested-by: Faiz Abbas Signed-off-by: Tejun Heo Signed-off-by: Jens Axboe commit 00b89892c869f34528deca957b10d1468c4e8b38 Author: Jens Axboe Date: Mon Nov 18 08:35:47 2019 -0700 Revert "bcache: fix fifo index swapping condition in journal_pin_cmp()" Coly says: "Guoju Fang talked to me today, he told me this change was unnecessary and I was over-thought. Then I realize fifo_idx() uses a mask to handle the array index overflow condition, so the index swap in journal_pin_cmp() won't happen. And yes, Guoju and Kent are correct. Since you already applied this patch, can you please to remove this patch from your for-next branch? This single patch does not break thing, but it is unecessary at this moment." This reverts commit c0e0954e909c17b43d176ab219fc598964616ae6. Signed-off-by: Jens Axboe commit a468168130ec1a3245812f2c713be97081149ca2 Author: YueHaibing Date: Fri Nov 15 13:18:29 2019 +0000 scsi: sd_zbc: Remove set but not used variable 'buflen' Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/sd_zbc.c: In function 'sd_zbc_check_zones': drivers/scsi/sd_zbc.c:341:9: warning: variable 'buflen' set but not used [-Wunused-but-set-variable] It is not used since commit d9dd73087a8b ("block: Enhance blk_revalidate_disk_zones()") Reported-by: Hulk Robot Reviewed-by: Damien Le Moal Signed-off-by: YueHaibing Signed-off-by: Jens Axboe commit 36b3db03b4741b8935b68fffc7e69951d8d70a89 Author: Alexander Shishkin Date: Fri Nov 15 18:08:18 2019 +0200 perf/core: Fix the mlock accounting, again Commit: 5e6c3c7b1ec2 ("perf/aux: Fix tracking of auxiliary trace buffer allocation") tried to guess the correct combination of arithmetic operations that would undo the AUX buffer's mlock accounting, and failed, leaking the bottom part when an allocation needs to be charged partially to both user->locked_vm and mm->pinned_vm, eventually leaving the user with no locked bonus: $ perf record -e intel_pt//u -m1,128 uname [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.061 MB perf.data ] $ perf record -e intel_pt//u -m1,128 uname Permission error mapping pages. Consider increasing /proc/sys/kernel/perf_event_mlock_kb, or try again with a smaller value of -m/--mmap_pages. (current value: 1,128) Fix this by subtracting both locked and pinned counts when AUX buffer is unmapped. Reported-by: Thomas Richter Tested-by: Thomas Richter Signed-off-by: Alexander Shishkin Acked-by: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Mark Rutland Cc: Namhyung Kim Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Signed-off-by: Ingo Molnar commit d256d796279de0bdc227ff4daef565aa7e80c898 Author: Jeffle Xu Date: Mon Nov 18 09:50:38 2019 +0800 dm thin: wakeup worker only when deferred bios exist Single thread fio test (read, bs=4k, ioengine=libaio, iodepth=128, numjobs=1) over dm-thin device has poor performance versus bare nvme device. Further investigation with perf indicates that queue_work_on() consumes over 20% CPU time when doing IO over dm-thin device. The call stack is as follows. - 40.57% thin_map + 22.07% queue_work_on + 9.95% dm_thin_find_block + 2.80% cell_defer_no_holder 1.91% inc_all_io_entry.isra.33.part.34 + 1.78% bio_detain.isra.35 In cell_defer_no_holder(), wakeup_worker() is always called, no matter whether the tc->deferred_bio_list list is empty or not. In single thread IO model, this list is most likely empty. So skip waking up worker thread if tc->deferred_bio_list list is empty. Single thread IO performance improves from 448 MiB/s to 646 MiB/s (+44%) once the needless wake_worker() calls are properly skipped. Signed-off-by: Jeffle Xu Signed-off-by: Mike Snitzer commit fa039b936cf518c50d99c694a757b18bf3ea3f5e Author: Jani Nikula Date: Fri Nov 15 14:04:40 2019 +0200 drm/i915: fix accidental static variable use It's supposed to be just a const pointer. Fixes: 074c77e3ec63 ("drm/i915/tgl: Gen-12 display loses Yf tiling and legacy CCS support") Cc: Ville Syrjälä Cc: Dhinakaran Pandiyan Cc: Lucas De Marchi Reviewed-by: Ville Syrjälä Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20191115120440.17883-1-jani.nikula@intel.com (cherry picked from commit 48ea97fabe75c83adf4e6ff9262bbda229e6ee73) Signed-off-by: Joonas Lahtinen commit e367925e80b5a0a7d8db5b629c767f288f0aed4b Author: Don Hiatt Date: Fri Nov 15 15:15:38 2019 -0800 drm/i915/guc: Skip suspend/resume GuC action on platforms w/o GuC submission On some platforms (e.g. KBL) that do not support GuC submission, but the user enabled the GuC communication (e.g for HuC authentication) calling the GuC EXIT_S_STATE action results in lose of ability to enter RC6. We can remove the GuC suspend/resume entirely as we do not need to save the GuC submission status. Add intel_guc_submission_is_enabled() function to determine if GuC submission is active. v2: Do not suspend/resume the GuC on platforms that do not support Guc Submission. v3: Fix typo, move suspend logic to remove goto. v4: Use intel_guc_submission_is_enabled() to check GuC submission status. v5: No need to look at engine to determine if submission is enabled. Squash fix + intel_guc_submission_is_enabled() patch into one. v6: Move resume check into intel_guc_resume() for symmetry. Fix commit Fixes tag. Reported-by: KiteStramuort Reported-by: S. Zharkoff Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111594 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111623 Fixes: ffd5ce22faa4 ("drm/i915/guc: Updates for GuC 32.0.3 firmware") Cc: Michal Wajdeczko Cc: Daniele Ceralo Spurio Cc: Stuart Summers Cc: Chris Wilson Tested-by: Tomas Janousek Signed-off-by: Don Hiatt Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20191115231538.1249-1-don.hiatt@intel.com (cherry picked from commit 82e0c5bbd6eb1d274b5a3e519ff0ab91f1f8e537) Signed-off-by: Joonas Lahtinen commit a46bfdc83fee0a83aae54390729df12abce57f45 Author: Chris Wilson Date: Thu Nov 14 22:57:32 2019 +0000 drm/i915/gt: Wait for new requests in intel_gt_retire_requests() Our callers fall into two categories, those passing timeout=0 who just want to flush request retirements and those passing a timeout that need to wait for submission completion (e.g. intel_gt_wait_for_idle()). Currently, we only wait for a snapshot of timelines at the start of the wait (but there was an expectation that new requests would cause timelines to appear at the end). However, our callers, such as intel_gt_wait_for_idle() before suspend, do require us to wait for the power management requests emitted by retirement as well. If we don't, then it takes an extra second or two for the background worker to flush the queue and mark the GT as idle. Fixes: 7e8057626640 ("drm/i915: Drop struct_mutex from around i915_retire_requests()") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20191114225736.616885-1-chris@chris-wilson.co.uk (cherry picked from commit 7936a22dd4660d24b4ca0668c02b0372127cab44) Signed-off-by: Joonas Lahtinen commit 2a39b072ee6990512ff0829a4eba5b409dff2746 Author: Imre Deak Date: Thu Nov 14 17:26:21 2019 +0200 drm/i915: Restore GT coarse power gating workaround The workaround to disable coarse power gating is still needed on SKL GT3/GT4 machines and since the RC6 context corruption was discovered by the hardware team also on all GEN9 machines. Restore applying the workaround. Fixes: c113236718e8 ("drm/i915: Extract GT render sleep (rc6) management") Testcase: igt/intel_gt_pm_late_selftests/live_rc6_ctx Cc: Chris Wilson Cc: Andi Shyti Signed-off-by: Imre Deak Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20191114152621.7235-1-imre.deak@intel.com (cherry picked from commit 980f87a2edb3e7825949ebd0a7e63ab574c20816) Signed-off-by: Joonas Lahtinen commit 9faf5fa4d3dad3b0c0fa6e67689c144981a11c27 Author: Chris Wilson Date: Wed Nov 13 18:06:33 2019 +0000 drm/i915/fbdev: Restore physical addresses for fb_mmap() fbdev uses the physical address of our framebuffer for its fb_mmap() routine. While we need to adapt this address for the new io BAR, we have to fix v5.4 first! The simplest fix is to restore the smem back to v5.3 and we will then probably have to implement our fbops->fb_mmap() callback to handle local memory. Reported-by: Neil MacLeod Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112256 Fixes: 5f889b9a61dd ("drm/i915: Disregard drm_mode_config.fb_base") Signed-off-by: Chris Wilson Cc: Daniel Vetter Cc: Maarten Lankhorst Tested-by: Neil MacLeod Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20191113180633.3947-1-chris@chris-wilson.co.uk (cherry picked from commit abc5520704ab438099fe352636b30b05c1253bea) Signed-off-by: Joonas Lahtinen commit 7e89d508558c1c02b6a4f34cdadfb7992794ad0f Author: Lionel Landwerlin Date: Wed Nov 13 17:46:39 2019 +0200 drm/i915/perf: don't forget noa wait after oa config I'm observing incoherence metric values, changing from run to run. It appears the patches introducing noa wait & reconfiguration from command stream switched places in the series multiple times during the review. This lead to the dependency of one onto the order to go missing... Signed-off-by: Lionel Landwerlin Fixes: 15d0ace1f876 ("drm/i915/perf: execute OA configuration from command stream") Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20191113154639.27144-1-lionel.g.landwerlin@intel.com (cherry picked from commit 93937659dc644f708def8fa58cb63c5c9f499f26) Signed-off-by: Joonas Lahtinen commit 3e749f5199e1604bedc67ed479c01332b91c0129 Author: Bruce Chang Date: Wed Nov 13 15:11:04 2019 -0800 drm/i915: Avoid atomic context for error capture io_mapping_map_atomic/kmap_atomic are occasionally taken in error capture (if there is no aperture preallocated for the use of error capture), but the error capture and compression routines are now run in normal context: <3> [113.316247] BUG: sleeping function called from invalid context at mm/page_alloc.c:4653 <3> [113.318190] in_atomic(): 1, irqs_disabled(): 0, pid: 678, name: debugfs_test <4> [113.319900] no locks held by debugfs_test/678. <3> [113.321002] Preemption disabled at: <4> [113.321130] [] i915_error_object_create+0x494/0x610 [i915] <4> [113.327259] Call Trace: <4> [113.327871] dump_stack+0x67/0x9b <4> [113.328683] ___might_sleep+0x167/0x250 <4> [113.329618] __alloc_pages_nodemask+0x26b/0x1110 <4> [113.334614] pool_alloc.constprop.19+0x14/0x60 [i915] <4> [113.335951] compress_page+0x7c/0x100 [i915] <4> [113.337110] i915_error_object_create+0x4bd/0x610 [i915] <4> [113.338515] i915_capture_gpu_state+0x384/0x1680 [i915] However, it is not a good idea to run the slow compression inside atomic context, so we choose not to. Fixes: 895d8ebeaa924 ("drm/i915: error capture with no ggtt slot") Signed-off-by: Bruce Chang Reviewed-by: Brian Welty Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20191113231104.24208-1-yu.bruce.chang@intel.com (cherry picked from commit 48715f7001742e0d1cb20cffab1a0d75f5f7ad72) Signed-off-by: Joonas Lahtinen commit 78e2ea291ead1e395864ff1583064e07b1adeb62 Author: José Roberto de Souza Date: Thu Nov 7 13:45:57 2019 -0800 drm/i915/display: Fix TRANS_DDI_MST_TRANSPORT_SELECT definition TRANS_DDI_MST_TRANSPORT_SELECT is 2 bits wide not 3, it was taking one bit from EDP/DSI Input Select. Fixes: b3545e086877 ("drm/i915/tgl: add support to one DP-MST stream") Cc: Lucas De Marchi Signed-off-by: José Roberto de Souza Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20191107214559.77087-1-jose.souza@intel.com (cherry picked from commit bb747fa5a9cbf561e5a30649f360feb9e6855645) Signed-off-by: Joonas Lahtinen commit 5d77aa07bd2f4aa940c80a0d97471201b4a6a282 Author: Imre Deak Date: Tue Nov 12 12:46:08 2019 +0200 drm/i915: Fix detection for a CMP-V PCH According to internal documents I found for CMP PCHs the PCI ID 0xA3C1 belongs to a CMP-V chipset. Based on the same docs the programming of the PCH is compatible with that of KBP. Fix up my previous wrong assumption accordingly using the SPT programming which in turn is the basis for KBP. The original bug reporter verified that this is the correct PCH identification (the only way we'll program valid DDC pin-pair values to the GMBUS register) and the Windows team uses the same identification (that is using the KBP programming model for this PCH). I filed the necessary Bspec update requests (BSpec/33734). Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112051 Fixes: 37c92dc303dd ("drm/i915: Add new CNL PCH ID seen on a CML platform") Reported-and-tested-by: Cyrus Cc: Cyrus Cc: Timo Aaltonen Cc: José Roberto de Souza Signed-off-by: Imre Deak Reviewed-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20191112104608.24587-1-imre.deak@intel.com (cherry picked from commit 50a5065f4474c2dbc1f7462b45a32d33d7b48d88) Signed-off-by: Joonas Lahtinen commit 36104fcf8ff4dd0b0ca8a79bc3fb5b1046deead2 Author: Chris Wilson Date: Tue Nov 12 15:00:51 2019 +0000 drm/i915: Flush context free work on cleanup Throw in a flush_work() to specifically flush the context cleanup work before the module is unloaded. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112248 Fixes: a4e7ccdac38e ("drm/i915: Move context management under GEM") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Mika Kuoppala Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20191112150051.1603-1-chris@chris-wilson.co.uk (cherry picked from commit 5f00cac921b1219bc9daf00d169385b4cb3916ce) Signed-off-by: Joonas Lahtinen commit de678bc63cc659d056a5ff3a3b11866d3eb4c1a9 Author: Sebastian Andrzej Siewior Date: Mon Nov 18 12:01:22 2019 +0100 block: Don't disable interrupts in trigger_softirq() trigger_softirq() is always invoked as a SMP-function call which is always invoked with disables interrupts. Don't disable interrupt in trigger_softirq() because interrupts are already disabled. Reviewed-by: Ming Lei Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Jens Axboe commit 32c4d9e8a4eb286674dc1a3b93d51d791c7f645e Author: Kars de Jong Date: Sat Nov 16 12:46:20 2019 +0100 rtc: msm6242: Remove unneeded msm6242_set()/msm6242_clear() functions The msm6242_set()/msm6242_clear() functions are used when writing to Control Register D to set or clear the HOLD bit when reading the current time from the RTC. Doing this with a read-modify-write cycle will potentially clear an interrupt condition which occurs between the read and the write. The datasheet states the following about this: When writing the HOLD or 30 second adjust bits of register D, it is necessary to write the IRQ FLAG bit to a "1". Since the only other bits in the register are the 30 second adjust bit (which is not used) and the BUSY bit (which is read-only), the read-modify-write cycle can be replaced by a simple write with the IRQ FLAG bit set to 1 and the other bits (except HOLD) set to 0. Tested-by: Kars de Jong Signed-off-by: Kars de Jong Link: https://lore.kernel.org/r/20191116114620.9193-1-jongk@linux-m68k.org Reviewed-by: Geert Uytterhoeven Signed-off-by: Alexandre Belloni commit 6e0a9b3dfaaf93476b34825e53c4ec065267081e Author: Arnaldo Carvalho de Melo Date: Thu Nov 14 12:15:34 2019 -0300 perf record: No need to process the synthesized MMAP events twice At the end of a 'perf record' session, by default, we'll process all samples and populate the threads, maps, etc so as to find out which of the DSOs got samples, to reduce the size of the build-id table we'll add to the perf.data headers. But we don't need to process the PERF_RECORD_MMAP events synthesized for the kernel modules, as we have those already via perf_session__create_kernel_maps(), so add mmap/mmap2 handlers that first look at event->header.misc to see if the event is for a user map, bailing out if not. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-mofoxvcx2dryppcw3o689jdd@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f068435d9bb2d825d59e3c101bc579f09315ee01 Author: Arnaldo Carvalho de Melo Date: Thu Nov 14 10:46:45 2019 -0300 perf map: No need to adjust the long name of modules At some point in the past we needed to make sure we would get the long name of modules and not just what we get from /proc/modules, but that need, as described in the cset that introduced the adjustment function: Fixes: c03d5184f0e9 ("perf machine: Adjust dso->long_name for offline module") Without using the buildid-cache: # lsmod | grep trusted # insmod trusted.ko # lsmod | grep trusted trusted 24576 0 # strace -e open,openat perf probe -m ./trusted.ko key_seal |& grep trusted openat(AT_FDCWD, "/sys/module/trusted/notes/.note.gnu.build-id", O_RDONLY) = 4 openat(AT_FDCWD, "/sys/module/trusted/notes/.note.gnu.build-id", O_RDONLY) = 7 openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 openat(AT_FDCWD, "/root/.debug/root/trusted.ko/dd3d355d567394d540f527e093e0f64b95879584/probes", O_RDWR|O_CREAT, 0644) = 3 openat(AT_FDCWD, "/usr/lib/debug/root/trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/debug/root/trusted.ko", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/root/.debug/trusted.ko", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 openat(AT_FDCWD, "trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, ".debug/trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 4 openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 probe:key_seal (on key_seal in trusted) # perf probe -l probe:key_seal (on key_seal in trusted) # No attempt at opening '[trusted]'. Now using the build-id cache: # rmmod trusted # perf buildid-cache --add ./trusted.ko # insmod trusted.ko # strace -e open,openat perf probe -m ./trusted.ko key_seal |& grep trusted openat(AT_FDCWD, "/sys/module/trusted/notes/.note.gnu.build-id", O_RDONLY) = 4 openat(AT_FDCWD, "/sys/module/trusted/notes/.note.gnu.build-id", O_RDONLY) = 7 openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 openat(AT_FDCWD, "/root/.debug/root/trusted.ko/dd3d355d567394d540f527e093e0f64b95879584/probes", O_RDWR|O_CREAT, 0644) = 3 openat(AT_FDCWD, "/usr/lib/debug/root/trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/debug/root/trusted.ko", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/root/.debug/trusted.ko", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 openat(AT_FDCWD, "trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, ".debug/trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 4 openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3 # Again, no attempt at reading '[trusted]'. Finally, adding a probe to that function and then using: [root@quaco ~]# perf trace -e probe_perf:*/max-stack=16/ --max-events=2 0.000 perf/13456 probe_perf:dso__adjust_kmod_long_name(__probe_ip: 5492263) dso__adjust_kmod_long_name (/home/acme/bin/perf) machine__process_kernel_mmap_event (/home/acme/bin/perf) machine__process_mmap_event (/home/acme/bin/perf) perf_event__process_mmap (/home/acme/bin/perf) machines__deliver_event (/home/acme/bin/perf) perf_session__deliver_event (/home/acme/bin/perf) perf_session__process_event (/home/acme/bin/perf) process_simple (/home/acme/bin/perf) reader__process_events (/home/acme/bin/perf) __perf_session__process_events (/home/acme/bin/perf) perf_session__process_events (/home/acme/bin/perf) process_buildids (/home/acme/bin/perf) record__finish_output (/home/acme/bin/perf) __cmd_record (/home/acme/bin/perf) cmd_record (/home/acme/bin/perf) run_builtin (/home/acme/bin/perf) 0.055 perf/13456 probe_perf:dso__adjust_kmod_long_name(__probe_ip: 5492263) dso__adjust_kmod_long_name (/home/acme/bin/perf) machine__process_kernel_mmap_event (/home/acme/bin/perf) machine__process_mmap_event (/home/acme/bin/perf) perf_event__process_mmap (/home/acme/bin/perf) machines__deliver_event (/home/acme/bin/perf) perf_session__deliver_event (/home/acme/bin/perf) perf_session__process_event (/home/acme/bin/perf) process_simple (/home/acme/bin/perf) reader__process_events (/home/acme/bin/perf) __perf_session__process_events (/home/acme/bin/perf) perf_session__process_events (/home/acme/bin/perf) process_buildids (/home/acme/bin/perf) record__finish_output (/home/acme/bin/perf) __cmd_record (/home/acme/bin/perf) cmd_record (/home/acme/bin/perf) run_builtin (/home/acme/bin/perf) # This was the only path I could find using the perf tools that reach at this function, then as of november/2019, if we put a probe in the line where the actuall setting of the dso->long_name is done: # perf trace -e probe_perf:* ^C[root@quaco ~] # perf stat -e probe_perf:* -I 2000 2.000404265 0 probe_perf:dso__adjust_kmod_long_name 4.001142200 0 probe_perf:dso__adjust_kmod_long_name 6.001704120 0 probe_perf:dso__adjust_kmod_long_name 8.002398316 0 probe_perf:dso__adjust_kmod_long_name 10.002984010 0 probe_perf:dso__adjust_kmod_long_name 12.003597851 0 probe_perf:dso__adjust_kmod_long_name 14.004113303 0 probe_perf:dso__adjust_kmod_long_name 16.004582773 0 probe_perf:dso__adjust_kmod_long_name 18.005176373 0 probe_perf:dso__adjust_kmod_long_name 20.005801605 0 probe_perf:dso__adjust_kmod_long_name 22.006467540 0 probe_perf:dso__adjust_kmod_long_name ^C 23.683261941 0 probe_perf:dso__adjust_kmod_long_name # Its not being used at all. To further test this I used kvm.ko as the offline module, i.e. removed if from the buildid-cache by nuking it completely (rm -rf ~/.debug) and moved it from the normal kernel distro path, removed the modules, stoped the kvm guest, and then installed it manually, etc. # rmmod kvm-intel # rmmod kvm # lsmod | grep kvm # modprobe kvm-intel modprobe: ERROR: ctx=0x55d3b1722260 path=/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm/kvm.ko.xz error=No such file or directory modprobe: ERROR: ctx=0x55d3b1722260 path=/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm/kvm.ko.xz error=No such file or directory modprobe: ERROR: could not insert 'kvm_intel': Unknown symbol in module, or unknown parameter (see dmesg) # insmod ./kvm.ko # modprobe kvm-intel modprobe: ERROR: ctx=0x562f34026260 path=/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm/kvm.ko.xz error=No such file or directory modprobe: ERROR: ctx=0x562f34026260 path=/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm/kvm.ko.xz error=No such file or directory # lsmod | grep kvm kvm_intel 299008 0 kvm 765952 1 kvm_intel irqbypass 16384 1 kvm # # perf probe -x ~/bin/perf machine__findnew_module_map:12 mname=m.name:string filename=filename:string 'dso_long_name=map->dso->long_name:string' 'dso_name=map->dso->name:string' # perf probe -l probe_perf:machine__findnew_module_map (on machine__findnew_module_map:12@util/machine.c in /home/acme/bin/perf with mname filename dso_long_name dso_name) # perf record ^C[ perf record: Woken up 2 times to write data ] [ perf record: Captured and wrote 3.416 MB perf.data (33956 samples) ] # perf trace -e probe_perf:machine* 6.322 perf/23099 probe_perf:machine__findnew_module_map(__probe_ip: 5492493, mname: "[salsa20_generic]", filename: "/lib/modules/5.3.8-200.fc30.x86_64/kernel/crypto/salsa20_generic.ko.xz", dso_long_name: "/lib/modules/5.3.8-200.fc30.x86_64/kernel/crypto/salsa20_generic.ko.xz", dso_name: "[salsa20_generic]") 6.375 perf/23099 probe_perf:machine__findnew_module_map(__probe_ip: 5492493, mname: "[kvm]", filename: "[kvm]", dso_long_name: "[kvm]", dso_name: "[kvm]") The filename doesn't come with the path, no point in trying to set the dso->long_name. [root@quaco ~]# strace -e open,openat perf probe -m ./kvm.ko kvm_apic_local_deliver |& egrep 'open.*kvm' openat(AT_FDCWD, "/sys/module/kvm_intel/notes/.note.gnu.build-id", O_RDONLY) = 4 openat(AT_FDCWD, "/sys/module/kvm/notes/.note.gnu.build-id", O_RDONLY) = 4 openat(AT_FDCWD, "/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 7 openat(AT_FDCWD, "/sys/module/kvm_intel/notes/.note.gnu.build-id", O_RDONLY) = 8 openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3 openat(AT_FDCWD, "/root/.debug/root/kvm.ko/5955f426cb93f03f30f3e876814be2db80ab0b55/probes", O_RDWR|O_CREAT, 0644) = 3 openat(AT_FDCWD, "/usr/lib/debug/root/kvm.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/debug/root/kvm.ko", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/root/.debug/kvm.ko", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3 openat(AT_FDCWD, "kvm.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, ".debug/kvm.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "kvm.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3 openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3 openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 4 openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3 [root@quaco ~]# Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-jlfew3lyb24d58egrp0o72o2@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 1ae14516cba032a83b561144d3d48fd381584c0c Author: Arnaldo Carvalho de Melo Date: Wed Nov 13 16:33:33 2019 -0300 perf map_groups: Add a front end cache for map lookups by name Lets see if it helps: First look at the probeable lines for the function that does lookups by name in a map_groups struct: # perf probe -x ~/bin/perf -L map_groups__find_by_name 0 struct map *map_groups__find_by_name(struct map_groups *mg, const char *name) 1 { 2 struct maps *maps = &mg->maps; struct map *map; 5 down_read(&maps->lock); 7 if (mg->last_search_by_name && strcmp(mg->last_search_by_name->dso->short_name, name) == 0) { 8 map = mg->last_search_by_name; 9 goto out_unlock; } 12 maps__for_each_entry(maps, map) 13 if (strcmp(map->dso->short_name, name) == 0) { 14 mg->last_search_by_name = map; 15 goto out_unlock; } 18 map = NULL; out_unlock: 21 up_read(&maps->lock); 22 return map; 23 } int dso__load_vmlinux(struct dso *dso, struct map *map, const char *vmlinux, bool vmlinux_allocated) # Now add a probe to the place where we reuse the last search: # perf probe -x ~/bin/perf map_groups__find_by_name:8 Added new event: probe_perf:map_groups__find_by_name (on map_groups__find_by_name:8 in /home/acme/bin/perf) You can now use it in all perf tools, such as: perf record -e probe_perf:map_groups__find_by_name -aR sleep 1 # Now lets do a system wide 'perf stat' counting those events: # perf stat -e probe_perf:* Leave it running and lets do a 'perf top', then, after a while, stop the 'perf stat': # perf stat -e probe_perf:* ^C Performance counter stats for 'system wide': 3,603 probe_perf:map_groups__find_by_name 44.565253139 seconds time elapsed # yeah, good to have. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-tcz37g3nxv3tvxw3q90vga3p@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e34494c8df0cd96fc432efae121db3212c46ae48 Author: Kars de Jong Date: Sat Nov 16 12:05:48 2019 +0100 rtc: msm6242: Fix reading of 10-hour digit The driver was reading the wrong register as the 10-hour digit due to a misplaced ')'. It was in fact reading the 1-second digit register due to this bug. Also remove the use of a magic number for the hour mask and use the define for it which was already present. Fixes: 4f9b9bba1dd1 ("rtc: Add an RTC driver for the Oki MSM6242") Tested-by: Kars de Jong Signed-off-by: Kars de Jong Link: https://lore.kernel.org/r/20191116110548.8562-1-jongk@linux-m68k.org Reviewed-by: Geert Uytterhoeven Signed-off-by: Alexandre Belloni commit c5c584d2dbb0883f1e6f61872964a4a3a35a2017 Author: Arnaldo Carvalho de Melo Date: Wed Nov 13 16:16:25 2019 -0300 perf maps: Do not use an rbtree to sort by map name This is only used for the kernel maps, shave 24 bytes out 'struct map' and just traverse the existing per ip rbtree to look for maps by name, use a front end cache to reuse the last search if its the same name. After this 'struct map' is down to just two cachelines: $ pahole -C map ~/bin/perf struct map { union { struct rb_node rb_node __attribute__((__aligned__(8))); /* 0 24 */ struct list_head node; /* 0 16 */ } __attribute__((__aligned__(8))); /* 0 24 */ u64 start; /* 24 8 */ u64 end; /* 32 8 */ _Bool erange_warned; /* 40 1 */ /* XXX 3 bytes hole, try to pack */ u32 priv; /* 44 4 */ u32 prot; /* 48 4 */ u32 flags; /* 52 4 */ u64 pgoff; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ u64 reloc; /* 64 8 */ u32 maj; /* 72 4 */ u32 min; /* 76 4 */ u64 ino; /* 80 8 */ u64 ino_generation; /* 88 8 */ u64 (*map_ip)(struct map *, u64); /* 96 8 */ u64 (*unmap_ip)(struct map *, u64); /* 104 8 */ struct dso * dso; /* 112 8 */ refcount_t refcnt; /* 120 4 */ /* size: 128, cachelines: 2, members: 17 */ /* sum members: 121, holes: 1, sum holes: 3 */ /* padding: 4 */ /* forced alignments: 1 */ } __attribute__((__aligned__(8))); $ Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-bvr8fqfgzxtgnhnwt5sssx5g@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit bef69dd87828ef5d8ecdab8d857cd3a33cf98675 Author: Vincent Guittot Date: Mon Nov 18 14:21:19 2019 +0100 sched/cpufreq: Move the cfs_rq_util_change() call to cpufreq_update_util() update_cfs_rq_load_avg() calls cfs_rq_util_change() every time PELT decays, which might be inefficient when the cpufreq driver has rate limitation. When a task is attached on a CPU, we have this call path: update_load_avg() update_cfs_rq_load_avg() cfs_rq_util_change -- > trig frequency update attach_entity_load_avg() cfs_rq_util_change -- > trig frequency update The 1st frequency update will not take into account the utilization of the newly attached task and the 2nd one might be discarded because of rate limitation of the cpufreq driver. update_cfs_rq_load_avg() is only called by update_blocked_averages() and update_load_avg() so we can move the call to cfs_rq_util_change/cpufreq_update_util() into these two functions. It's also interesting to note that update_load_avg() already calls cfs_rq_util_change() directly for the !SMP case. This change will also ensure that cpufreq_update_util() is called even when there is no more CFS rq in the leaf_cfs_rq_list to update, but only IRQ, RT or DL PELT signals. [ mingo: Minor updates. ] Reported-by: Doug Smythies Tested-by: Doug Smythies Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Acked-by: Rafael J. Wysocki Cc: Linus Torvalds Cc: Thomas Gleixner Cc: juri.lelli@redhat.com Cc: linux-pm@vger.kernel.org Cc: mgorman@suse.de Cc: rostedt@goodmis.org Cc: sargun@sargun.me Cc: srinivas.pandruvada@linux.intel.com Cc: tj@kernel.org Cc: xiexiuqi@huawei.com Cc: xiezhipeng1@huawei.com Fixes: 039ae8bcf7a5 ("sched/fair: Fix O(nr_cgroups) in the load balancing path") Link: https://lkml.kernel.org/r/1574083279-799-1-git-send-email-vincent.guittot@linaro.org Signed-off-by: Ingo Molnar commit b21feab0b865c36b24d7a60b55a10c7033b03159 Merge: a9723389cc75 af42d3466bdc Author: Ingo Molnar Date: Mon Nov 18 14:41:02 2019 +0100 Merge tag 'v5.4-rc8' into sched/core, to pick up fixes and dependencies Signed-off-by: Ingo Molnar commit a9723389cc759c891d481de271ac73eeaa123bcb Author: Vincent Guittot Date: Tue Nov 12 15:50:43 2019 +0100 sched/fair: Add comments for group_type and balancing at SD_NUMA level Add comments to describe each state of goup_type and to add some details about the load balance at NUMA level. [ Valentin Schneider: Updates to the comments. ] [ mingo: Other updates to the comments. ] Reported-by: Mel Gorman Signed-off-by: Vincent Guittot Acked-by: Valentin Schneider Cc: Ben Segall Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/1573570243-1903-1-git-send-email-vincent.guittot@linaro.org Signed-off-by: Ingo Molnar commit 450c3d4166837c496ebce03650c08800991f2150 Author: Navid Emamdoost Date: Wed Oct 2 16:52:37 2019 -0500 affs: fix a memory leak in affs_remount In affs_remount if data is provided it is duplicated into new_opts. The allocated memory for new_opts is only released if parse_options fails. There's a bit of history behind new_options, originally there was save/replace options on the VFS layer so the 'data' passed must not change (thus strdup), this got cleaned up in later patches. But not completely. There's no reason to do the strdup in cases where the filesystem does not need to reuse the 'data' again, because strsep would modify it directly. Fixes: c8f33d0bec99 ("affs: kstrdup() memory handling") Signed-off-by: Navid Emamdoost [ update changelog ] Signed-off-by: David Sterba commit 6060c07d476ebb1f21d28db5ba852e911246ce79 Author: Davidlohr Bueso Date: Sun Oct 27 15:01:43 2019 -0700 affs: Replace binary semaphores with mutexes At a slight footprint cost (24 vs 32 bytes), mutexes are more optimal than semaphores; it's also a nicer interface for mutual exclusion, which is why they are encouraged over binary semaphores, when possible. For both i_link_lock and i_ext_lock (and hence i_hash_lock which I annotated for the hash lock mapping hackery for lockdep), their semantics imply traditional lock ownership; that is, the lock owner is the same for both lock/unlock operations and does not run in irq context. Therefore it is safe to convert. Signed-off-by: Davidlohr Bueso Signed-off-by: David Sterba commit 3318544b721d3072fdd1f85ee0f1f214c0b211ee Author: Vincent Guittot Date: Tue Oct 22 18:46:38 2019 +0200 sched/fair: Fix rework of find_idlest_group() The task, for which the scheduler looks for the idlest group of CPUs, must be discounted from all statistics in order to get a fair comparison between groups. This includes utilization, load, nr_running and idle_cpus. Such unfairness can be easily highlighted with the unixbench execl 1 task. This test continuously call execve() and the scheduler looks for the idlest group/CPU on which it should place the task. Because the task runs on the local group/CPU, the latter seems already busy even if there is nothing else running on it. As a result, the scheduler will always select another group/CPU than the local one. This recovers most of the performance regression on my system from the recent load-balancer rewrite. [ mingo: Minor cleanups. ] Reported-by: kernel test robot Tested-by: kernel test robot Signed-off-by: Vincent Guittot Cc: Linus Torvalds Cc: Morten.Rasmussen@arm.com Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dietmar.eggemann@arm.com Cc: hdanton@sina.com Cc: parth@linux.ibm.com Cc: pauld@redhat.com Cc: quentin.perret@arm.com Cc: riel@surriel.com Cc: srikar@linux.vnet.ibm.com Cc: valentin.schneider@arm.com Fixes: 57abff067a08 ("sched/fair: Rework find_idlest_group()") Link: https://lkml.kernel.org/r/1571762798-25900-1-git-send-email-vincent.guittot@linaro.org Signed-off-by: Ingo Molnar commit 79f6c108c87b470aacf25fc25a86f48694d03ae8 Author: Peter Ujfalusi Date: Wed Nov 13 14:47:34 2019 +0200 ASoC: pcm3168a: Add support for optional RST gpio handling In case the RST line is connected to a GPIO line it needs to be pulled high when the driver probes to be able to use the codec. Add support also for cases when more than one codec is is controlled by the same GPIO line by requesting the gpio with GPIOD_FLAGS_BIT_NONEXCLUSIVE. Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20191113124734.27984-3-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit cdacc761dae1cbd6475ac79f0e732f2b1ca021e0 Author: Peter Ujfalusi Date: Wed Nov 13 14:47:33 2019 +0200 ASoC: pcm3168a: Document optional RST gpio On boards where the RST line is not pulled up, but it is connected to a GPIO line this property must present in order to be able to enable the codec. Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20191113124734.27984-2-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit b1176bbb70866f24099cd2720283c7219fb4a81c Author: Chuhong Yuan Date: Mon Nov 18 15:37:07 2019 +0800 ASoC: wm5100: add missed pm_runtime_disable The driver forgets to call pm_runtime_disable in remove and probe failure. Add the calls to fix it. Signed-off-by: Chuhong Yuan Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20191118073707.28298-1-hslester96@gmail.com Signed-off-by: Mark Brown commit 2dab09be49a1e7a4dd13cb47d3a1441a2ef33a87 Author: Chuhong Yuan Date: Mon Nov 18 15:36:33 2019 +0800 ASoC: wm2200: add missed operations in remove and probe failure This driver misses calls to pm_runtime_disable and regulator_bulk_disable in remove and a call to free_irq in probe failure. Add the calls to fix it. Signed-off-by: Chuhong Yuan Link: https://lore.kernel.org/r/20191118073633.28237-1-hslester96@gmail.com Signed-off-by: Mark Brown commit baddcee989931e304eeb90c101751c2f7f9b5045 Author: Vinod Koul Date: Fri Nov 15 15:57:05 2019 +0530 ASoC: qcom: q6asm-dai: add support to flac decoder Qualcomm DSPs also support the flac decoder, so add support for FLAC decoder and convert the snd_dec_flac params to qdsp format. Co-developed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Signed-off-by: Vinod Koul Link: https://lore.kernel.org/r/20191115102705.649976-4-vkoul@kernel.org Signed-off-by: Mark Brown commit 51d2584a98942a6b4a0dfa183f4a9afcb8a04073 Author: Srinivas Kandagatla Date: Fri Nov 15 15:57:04 2019 +0530 ASoC: qcom: q6asm: add support to flac config Qualcomm DSPs expect flac config to be set for flac decoders, so add the API to program the flac config to the DSP Signed-off-by: Srinivas Kandagatla Signed-off-by: Vinod Koul Link: https://lore.kernel.org/r/20191115102705.649976-3-vkoul@kernel.org Signed-off-by: Mark Brown commit d2522335c92c090bf58531a2b696d7fe80ab2a7a Author: Vinod Koul Date: Fri Nov 15 15:57:03 2019 +0530 ALSA: compress: add flac decoder params The current design of sending codec parameters assumes that decoders will have parsers so they can parse the encoded stream for parameters and configure the decoder. But this assumption may not be universally true and we know some DSPs which do not contain the parsers so additional parameters are required to be passed. So add these parameters starting with FLAC decoder. The size of snd_codec_options is still 120 bytes after this change (due to this being a union) Co-developed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Signed-off-by: Vinod Koul Link: https://lore.kernel.org/r/20191115102705.649976-2-vkoul@kernel.org Acked-by: Takashi Iwai Signed-off-by: Mark Brown commit cd050abeba2a95fe5374eec28ad2244617bcbab6 Author: Chuhong Yuan Date: Mon Nov 18 10:48:48 2019 +0800 spi: st-ssc4: add missed pm_runtime_disable The driver forgets to call pm_runtime_disable in probe failure and remove. Add the missed calls to fix it. Signed-off-by: Chuhong Yuan Link: https://lore.kernel.org/r/20191118024848.21645-1-hslester96@gmail.com Signed-off-by: Mark Brown commit 1d7c4c115f7a835fec387d7f61767781381db5db Author: zhengbin Date: Mon Nov 18 18:59:22 2019 +0800 regulator: vexpress: Use PTR_ERR_OR_ZERO() to simplify code Fixes coccicheck warning: drivers/regulator/vexpress-regulator.c:78:1-3: WARNING: PTR_ERR_OR_ZERO can be used Reported-by: Hulk Robot Signed-off-by: zhengbin Link: https://lore.kernel.org/r/1574074762-34629-1-git-send-email-zhengbin13@huawei.com Signed-off-by: Mark Brown commit 48914c4ecb0c0fa1d70ea7b97d758ce5fadacfb0 Author: Thierry Reding Date: Mon Nov 18 07:33:48 2019 +0100 soc/tegra: pmc: Add reset sources and levels on Tegra194 Tegra194 supports the same reset levels as Tegra186 but extends the set of reset sources. Provide custom PMC register definitions to account for the larger field for the reset sources as well as the updated list of reset sources. Signed-off-by: Thierry Reding --- Changes in v2: - use the new Tegra194 register definitions commit a3b9ed55775eb18ca9f1641f13328f479a3653cb Author: kbuild test robot Date: Thu Nov 14 23:33:04 2019 +0800 ASoC: rt5677: rt5677_check_hotword() can be static Fixes: 21c00e5df439 ("ASoC: rt5677: Enable jack detect while DSP is running") Signed-off-by: kbuild test robot Link: https://lore.kernel.org/r/20191114153304.n4pyix7qadu76tx4@4978f4969bb8 Signed-off-by: Mark Brown commit cd4a709a19d58b7805b261ceac7bef94f423e08f Author: Thierry Reding Date: Mon Nov 18 07:33:47 2019 +0100 soc/tegra: pmc: Add missing IRQ callbacks on Tegra194 Reuse the IRQ callbacks from Tegra186 on Tegra194. This fixes failures to request interrupts on Tegra194 due to the missing callbacks. Cc: Sowjanya Komatineni Fixes: aba19827fced ("soc/tegra: pmc: Support wake events on more Tegra SoCs") Signed-off-by: Thierry Reding Acked-by: Jon Hunter Tested-by: Jon Hunter Signed-off-by: Thierry Reding commit dfd9d2dda8d0727bf3e1b191b6b78fb3c7b3a151 Author: Thierry Reding Date: Mon Nov 18 07:33:46 2019 +0100 soc/tegra: pmc: Use lower-case for hexadecimal literals The remainder of the file uses lower-case for hexadecimal literals, so change the only odd-one-out occurrence for consistency. Signed-off-by: Thierry Reding Acked-by: Jon Hunter Signed-off-by: Thierry Reding commit 44d13f6c2a0b739a7c4df3c478c8070320c4fd45 Author: Shuming Fan Date: Mon Nov 18 17:16:24 2019 +0800 ASoC: rt5682: fix the charge pump capacitor discharges Due to switching the HV to LV mode while stopping playback, the charge pump capacitor will be discharged to the source of the pump circuit. Therefore, this patch removed the event control. Signed-off-by: Shuming Fan Link: https://lore.kernel.org/r/20191118091624.18699-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 030d2829f4c22e675e21904f32ab60f659174e72 Author: Dmitry Osipenko Date: Fri Nov 15 19:26:42 2019 +0300 memory: tegra30-emc: Fix panic on suspend Trying to suspend driver results in a crash if timings aren't available in device-tree. Reported-by: Jon Hunter Fixes: e34212c75a68 ("memory: tegra: Introduce Tegra30 EMC driver") Signed-off-by: Dmitry Osipenko Acked-by: Jon Hunter Tested-by: Jon Hunter Signed-off-by: Thierry Reding commit fe289ebb65eee604f08fd1f8ab33ded3e955a7df Merge: 7ee30bc132c6 c7b7de631246 Author: Paolo Bonzini Date: Mon Nov 18 13:16:46 2019 +0100 Merge tag 'kvm-s390-next-5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: small fixes and enhancements - selftest improvements - yield improvements - cleanups commit 7da8abcf482adcc0d84ebf619f9f841058fccdb1 Author: zhengbin Date: Mon Nov 18 15:45:56 2019 +0800 staging: rtl8723bs: remove set but not used variable 'change', 'pos' Fixes gcc '-Wunused-but-set-variable' warning: drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c: In function cfg80211_rtw_change_iface: drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:1310:5: warning: variable change set but not used [-Wunused-but-set-variable] drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c: In function rtw_cfg80211_set_wpa_ie: drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:1803:19: warning: variable pos set but not used [-Wunused-but-set-variable] They are introduced by commit 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver"), but never used, so remove them. Reported-by: Hulk Robot Signed-off-by: zhengbin Link: https://lore.kernel.org/r/1574063156-68155-6-git-send-email-zhengbin13@huawei.com Signed-off-by: Greg Kroah-Hartman commit eb22caade58d6da19595f7a515ca4b8fdfccb9a2 Author: zhengbin Date: Mon Nov 18 15:45:55 2019 +0800 staging: rtl8723bs: remove set but not used variable 'notify_ielen', 'notify_ie', 'notify_interval', 'notify_capability' Fixes gcc '-Wunused-but-set-variable' warning: drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c: In function rtw_cfg80211_inform_bss: drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:248:9: warning: variable notify_ielen set but not used [-Wunused-but-set-variable] drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c: In function rtw_cfg80211_inform_bss: drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:247:6: warning: variable notify_ie set but not used [-Wunused-but-set-variable] drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c: In function rtw_cfg80211_inform_bss: drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:246:6: warning: variable notify_interval set but not used [-Wunused-but-set-variable] drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c: In function rtw_cfg80211_inform_bss: drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:245:6: warning: variable notify_capability set but not used [-Wunused-but-set-variable] They are introduced by commit 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver"), but never used, so remove them. Reported-by: Hulk Robot Signed-off-by: zhengbin Link: https://lore.kernel.org/r/1574063156-68155-5-git-send-email-zhengbin13@huawei.com Signed-off-by: Greg Kroah-Hartman commit 17b937a9d6f7ed4aeba0b610baafccf7e730e71f Author: zhengbin Date: Mon Nov 18 15:45:54 2019 +0800 staging: rtl8723bs: remove set but not used variable 'pmlmeinfo', 'pHalData' Fixes gcc '-Wunused-but-set-variable' warning: drivers/staging/rtl8723bs/hal/rtl8723b_cmd.c: In function ConstructBtNullFunctionData: drivers/staging/rtl8723bs/hal/rtl8723b_cmd.c:2099:24: warning: variable pmlmeinfo set but not used [-Wunused-but-set-variable] drivers/staging/rtl8723bs/hal/rtl8723b_cmd.c: In function SetFwRsvdPagePkt_BTCoex: drivers/staging/rtl8723bs/hal/rtl8723b_cmd.c:2154:24: warning: variable pmlmeinfo set but not used [-Wunused-but-set-variable] drivers/staging/rtl8723bs/hal/rtl8723b_cmd.c: In function SetFwRsvdPagePkt_BTCoex: drivers/staging/rtl8723bs/hal/rtl8723b_cmd.c:2149:23: warning: variable pHalData set but not used [-Wunused-but-set-variable] They are introduced by commit 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver"), but never used, so remove them. Reported-by: Hulk Robot Signed-off-by: zhengbin Link: https://lore.kernel.org/r/1574063156-68155-4-git-send-email-zhengbin13@huawei.com Signed-off-by: Greg Kroah-Hartman commit 68a65ab1b7f19a702679e06e5691e81ea0181a7a Author: zhengbin Date: Mon Nov 18 15:45:53 2019 +0800 staging: rtl8723bs: remove set but not used variable 'pHalData', 'pdmpriv' Fixes gcc '-Wunused-but-set-variable' warning: drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c: In function rtl8723b_InitAntenna_Selection: drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c:2237:23: warning: variable pHalData set but not used [-Wunused-but-set-variable] drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c: In function rtl8723b_fill_default_txdesc: drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c:3056:18: warning: variable pdmpriv set but not used [-Wunused-but-set-variable] They are introduced by commit 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver"), but never used, so remove them. Reported-by: Hulk Robot Signed-off-by: zhengbin Link: https://lore.kernel.org/r/1574063156-68155-3-git-send-email-zhengbin13@huawei.com Signed-off-by: Greg Kroah-Hartman commit 7fcd011a86dc17b57dd70276f948bacb5376022b Author: zhengbin Date: Mon Nov 18 15:45:52 2019 +0800 staging: rtl8723bs: remove set but not used variable 'pHalData', 'pregistrypriv' Fixes gcc '-Wunused-but-set-variable' warning: drivers/staging/rtl8723bs/hal/sdio_halinit.c: In function sdio_AggSettingRxUpdate: drivers/staging/rtl8723bs/hal/sdio_halinit.c:578:23: warning: variable pHalData set but not used [-Wunused-but-set-variable] drivers/staging/rtl8723bs/hal/sdio_halinit.c: In function rtl8723bs_hal_init: drivers/staging/rtl8723bs/hal/sdio_halinit.c:734:24: warning: variable pregistrypriv set but not used [-Wunused-but-set-variable] They are introduced by commit 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver"), but never used, so remove them. Reported-by: Hulk Robot Signed-off-by: zhengbin Link: https://lore.kernel.org/r/1574063156-68155-2-git-send-email-zhengbin13@huawei.com Signed-off-by: Greg Kroah-Hartman commit 04254066ac76a96dfaafd730a999daa678aa59c0 Author: zhengbin Date: Mon Nov 18 15:58:21 2019 +0800 staging: rtl8192e: remove set but not used variable 'frag' Fixes gcc '-Wunused-but-set-variable' warning: drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c: In function _rtl92e_process_phyinfo: drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c:1689:15: warning: variable frag set but not used [-Wunused-but-set-variable] It is introduced by commit 3d461c912462 ("rtl8192e: Split into two directories"), but never used, so remove it. Reported-by: Hulk Robot Signed-off-by: zhengbin Link: https://lore.kernel.org/r/1574063901-87429-1-git-send-email-zhengbin13@huawei.com Signed-off-by: Greg Kroah-Hartman commit 50b2b571c5f3df721fc81bf9a12c521dfbe019ba Author: Chuhong Yuan Date: Mon Nov 18 10:48:33 2019 +0800 serial: ifx6x60: add missed pm_runtime_disable The driver forgets to call pm_runtime_disable in remove. Add the missed calls to fix it. Signed-off-by: Chuhong Yuan Cc: stable Link: https://lore.kernel.org/r/20191118024833.21587-1-hslester96@gmail.com Signed-off-by: Greg Kroah-Hartman commit f6a196477184b99a31d16366a8e826558aa11f6d Author: Vincent Whitchurch Date: Mon Nov 18 10:25:47 2019 +0100 serial: pl011: Fix DMA ->flush_buffer() PL011's ->flush_buffer() implementation releases and reacquires the port lock. Due to a race condition here, data can end up being added to the circular buffer but neither being discarded nor being sent out. This leads to, for example, tcdrain(2) waiting indefinitely. Process A Process B uart_flush_buffer() - acquire lock - circ_clear - pl011_flush_buffer() -- release lock -- dmaengine_terminate_all() uart_write() - acquire lock - add chars to circ buffer - start_tx() -- start DMA - release lock -- acquire lock -- turn off DMA -- release lock // Data in circ buffer but DMA is off According to the comment in the code, the releasing of the lock around dmaengine_terminate_all() is to avoid a deadlock with the DMA engine callback. However, since the time this code was written, the DMA engine API documentation seems to have been clarified to say that dmaengine_terminate_all() (in the identically implemented but differently named dmaengine_terminate_async() variant) does not wait for any running complete callback to be completed and can even be called from a complete callback. So there is no possibility of deadlock if the DMA engine driver implements this API correctly. So we should be able to just remove this release and reacquire of the lock to prevent the aforementioned race condition. Signed-off-by: Vincent Whitchurch Cc: stable Link: https://lore.kernel.org/r/20191118092547.32135-1-vincent.whitchurch@axis.com Signed-off-by: Greg Kroah-Hartman commit 8530c37a70df71ea8a04fbafabba0b92f4475c6c Author: David Sterba Date: Fri Aug 30 15:42:07 2019 +0200 btrfs: get bdev from latest_dev for dio bh_result To remove use of extent_map::bdev we need to find a replacement, and the latest_bdev is the only one we can use here, because inode::i_bdev and superblock::s_bdev are NULL. The DIO code uses bdev in two places: * to read blocksize to perform alignment checks in do_blockdev_direct_IO, but we do them in btrfs code before any call to DIO * in the following call chain: do_direct_IO get_more_blocks sdio->get_block() <-- this is btrfs_get_blocks_direct subsequently the map_bh->b_dev member is used in clean_bdev_aliases and dio_new_bio to set the bio's bdev to that of the buffer_head. However, because we have provided a submit function dio_bio_submit calls our submission function and ignores the bdev. So it's safe to pass any valid bdev that's used within the filesystem. Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit c3e14909d3b399d49d8dfcf3edbcd5463a7eed6f Author: David Sterba Date: Fri May 10 17:48:30 2019 +0200 btrfs: assert extent_map bdevs and lookup_map and split This is a preparatory patch for removing extent_map::bdev. There's some history behind the code so this is only precaution to catch if things break before the actual removal happens. Logically, comparing a raw low-level block device (bdev) does not make sense for extent maps (high-level objects). This had no effect in practice but was quite confusing in the code. The lookup_map is set iff EXTENT_FLAG_FS_MAPPING is set. The two pointers were stored in the same bytes and used potentially in two meanings. Now they're split, so the asserts are in place to check that the condition will not change. The lookup map pointer misused bdev, this has been changed in commit 95617d69326c ("btrfs: cleanup, stop casting for extent_map->lookup everywhere") to the explicit type. But the semantics hasn't changed and bdev was not actually used to decide if maps are mergeable. Signed-off-by: David Sterba commit 32ab3d1b4d0c55daea9ba52c0f5d1363be21bf2a Author: Johannes Thumshirn Date: Fri Oct 18 11:58:23 2019 +0200 btrfs: remove pointless indentation in btrfs_read_sys_array() Instead of checking if we've read a BTRFS_CHUNK_ITEM_KEY from disk and then process it we could just bail out early if the read disk key wasn't a BTRFS_CHUNK_ITEM_KEY. This removes a level of indentation and makes the code nicer to read. Reviewed-by: Nikolay Borisov Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5ae216929069507efce3caff6f5618ec919cad11 Author: Johannes Thumshirn Date: Fri Oct 18 11:58:22 2019 +0200 btrfs: reduce indentation in btrfs_may_alloc_data_chunk In btrfs_may_alloc_data_chunk() we're checking if the chunk type is of type BTRFS_BLOCK_GROUP_DATA and if it is we process it. Instead of checking if the chunk type is a BTRFS_BLOCK_GROUP_DATA chunk we can negate the check and bail out early if it isn't. This makes the code a bit more readable. Reviewed-by: Nikolay Borisov Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 721860d5780c64d0757a205413c7eecddfd89039 Author: Johannes Thumshirn Date: Fri Oct 18 11:58:21 2019 +0200 btrfs: remove pointless local variable in lock_stripe_add() In lock_stripe_add() we're caching the bucket for the stripe hash table just for a single call to dereference the stripe hash. If we just directly call rbio_bucket() we can safe the pointless local variable. Also move the dereferencing of the stripe hash outside of the variable declaration block to not break over the 80 characters limit. Reviewed-by: Nikolay Borisov Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9d6cb1b0f9dfefac9cf2f62c8582aa892770b34e Author: Johannes Thumshirn Date: Fri Oct 18 11:58:20 2019 +0200 btrfs: raid56: reduce indentation in lock_stripe_add In lock_stripe_add() we're traversing the stripe hash list and check if the current list element's raid_map equals is equal to the raid bio's raid_map. If both are equal we continue processing. If we'd check for inequality instead of equality we can reduce one level of indentation. Reviewed-by: Nikolay Borisov Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1d2e7c7c3ed73cc510a4dc093df2a935092ff5ad Author: David Sterba Date: Thu Oct 17 13:28:57 2019 +0200 btrfs: tracepoints: constify all pointers We don't modify the data passed to tracepoints, some of the declarations are already const, add it to the rest. Signed-off-by: David Sterba commit 94c3f6c6b804c85c91aae0494c205ec7c81ce8d1 Author: David Sterba Date: Thu Oct 17 13:28:55 2019 +0200 btrfs: tracepoints: drop typecasts from printk Remove typecasts from trace printk, adjust types and move typecast to the assignment if necessary. When assigning, the types are more obvious compared to matching the variables to the format strings. Signed-off-by: David Sterba commit bc80230e0e7bc779cd553c2326ea5b3a5bac303b Author: Nikolay Borisov Date: Fri Sep 27 13:23:18 2019 +0300 btrfs: Return offset from find_desired_extent Instead of using an input pointer parameter as the return value and have an int as the return type of find_desired_extent, rework the function to directly return the found offset. Doing that the 'ret' variable in btrfs_llseek_file can be removed. Additional (subjective) benefit is that btrfs' llseek function now resemebles those of the other major filesystems. Reviewed-by: Johannes Thumshirn Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2034f3b470ccfd4103737cf4d2a25a52ce9ad002 Author: Nikolay Borisov Date: Fri Sep 27 13:23:17 2019 +0300 btrfs: Simplify btrfs_file_llseek Handle SEEK_END/SEEK_CUR in a single 'default' case by directly returning from generic_file_llseek. This makes the 'out' label redundant. Finally return directly the vale from vfs_setpos. No semantic changes. Reviewed-by: Johannes Thumshirn Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit d79b7c26b12279038b8b84bfcbe7bb3e53382b3f Author: Nikolay Borisov Date: Fri Sep 27 13:23:16 2019 +0300 btrfs: Speed up btrfs_file_llseek Modifying the file position is done on a per-file basis. This renders holding the inode lock for writing useless and makes the performance of concurrent llseek's abysmal. Fix this by holding the inode for read. This provides protection against concurrent truncates and find_desired_extent already includes proper extent locking for the range which ensures proper locking against concurrent writes. SEEK_CUR and SEEK_END can be done lockessly. The former is synchronized by file::f_lock spinlock. SEEK_END is not synchronized but atomic, but that's OK since there is not guarantee that SEEK_END will always be at the end of the file in the face of tail modifications. This change brings ~82% performance improvement when doing a lot of parallel fseeks. The workload essentially does: for (d=0; d Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0cf252131361cdeebb7dfc88dd8ec825fff0956a Author: David Sterba Date: Fri Oct 4 03:09:55 2019 +0200 btrfs: compression: remove ops pointer from workspace_manager We can infer the ops from the type that is now passed to all functions that would need it, this makes workspace_manager::ops redundant and can be removed. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 1e002351605db4f2fc4114cbb973d5aead72d006 Author: David Sterba Date: Fri Oct 4 02:57:22 2019 +0200 btrfs: compression: inline free_workspace Replace indirect calls to free_workspace by switch and calls to the specific callbacks. This is mainly to get rid of the indirection due to spectre vulnerability mitigations. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit a3bbd2a9ee3c08b60b3127843866bdc76757c24f Author: David Sterba Date: Fri Oct 4 02:50:28 2019 +0200 btrfs: compression: pass type to btrfs_put_workspace We can infer the workspace_manager from type and the type will be used in the following patch to call a common helper for free_workspace. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit c778df140644142fb7e12b7e468b137721d85890 Author: David Sterba Date: Fri Oct 4 02:47:39 2019 +0200 btrfs: compression: inline alloc_workspace Replace indirect calls to alloc_workspace by switch and calls to the specific callbacks. This is mainly to get rid of the indirection due to spectre vulnerability mitigations. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 5907a9bb13cea3bbf0c54d6a9a1ccf5edebedeed Author: David Sterba Date: Fri Oct 4 02:50:28 2019 +0200 btrfs: compression: pass type to btrfs_get_workspace We can infer the workspace_manager from type and the type will be used in the following patch to call a common helper for alloc_workspace. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit bd3a5287cc20e37f1e365be1f742b6c574e3f83c Author: David Sterba Date: Fri Oct 4 02:42:03 2019 +0200 btrfs: compression: inline put_workspace Similar to get_workspace, majority of the callbacks is trivial, we don't gain anything by the indirection, so replace them by a switch function. Trivial callback implementations use the helper. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 6a0d12724bd2dd1c766769578e221ce1d10a4656 Author: David Sterba Date: Fri Oct 4 02:36:16 2019 +0200 btrfs: compression: inline get_workspace Majority of the callbacks is trivial, we don't gain anything by the indirection, so replace them by a switch function. ZLIB needs to adjust level in the callback and ZSTD workspace management is complex, the rest is call to the helper. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit d20f395f98959dee592cf05af0bec7ab5b185e5e Author: David Sterba Date: Fri Oct 4 02:21:48 2019 +0200 btrfs: compression: export alloc/free/get/put callbacks of all algos The indirect calls will be replaced by a switch in compression.c. (Switch is faster than indirect calls with when Spectre mitigations are enabled). Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 2510307e6c78d1d9a59c85164cbff66f8a9f3fed Author: David Sterba Date: Wed Oct 2 01:08:03 2019 +0200 btrfs: compression: inline cleanup_workspace_manager Replace loop calling to all algos with a list of direct calls to the cleanup manager callback. When that becomes trivial it is replaced by direct call to the helper. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 2dba714390f1ff7a8a37cc8c3b374d71d3e84af7 Author: David Sterba Date: Fri Oct 4 01:40:58 2019 +0200 btrfs: compression: let workspace manager cleanup take only the type With the access to the workspace structures, we can look it up together with the compression ops inside the workspace manager cleanup helper. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit d551703347263b7f79168e51c2f999cb883b8d65 Author: David Sterba Date: Wed Oct 2 01:08:03 2019 +0200 btrfs: compression: inline init_workspace_manager Replace loop calling to all algos with a list of direct calls to the init manager callback. When that becomes trivial it is replaced by direct call to the helper. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 975db48330c492a84d8b29b10ae55a30a03dfe0f Author: David Sterba Date: Fri Oct 4 01:40:58 2019 +0200 btrfs: compression: let workspace manager init take only the type With the access to the workspace structures, we can look it up together with the compression ops inside the workspace manager init helper. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit be951045312d963ffeacd6a566a0de87e4784af1 Author: David Sterba Date: Wed Oct 2 00:53:31 2019 +0200 btrfs: compression: attach workspace manager to the ops There's a lot of indirection when the generic code calls into algo-specific callbacks to reach the private workspace manager structure and back to the generic code. To simplify that, export the workspace manager for heuristic, LZO and ZLIB, while ZSTD is going to use it's own manager. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 1e4eb7465438e47cc3718a02d4326dd034f3c0da Author: David Sterba Date: Wed Oct 2 00:06:15 2019 +0200 btrfs: switch compression callbacks to direct calls The indirect calls bring some overhead due to spectre vulnerability mitigations. The number of cases is small and below the threshold (10-20) where indirect call would be better. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit c4bf665a3197554a696121d20f3bf11d084a6961 Author: David Sterba Date: Tue Oct 1 22:38:34 2019 +0200 btrfs: export compression and decompression callbacks Export compress_pages, decompress_bio and decompress callbacks for all compression algos. The indirect calls will be replaced by a switch. Reviewed-by: Johannes Thumshirn Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit a60adce85f4bb5c1ef8ffcebadd702cafa2f3696 Author: Josef Bacik Date: Tue Sep 24 16:50:44 2019 -0400 btrfs: use btrfs_block_group_cache_done in update_block_group When free'ing extents in a block group we check to see if the block group is not cached, and then cache it if we need to. However we'll just carry on as long as we're loading the cache. This is problematic because we are dirtying the block group here. If we are fast enough we could do a transaction commit and clear the free space cache while we're still loading the space cache in another thread. This truncates the free space inode, which will keep it from loading the space cache. Fix this by using the btrfs_block_group_cache_done helper so that we try to load the space cache unconditionally here, which will result in the caller waiting for the fast caching to complete and keep us from truncating the free space inode. CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 3797136b626ad4b6582223660c041efdea8f26b2 Author: Josef Bacik Date: Tue Sep 24 16:50:43 2019 -0400 btrfs: check page->mapping when loading free space cache While testing 5.2 we ran into the following panic [52238.017028] BUG: kernel NULL pointer dereference, address: 0000000000000001 [52238.105608] RIP: 0010:drop_buffers+0x3d/0x150 [52238.304051] Call Trace: [52238.308958] try_to_free_buffers+0x15b/0x1b0 [52238.317503] shrink_page_list+0x1164/0x1780 [52238.325877] shrink_inactive_list+0x18f/0x3b0 [52238.334596] shrink_node_memcg+0x23e/0x7d0 [52238.342790] ? do_shrink_slab+0x4f/0x290 [52238.350648] shrink_node+0xce/0x4a0 [52238.357628] balance_pgdat+0x2c7/0x510 [52238.365135] kswapd+0x216/0x3e0 [52238.371425] ? wait_woken+0x80/0x80 [52238.378412] ? balance_pgdat+0x510/0x510 [52238.386265] kthread+0x111/0x130 [52238.392727] ? kthread_create_on_node+0x60/0x60 [52238.401782] ret_from_fork+0x1f/0x30 The page we were trying to drop had a page->private, but had no page->mapping and so called drop_buffers, assuming that we had a buffer_head on the page, and then panic'ed trying to deref 1, which is our page->private for data pages. This is happening because we're truncating the free space cache while we're trying to load the free space cache. This isn't supposed to happen, and I'll fix that in a followup patch. However we still shouldn't allow those sort of mistakes to result in messing with pages that do not belong to us. So add the page->mapping check to verify that we still own this page after dropping and re-acquiring the page lock. This page being unlocked as: btrfs_readpage extent_read_full_page __extent_read_full_page __do_readpage if (!nr) unlock_page <-- nr can be 0 only if submit_extent_page returns an error CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Reviewed-by: Nikolay Borisov Signed-off-by: Josef Bacik [ add callchain ] Signed-off-by: David Sterba commit 536870071dbc4278264f59c9a2f5f447e584d139 Author: Filipe Manana Date: Wed Oct 9 17:43:59 2019 +0100 Btrfs: fix metadata space leak on fixup worker failure to set range as delalloc In the fixup worker, if we fail to mark the range as delalloc in the io tree, we must release the previously reserved metadata, as well as update the outstanding extents counter for the inode, otherwise we leak metadata space. In pratice we can't return an error from btrfs_set_extent_delalloc(), which is just a wrapper around __set_extent_bit(), as for most errors __set_extent_bit() does a BUG_ON() (or panics which hits a BUG_ON() as well) and returning an -EEXIST error doesn't happen in this case since the exclusive bits parameter always has a value of 0 through this code path. Nevertheless, just fix the error handling in the fixup worker, in case one day __set_extent_bit() can return an error to this code path. Fixes: f3038ee3a3f101 ("btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker") CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Nikolay Borisov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a0e248bb502d5165b3314ac3819e888fdcdf7d9f Author: Filipe Manana Date: Fri Oct 11 16:41:20 2019 +0100 Btrfs: fix negative subv_writers counter and data space leak after buffered write When doing a buffered write it's possible to leave the subv_writers counter of the root, used for synchronization between buffered nocow writers and snapshotting. This happens in an exceptional case like the following: 1) We fail to allocate data space for the write, since there's not enough available data space nor enough unallocated space for allocating a new data block group; 2) Because of that failure, we try to go to NOCOW mode, which succeeds and therefore we set the local variable 'only_release_metadata' to true and set the root's sub_writers counter to 1 through the call to btrfs_start_write_no_snapshotting() made by check_can_nocow(); 3) The call to btrfs_copy_from_user() returns zero, which is very unlikely to happen but not impossible; 4) No pages are copied because btrfs_copy_from_user() returned zero; 5) We call btrfs_end_write_no_snapshotting() which decrements the root's subv_writers counter to 0; 6) We don't set 'only_release_metadata' back to 'false' because we do it only if 'copied', the value returned by btrfs_copy_from_user(), is greater than zero; 7) On the next iteration of the while loop, which processes the same page range, we are now able to allocate data space for the write (we got enough data space released in the meanwhile); 8) After this if we fail at btrfs_delalloc_reserve_metadata(), because now there isn't enough free metadata space, or in some other place further below (prepare_pages(), lock_and_cleanup_extent_if_need(), btrfs_dirty_pages()), we break out of the while loop with 'only_release_metadata' having a value of 'true'; 9) Because 'only_release_metadata' is 'true' we end up decrementing the root's subv_writers counter to -1 (through a call to btrfs_end_write_no_snapshotting()), and we also end up not releasing the data space previously reserved through btrfs_check_data_free_space(). As a consequence the mechanism for synchronizing NOCOW buffered writes with snapshotting gets broken. Fix this by always setting 'only_release_metadata' to false at the start of each iteration. Fixes: 8257b2dc3c1a ("Btrfs: introduce btrfs_{start, end}_nocow_write() for each subvolume") Fixes: 7ee9e4405f26 ("Btrfs: check if we can nocow if we don't have data space") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b929c1d8313c80f75979a3d7906a71a640eea171 Author: Marcos Paulo de Souza Date: Thu Oct 10 21:23:11 2019 -0300 btrfs: ioctl: Try to use btrfs_fs_info instead of *file Some functions are doing some unnecessary indirection to reach the btrfs_fs_info struct. Change these functions to receive a btrfs_fs_info struct instead of a *file. Reviewed-by: Anand Jain Reviewed-by: Nikolay Borisov Signed-off-by: Marcos Paulo de Souza Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4273eaff9b8d5e141113a5bdf9628c02acf3afe5 Author: Anand Jain Date: Thu Oct 10 10:39:25 2019 +0800 btrfs: use bool argument in free_root_pointers() We don't need int argument bool shall do in free_root_pointers(). And rename the argument as it confused two people. Reviewed-by: Qu Wenruo Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba commit ce96b7ffd11e261ef2ecd6817b7572a77750170d Author: Chengguang Xu Date: Thu Oct 10 15:59:57 2019 +0800 btrfs: use better definition of number of compression type The compression type upper limit constant is the same as the last value and this is confusing. In order to keep coding style consistent, use BTRFS_NR_COMPRESS_TYPES as the total number that follows the idom of 'NR' being one more than the last value. Signed-off-by: Chengguang Xu Reviewed-by: David Sterba Signed-off-by: David Sterba commit b9b1a53e180e2ab4cea42c95bf344e4bf7f524e7 Author: Chengguang Xu Date: Thu Oct 10 15:59:58 2019 +0800 btrfs: use enum for extent type defines Use enum to replace macro definitions of extent types. Signed-off-by: Chengguang Xu Reviewed-by: David Sterba Signed-off-by: David Sterba commit b2cd29596469f16e2a56bcd59d6cbf7f7652131f Author: Chengguang Xu Date: Thu Oct 10 15:59:56 2019 +0800 btrfs: props: remove unnecessary hash_init() DEFINE_HASHTABLE itself has already included initialization code, we don't have to call hash_init() again, so remove it. Signed-off-by: Chengguang Xu Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8d510121bfbf87302e0594d2022c5e7d52b26f7f Author: Nikolay Borisov Date: Tue Oct 8 20:43:06 2019 +0300 btrfs: Rename btrfs_join_transaction_nolock This function is used only during the final phase of freespace cache writeout. This is necessary since using the plain btrfs_join_transaction api is deadlock prone. The deadlock looks like: T1: btrfs_commit_transaction commit_cowonly_roots btrfs_write_dirty_block_groups btrfs_wait_cache_io __btrfs_wait_cache_io btrfs_wait_ordered_range <-- Triggers ordered IO for freespace inode and blocks transaction commit until freespace cache writeout T2: <-- after T1 has triggered the writeout finish_ordered_fn btrfs_finish_ordered_io btrfs_join_transaction <--- this would block waiting for current transaction to commit, but since trans commit is waiting for this writeout to finish The special purpose functions prevents it by simply skipping the "wait for writeout" since it's guaranteed the transaction won't proceed until we are done. Reviewed-by: Qu Wenruo Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit ce6d3eb6fd5cfede81c7a3d540919f6d92faaac0 Author: Nikolay Borisov Date: Tue Oct 8 16:26:16 2019 +0300 btrfs: User assert to document transaction requirement Using an ASSERT in btrfs_pin_extent allows to more stringently observe whether the function is called under a transaction or not. Reviewed-by: Johannes Thumshirn Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 67439dadb03ad9da45bfccb4cdb6ef6b1a7f8da9 Author: David Sterba Date: Tue Oct 8 13:28:47 2019 +0200 btrfs: opencode extent_buffer_get The helper is trivial and we can understand what the atomic_inc on something named refs does. Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: David Sterba commit f7bddf1e27d18fbc7d3e3056ba449cfbe4e20b0a Author: Tejun Heo Date: Thu Oct 3 07:27:13 2019 -0700 btrfs: Avoid getting stuck during cyclic writebacks During a cyclic writeback, extent_write_cache_pages() uses done_index to update the writeback_index after the current run is over. However, instead of current index + 1, it gets to to the current index itself. Unfortunately, this, combined with returning on EOF instead of looping back, can lead to the following pathlogical behavior. 1. There is a single file which has accumulated enough dirty pages to trigger balance_dirty_pages() and the writer appending to the file with a series of short writes. 2. balance_dirty_pages kicks in, wakes up background writeback and sleeps. 3. Writeback kicks in and the cursor is on the last page of the dirty file. Writeback is started or skipped if already in progress. As it's EOF, extent_write_cache_pages() returns and the cursor is set to done_index which is pointing to the last page. 4. Writeback is done. Nothing happens till balance_dirty_pages finishes, at which point we go back to #1. This can almost completely stall out writing back of the file and keep the system over dirty threshold for a long time which can mess up the whole system. We encountered this issue in production with a package handling application which can reliably reproduce the issue when running under tight memory limits. Reading the comment in the error handling section, this seems to be to avoid accidentally skipping a page in case the write attempt on the page doesn't succeed. However, this concern seems bogus. On each page, the code either: * Skips and moves onto the next page. * Fails issue and sets done_index to index + 1. * Successfully issues and continue to the next page if budget allows and not EOF. IOW, as long as it's not EOF and there's budget, the code never retries writing back the same page. Only when a page happens to be the last page of a particular run, we end up retrying the page, which can't possibly guarantee anything data integrity related. Besides, cyclic writes are only used for non-syncing writebacks meaning that there's no data integrity implication to begin with. Fix it by always setting done_index past the current page being processed. Note that this problem exists in other writepages too. CC: stable@vger.kernel.org # 4.19+ Signed-off-by: Tejun Heo Reviewed-by: David Sterba Signed-off-by: David Sterba commit a9143bd31c6ab52f6a320a1a4254f2a2934610b1 Author: Marcos Paulo de Souza Date: Mon Oct 7 21:50:38 2019 -0300 btrfs: block-group: Rework documentation of check_system_chunk function Commit 4617ea3a52cf (" Btrfs: fix necessary chunk tree space calculation when allocating a chunk") removed the is_allocation argument from check_system_chunk, since the formula for reserving the necessary space for allocation or removing a chunk would be the same. So, rework the comment by removing the mention of is_allocation argument. Signed-off-by: Marcos Paulo de Souza Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit c06631b0d8a4236fb45667de60880b037863de56 Author: Qu Wenruo Date: Fri Oct 4 17:31:33 2019 +0800 btrfs: Enhance error output for write time tree checker Unlike read time tree checker errors, write time error can't be inspected by "btrfs inspect dump-tree", so we need extra information to determine what's going wrong. The patch will add the following output for write time tree checker error: - The content of the offending tree block To help determining if it's a false alert. - Kernel WARN_ON() for debug build This is helpful for us to detect unexpected write time tree checker error, especially fstests could catch the dmesg. Since the WARN_ON() is only triggered for write time tree checker, test cases utilizing dm-error won't trigger this WARN_ON(), thus no extra noise. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 80d7fd1e09822daf8d94d46c6f9a17e7e34cf0b4 Author: Qu Wenruo Date: Fri Oct 4 17:31:32 2019 +0800 btrfs: tree-checker: Refactor prev_key check for ino into a function Refactor the check for prev_key->objectid of the following key types into one function, check_prev_ino(): - EXTENT_DATA - INODE_REF - DIR_INDEX - DIR_ITEM - XATTR_ITEM Also add the check of prev_key for INODE_REF. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit dbb70becde5b28940366ee419e0fdd3e09af44fb Author: Chris Mason Date: Wed Jul 10 12:28:18 2019 -0700 Btrfs: extent_write_locked_range() should attach inode->i_wb extent_write_locked_range() is used when we're falling back to buffered IO from inside of compression. It allocates its own wbc and should associate it with the inode's i_wb to make sure the IO goes down from the correct cgroup. Reviewed-by: Josef Bacik Signed-off-by: Chris Mason Signed-off-by: David Sterba commit ec39f7696ccfac85b3eea41eba7d6f747ee4ce8d Author: Chris Mason Date: Wed Jul 10 12:28:17 2019 -0700 Btrfs: use REQ_CGROUP_PUNT for worker thread submitted bios Async CRCs and compression submit IO through helper threads, which means they have IO priority inversions when cgroup IO controllers are in use. This flags all of the writes submitted by btrfs helper threads as REQ_CGROUP_PUNT. submit_bio() will punt these to dedicated per-blkcg work items to avoid the priority inversion. For the compression code, we take a reference on the wbc's blkg css and pass it down to the async workers. For the async CRCs, the bio already has the correct css, we just need to tell the block layer to use REQ_CGROUP_PUNT. Reviewed-by: Josef Bacik Signed-off-by: Chris Mason Modified-and-reviewed-by: Tejun Heo Signed-off-by: David Sterba commit 1d53c9e6723022b12e4a5ed4b141f67c834b7f6f Author: Chris Mason Date: Wed Jul 10 12:28:16 2019 -0700 Btrfs: only associate the locked page with one async_chunk struct The btrfs writepages function collects a large range of pages flagged for delayed allocation, and then sends them down through the COW code for processing. When compression is on, we allocate one async_chunk structure for every 512K, and then run those pages through the compression code for IO submission. writepages starts all of this off with a single page, locked by the original call to extent_write_cache_pages(), and it's important to keep track of this page because it has already been through clear_page_dirty_for_io(). The btrfs async_chunk struct has a pointer to the locked_page, and when we're redirtying the page because compression had to fallback to uncompressed IO, we use page->index to decide if a given async_chunk struct really owns that page. But, this is racey. If a given delalloc range is broken up into two async_chunks (chunkA and chunkB), we can end up with something like this: compress_file_range(chunkA) submit_compress_extents(chunkA) submit compressed bios(chunkA) put_page(locked_page) compress_file_range(chunkB) ... Or: async_cow_submit submit_compressed_extents <--- falls back to buffered writeout cow_file_range extent_clear_unlock_delalloc __process_pages_contig put_page(locked_pages) async_cow_submit The end result is that chunkA is completed and cleaned up before chunkB even starts processing. This means we can free locked_page() and reuse it elsewhere. If we get really lucky, it'll have the same page->index in its new home as it did before. While we're processing chunkB, we might decide we need to fall back to uncompressed IO, and so compress_file_range() will call __set_page_dirty_nobufers() on chunkB->locked_page. Without cgroups in use, this creates as a phantom dirty page, which isn't great but isn't the end of the world. What can happen, it can go through the fixup worker and the whole COW machinery again: in submit_compressed_extents(): while (async extents) { ... cow_file_range if (!page_started ...) extent_write_locked_range else if (...) unlock_page continue; This hasn't been observed in practice but is still possible. With cgroups in use, we might crash in the accounting code because page->mapping->i_wb isn't set. BUG: unable to handle kernel NULL pointer dereference at 00000000000000d0 IP: percpu_counter_add_batch+0x11/0x70 PGD 66534e067 P4D 66534e067 PUD 66534f067 PMD 0 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC CPU: 16 PID: 2172 Comm: rm Not tainted RIP: 0010:percpu_counter_add_batch+0x11/0x70 RSP: 0018:ffffc9000a97bbe0 EFLAGS: 00010286 RAX: 0000000000000005 RBX: 0000000000000090 RCX: 0000000000026115 RDX: 0000000000000030 RSI: ffffffffffffffff RDI: 0000000000000090 RBP: 0000000000000000 R08: fffffffffffffff5 R09: 0000000000000000 R10: 00000000000260c0 R11: ffff881037fc26c0 R12: ffffffffffffffff R13: ffff880fe4111548 R14: ffffc9000a97bc90 R15: 0000000000000001 FS: 00007f5503ced480(0000) GS:ffff880ff7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000d0 CR3: 00000001e0459005 CR4: 0000000000360ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: account_page_cleaned+0x15b/0x1f0 __cancel_dirty_page+0x146/0x200 truncate_cleanup_page+0x92/0xb0 truncate_inode_pages_range+0x202/0x7d0 btrfs_evict_inode+0x92/0x5a0 evict+0xc1/0x190 do_unlinkat+0x176/0x280 do_syscall_64+0x63/0x1a0 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The fix here is to make asyc_chunk->locked_page NULL everywhere but the one async_chunk struct that's allowed to do things to the locked page. Link: https://lore.kernel.org/linux-btrfs/c2419d01-5c84-3fb4-189e-4db519d08796@suse.com/ Fixes: 771ed689d2cd ("Btrfs: Optimize compressed writeback and reads") Reviewed-by: Josef Bacik Signed-off-by: Chris Mason [ update changelog from mail thread discussion ] Signed-off-by: David Sterba commit ba8a9d07954397f0645cf62bcc1ef536e8e7ba24 Author: Chris Mason Date: Wed Jul 10 12:28:15 2019 -0700 Btrfs: delete the entire async bio submission framework Now that we're not using btrfs_schedule_bio() anymore, delete all the code that supported it. Reviewed-by: Josef Bacik Reviewed-by: Nikolay Borisov Signed-off-by: Chris Mason Reviewed-by: David Sterba Signed-off-by: David Sterba commit 08635bae0b4ceb08fe4c156a11c83baec397d36d Author: Chris Mason Date: Wed Jul 10 12:28:14 2019 -0700 Btrfs: stop using btrfs_schedule_bio() btrfs_schedule_bio() hands IO off to a helper thread to do the actual submit_bio() call. This has been used to make sure async crc and compression helpers don't get stuck on IO submission. To maintain good performance, over time the IO submission threads duplicated some IO scheduler characteristics such as high and low priority IOs and they also made some ugly assumptions about request allocation batch sizes. All of this cost at least one extra context switch during IO submission, and doesn't fit well with the modern blkmq IO stack. So, this commit stops using btrfs_schedule_bio(). We may need to adjust the number of async helper threads for crcs and compression, but long term it's a better path. Reviewed-by: Josef Bacik Reviewed-by: Nikolay Borisov Signed-off-by: Chris Mason Reviewed-by: David Sterba Signed-off-by: David Sterba commit e1f60a6580c04d0d2492bb6034e968b8c29c78cf Author: David Sterba Date: Tue Oct 1 19:57:39 2019 +0200 btrfs: add __pure attribute to functions The attribute is more relaxed than const and the functions could dereference pointers, as long as the observable state is not changed. We do have such functions, based on -Wsuggest-attribute=pure . The visible effects of this patch are negligible, there are differences in the assembly but hard to summarize. Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 4143cb8b6f00910e73a7503fd922211b9f08cf48 Author: David Sterba Date: Tue Oct 1 19:57:37 2019 +0200 btrfs: add const function attribute For some reason the attribute is called __attribute_const__ and not __const, marks functions that have no observable effects on program state, IOW not reading pointers, just the arguments and calculating a value. Allows the compiler to do some optimizations, based on -Wsuggest-attribute=const . The effects are rather small, though, about 60 bytes decrese of btrfs.ko. Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit b105e92755b448efd4800e3415dfeae5ad8054e9 Author: David Sterba Date: Tue Oct 1 19:57:35 2019 +0200 btrfs: add __cold attribute to more functions The attribute can mark functions supposed to be called rarely if at all and the text can be moved to sections far from the other code. The attribute has been added to several functions already, this patch is based on hints given by gcc -Wsuggest-attribute=cold. The net effect of this patch is decrease of btrfs.ko by 1000-1300, depending on the config options. Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 4c66e0d4243bb8829f2c936e966030d967726e90 Author: David Sterba Date: Thu Oct 3 19:09:35 2019 +0200 btrfs: drop unused parameter is_new from btrfs_iget The parameter is now always set to NULL and could be dropped. The last user was get_default_root but that got reworked in 05dbe6837b60 ("Btrfs: unify subvol= and subvolid= mounting") and the parameter became unused. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit baf320b9d531f1cfbf64c60dd155ff80a58b3796 Author: Josef Bacik Date: Thu Sep 26 08:29:32 2019 -0400 btrfs: use refcount_inc_not_zero in kill_all_nodes We hit the following warning while running down a different problem [ 6197.175850] ------------[ cut here ]------------ [ 6197.185082] refcount_t: underflow; use-after-free. [ 6197.194704] WARNING: CPU: 47 PID: 966 at lib/refcount.c:190 refcount_sub_and_test_checked+0x53/0x60 [ 6197.521792] Call Trace: [ 6197.526687] __btrfs_release_delayed_node+0x76/0x1c0 [ 6197.536615] btrfs_kill_all_delayed_nodes+0xec/0x130 [ 6197.546532] ? __btrfs_btree_balance_dirty+0x60/0x60 [ 6197.556482] btrfs_clean_one_deleted_snapshot+0x71/0xd0 [ 6197.566910] cleaner_kthread+0xfa/0x120 [ 6197.574573] kthread+0x111/0x130 [ 6197.581022] ? kthread_create_on_node+0x60/0x60 [ 6197.590086] ret_from_fork+0x1f/0x30 [ 6197.597228] ---[ end trace 424bb7ae00509f56 ]--- This is because the free side drops the ref without the lock, and then takes the lock if our refcount is 0. So you can have nodes on the tree that have a refcount of 0. Fix this by zero'ing out that element in our temporary array so we don't try to kill it again. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Nikolay Borisov Signed-off-by: Josef Bacik Reviewed-by: David Sterba [ add comment ] Signed-off-by: David Sterba commit aa6c0df73e3b3fc771d8d8469eb81537f4b46a45 Author: Anand Jain Date: Wed Oct 2 18:30:48 2019 +0800 btrfs: print process name and pid that calls device scanning Its very helpful if we had logged the device scanner process name to debug the race condition between the systemd-udevd scan and the user initiated device forget command. This patch adds process name and pid to the scan message. Signed-off-by: Anand Jain Reviewed-by: David Sterba [ add pid to the message ] Signed-off-by: David Sterba commit 725af92a62511aee68216438192041135bf14238 Author: Nikolay Borisov Date: Fri Aug 30 17:44:49 2019 +0300 btrfs: Open-code name_in_log_ref in replay_one_name That function adds unnecessary indirection between backref_in_log and the caller. Furthermore it also "downgrades" backref_in_log's return value to a boolean, when in fact it could very well be an error. Rectify the situation by simply opencoding name_in_log_ref in replay_one_name and properly handling possible return codes from backref_in_log. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba [ update comment ] Signed-off-by: David Sterba commit d3316c8233bb05e0dd855d30aac347bb8ad76ee4 Author: Nikolay Borisov Date: Wed Sep 25 14:03:03 2019 +0300 btrfs: Properly handle backref_in_log retval This function can return a negative error value if btrfs_search_slot errors for whatever reason or if btrfs_alloc_path runs out of memory. This is currently problemattic because backref_in_log is treated by its callers as if it returns boolean. Fix this by adding proper error handling in callers. That also enables the function to return the direct error code from btrfs_search_slot. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 89cbf5f6b6c2a5f0ac7cb83c8b3fd97eadba0d11 Author: Nikolay Borisov Date: Fri Aug 30 17:44:47 2019 +0300 btrfs: Don't opencode btrfs_find_name_in_backref in backref_in_log Direct replacement, though note that the inside of the loop in btrfs_find_name_in_backref is organized in a slightly different way but is equvalent. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba [ add changelog ] Signed-off-by: David Sterba commit 3296bf562443a8ca35aaad959a76a49e9b412760 Author: Qu Wenruo Date: Thu Aug 22 15:25:00 2019 +0800 btrfs: transaction: Cleanup unused TRANS_STATE_BLOCKED The state was introduced in commit 4a9d8bdee368 ("Btrfs: make the state of the transaction more readable"), then in commit 302167c50b32 ("btrfs: don't end the transaction for delayed refs in throttle") the state is completely removed. So we can just clean up the state since it's only compared but never set. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 61c047b541b56f4ec78886e9d695e0a3bbcd3834 Author: Qu Wenruo Date: Thu Aug 22 15:24:59 2019 +0800 btrfs: transaction: describe transaction states and transitions Add an overview of the basic btrfs transaction transitions, including the following states: - No transaction states - Transaction N [[TRANS_STATE_RUNNING]] - Transaction N [[TRANS_STATE_COMMIT_START]] - Transaction N [[TRANS_STATE_COMMIT_DOING]] - Transaction N [[TRANS_STATE_UNBLOCKED]] - Transaction N [[TRANS_STATE_COMPLETED]] For each state, the comment will include: - Basic explaination about current state - How to go next stage - What will happen if we call various start_transaction() functions - Relationship to transaction N+1 This doesn't provide tech details, but serves as a cheat sheet for reader to get into the code a little easier. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit c1499166d10ae734b5ec5cc7982bd9b9ee7f9fe6 Author: David Sterba Date: Tue Oct 1 19:44:42 2019 +0200 btrfs: use has_single_bit_set for clarity Replace is_power_of_2 with the helper that is self-documenting and remove the open coded call in alloc_profile_is_valid. Signed-off-by: David Sterba commit 79c8264e443471eb2748c93680acce54d14d2225 Author: David Sterba Date: Tue Oct 1 19:40:15 2019 +0200 btrfs: add 64bit safe helper for power of two checks As is_power_of_two takes unsigned long, it's not safe on 32bit architectures, but we could pass any u64 value in seveal places. Add a separate helper and also an alias that better expresses the purpose for which the helper is used. Signed-off-by: David Sterba commit e62869be1ed7569bf12a5dc28c5b7ee5823f9cf3 Author: Anand Jain Date: Wed Sep 25 14:29:28 2019 +0800 btrfs: balance: use term redundancy instead of integrity in message When balance reduces the number of copies of metadata, it reduces the redundancy, use the term redundancy instead of integrity. Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1f95ec012cb4a3fabfef3efd9ba0b59e14ce48ce Author: David Sterba Date: Tue Sep 24 19:17:17 2019 +0200 btrfs: move btrfs_unlock_up_safe to other locking functions The function belongs to the family of locking functions, so move it there. The 'noinline' keyword is dropped as it's now an exported function that does not need it. Reviewed-by: Josef Bacik Signed-off-by: David Sterba commit ed2b1d36a9d027f9b841be5bfc9d61011462d447 Author: David Sterba Date: Tue Sep 24 19:17:17 2019 +0200 btrfs: move btrfs_set_path_blocking to other locking functions The function belongs to the family of locking functions, so move it there. The 'noinline' keyword is dropped as it's now an exported function that does not need it. Reviewed-by: Josef Bacik Signed-off-by: David Sterba commit 31f6e769ce4145fdfaba44ad7c5b30ad21f58c11 Author: David Sterba Date: Tue Sep 24 18:44:24 2019 +0200 btrfs: make btrfs_assert_tree_locked static inline The function btrfs_assert_tree_locked is used outside of the locking code so it is exported, however we can make it static inine as it's fairly trivial. This is the only locking assertion used in release builds, inlining improves the text size by 174 bytes and reduces stack consumption in the callers. Reviewed-by: Josef Bacik Signed-off-by: David Sterba commit d6156218bec93965b6a43ba2686ad962ce77c854 Author: David Sterba Date: Tue Sep 24 18:29:10 2019 +0200 btrfs: make locking assertion helpers static inline I've noticed that none of the btrfs_assert_*lock* debugging helpers is inlined, despite they're short and mostly a value update. Making them inline shaves 67 from the text size, reduces stack consumption and perhaps also slightly improves the performance due to avoiding unnecessary calls. Reviewed-by: Josef Bacik Signed-off-by: David Sterba commit c9eb55db8439057165f106164622c146cdd59468 Author: Omar Sandoval Date: Mon Sep 16 11:30:58 2019 -0700 btrfs: get rid of pointless wtag variable in async-thread.c Commit ac0c7cf8be00 ("btrfs: fix crash when tracepoint arguments are freed by wq callbacks") added a void pointer, wtag, which is passed into trace_btrfs_all_work_done() instead of the freed work item. This is silly for a few reasons: 1. The freed work item still has the same address. 2. work is still in scope after it's freed, so assigning wtag doesn't stop anyone from using it. 3. The tracepoint has always taken a void * argument, so assigning wtag doesn't actually make things any more type-safe. (Note that the original bug in commit bc074524e123 ("btrfs: prefix fsid to all trace events") was that the void * was implicitly casted when it was passed to btrfs_work_owner() in the trace point itself). Instead, let's add some clearer warnings as comments. Reviewed-by: Nikolay Borisov Reviewed-by: Filipe Manana Signed-off-by: Omar Sandoval Reviewed-by: David Sterba Signed-off-by: David Sterba commit a0cac0ec961f0d42828eeef196ac2246a2f07659 Author: Omar Sandoval Date: Mon Sep 16 11:30:57 2019 -0700 btrfs: get rid of unique workqueue helper functions Commit 9e0af2376434 ("Btrfs: fix task hang under heavy compressed write") worked around the issue that a recycled work item could get a false dependency on the original work item due to how the workqueue code guarantees non-reentrancy. It did so by giving different work functions to different types of work. However, the fixes in the previous few patches are more complete, as they prevent a work item from being recycled at all (except for a tiny window that the kernel workqueue code handles for us). This obsoletes the previous fix, so we don't need the unique helpers for correctness. The only other reason to keep them would be so they show up in stack traces, but they always seem to be optimized to a tail call, so they don't show up anyways. So, let's just get rid of the extra indirection. While we're here, rename normal_work_helper() to the more informative btrfs_work_helper(). Reviewed-by: Nikolay Borisov Reviewed-by: Filipe Manana Signed-off-by: Omar Sandoval Reviewed-by: David Sterba Signed-off-by: David Sterba commit 57d4f0b863272ba04ba85f86bfdc0f976f0af91c Author: Omar Sandoval Date: Mon Sep 16 11:30:56 2019 -0700 btrfs: don't prematurely free work in scrub_missing_raid56_worker() Currently, scrub_missing_raid56_worker() puts and potentially frees sblock (which embeds the work item) and then submits a bio through scrub_wr_submit(). This is another potential instance of the bug in "btrfs: don't prematurely free work in run_ordered_work()". Fix it by dropping the reference after we submit the bio. Reviewed-by: Johannes Thumshirn Signed-off-by: Omar Sandoval Reviewed-by: David Sterba Signed-off-by: David Sterba commit e732fe95e4cad35fc1df278c23a32903341b08b3 Author: Omar Sandoval Date: Mon Sep 16 11:30:55 2019 -0700 btrfs: don't prematurely free work in reada_start_machine_worker() Currently, reada_start_machine_worker() frees the reada_machine_work and then calls __reada_start_machine() to do readahead. This is another potential instance of the bug in "btrfs: don't prematurely free work in run_ordered_work()". There _might_ already be a deadlock here: reada_start_machine_worker() can depend on itself through stacked filesystems (__read_start_machine() -> reada_start_machine_dev() -> reada_tree_block_flagged() -> read_extent_buffer_pages() -> submit_one_bio() -> btree_submit_bio_hook() -> btrfs_map_bio() -> submit_stripe_bio() -> submit_bio() onto a loop device can trigger readahead on the lower filesystem). Either way, let's fix it by freeing the work at the end. Reviewed-by: Johannes Thumshirn Signed-off-by: Omar Sandoval Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9be490f1e15c34193b1aae17da58e14dd9f55a95 Author: Omar Sandoval Date: Mon Sep 16 11:30:54 2019 -0700 btrfs: don't prematurely free work in end_workqueue_fn() Currently, end_workqueue_fn() frees the end_io_wq entry (which embeds the work item) and then calls bio_endio(). This is another potential instance of the bug in "btrfs: don't prematurely free work in run_ordered_work()". In particular, the endio call may depend on other work items. For example, btrfs_end_dio_bio() can call btrfs_subio_endio_read() -> __btrfs_correct_data_nocsum() -> dio_read_error() -> submit_dio_repair_bio(), which submits a bio that is also completed through a end_workqueue_fn() work item. However, __btrfs_correct_data_nocsum() waits for the newly submitted bio to complete, thus it depends on another work item. This example currently usually works because we use different workqueue helper functions for BTRFS_WQ_ENDIO_DATA and BTRFS_WQ_ENDIO_DIO_REPAIR. However, it may deadlock with stacked filesystems and is fragile overall. The proper fix is to free the work item at the very end of the work function, so let's do that. Reviewed-by: Johannes Thumshirn Signed-off-by: Omar Sandoval Reviewed-by: David Sterba Signed-off-by: David Sterba commit c495dcd6fbe1dce51811a76bb85b4675f6494938 Author: Omar Sandoval Date: Mon Sep 16 11:30:53 2019 -0700 btrfs: don't prematurely free work in run_ordered_work() We hit the following very strange deadlock on a system with Btrfs on a loop device backed by another Btrfs filesystem: 1. The top (loop device) filesystem queues an async_cow work item from cow_file_range_async(). We'll call this work X. 2. Worker thread A starts work X (normal_work_helper()). 3. Worker thread A executes the ordered work for the top filesystem (run_ordered_work()). 4. Worker thread A finishes the ordered work for work X and frees X (work->ordered_free()). 5. Worker thread A executes another ordered work and gets blocked on I/O to the bottom filesystem (still in run_ordered_work()). 6. Meanwhile, the bottom filesystem allocates and queues an async_cow work item which happens to be the recently-freed X. 7. The workqueue code sees that X is already being executed by worker thread A, so it schedules X to be executed _after_ worker thread A finishes (see the find_worker_executing_work() call in process_one_work()). Now, the top filesystem is waiting for I/O on the bottom filesystem, but the bottom filesystem is waiting for the top filesystem to finish, so we deadlock. This happens because we are breaking the workqueue assumption that a work item cannot be recycled while it still depends on other work. Fix it by waiting to free the work item until we are done with all of the related ordered work. P.S.: One might ask why the workqueue code doesn't try to detect a recycled work item. It actually does try by checking whether the work item has the same work function (find_worker_executing_work()), but in our case the function is the same. This is the only key that the workqueue code has available to compare, short of adding an additional, layer-violating "custom key". Considering that we're the only ones that have ever hit this, we should just play by the rules. Unfortunately, we haven't been able to create a minimal reproducer other than our full container setup using a compress-force=zstd filesystem on top of another compress-force=zstd filesystem. Suggested-by: Tejun Heo Reviewed-by: Johannes Thumshirn Signed-off-by: Omar Sandoval Reviewed-by: David Sterba Signed-off-by: David Sterba commit cdc6f1668e1f41b9fbdb0ae075b789c5fa0bec4b Author: Omar Sandoval Date: Mon Sep 16 11:30:52 2019 -0700 btrfs: get rid of unnecessary memset() of work item Commit fc97fab0ea59 ("btrfs: Replace fs_info->qgroup_rescan_worker workqueue with btrfs_workqueue.") converted qgroup_rescan_work to be initialized with btrfs_init_work(), but it left behind an unnecessary memset(). Get rid of the memset(). Reviewed-by: Johannes Thumshirn Signed-off-by: Omar Sandoval Reviewed-by: David Sterba Signed-off-by: David Sterba commit b3f167aa6c7053b87fa53364fc40dd4757f053c9 Author: Josef Bacik Date: Mon Sep 23 10:05:21 2019 -0400 btrfs: move the failrec tree stuff into extent-io-tree.h This needs to be cleaned up in the future, but for now it belongs to the extent-io-tree stuff since it uses the internal tree search code. Needed to export get_state_failrec and set_state_failrec as well since we're not going to move the actual IO part of the failrec stuff out at this point. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 083e75e7e6a9e24b041ed9cc668dc7a500e31919 Author: Josef Bacik Date: Mon Sep 23 10:05:20 2019 -0400 btrfs: export find_delalloc_range This utilizes internal stuff to the extent_io_tree, so we need to export it before we move it. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9c7d3a548331e72ba3613eaa5c8a74839462b764 Author: Josef Bacik Date: Mon Sep 23 10:05:19 2019 -0400 btrfs: move extent_io_tree defs to their own header extent_io.c/h are huge, encompassing a bunch of different things. The extent_io_tree code can live on its own, so separate this out. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6f0d04f8e72e1c7fd17e7fac0fea82553a6443b4 Author: Josef Bacik Date: Mon Sep 23 10:05:18 2019 -0400 btrfs: separate out the extent io init function We are moving extent_io_tree into it's on file, so separate out the extent_state init stuff from extent_io_tree_init(). Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 33ca832fefa5ebf66df983783522c888b851fbe4 Author: Josef Bacik Date: Mon Sep 23 10:05:17 2019 -0400 btrfs: separate out the extent leak code We check both extent buffer and extent state leaks in the same function, separate these two functions out so we can move them around. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 34ffafdba12eee3e387694edd128e954fd355e8e Author: Qu Wenruo Date: Tue Sep 10 15:40:19 2019 +0800 btrfs: ctree: Remove stray comment of setting up path lock The following comment shows up in btrfs_search_slot() with out much sense: /* * setup the path here so we can release it under lock * contention with the cow code */ if (cow) { /* code touching path->lock[] is far away from here */ } This comment hasn't been cleaned up after the relevant code has been removed. The original code is introduced in commit 65b51a009e29 ("btrfs_search_slot: reduce lock contention by cowing in two stages"): + + /* + * setup the path here so we can release it under lock + * contention with the cow code + */ + p->nodes[level] = b; + if (!p->skip_locking) + p->locks[level] = 1; + But in current code, we have different timing for modifying path lock, so just remove the comment. Reviewed-by: Nikolay Borisov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit abe9339d69bd096e2020ffc39fedee2ac0a9c03b Author: Qu Wenruo Date: Tue Sep 10 15:40:18 2019 +0800 btrfs: ctree: Reduce one indent level for btrfs_search_old_slot() Similar to btrfs_search_slot() done in previous patch, make a shortcut for the level 0 case and allow to reduce indentation for the remaining case. Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit f624d976081d371b3dea65935501d8d9f142d5df Author: Qu Wenruo Date: Tue Sep 10 15:40:17 2019 +0800 btrfs: ctree: Reduce one indent level for btrfs_search_slot() In btrfs_search_slot(), we something like: if (level != 0) { /* Do search inside tree nodes*/ } else { /* Do search inside tree leaves */ goto done; } This caused extra indent for tree node search code. Change it to something like: if (level == 0) { /* Do search inside tree leaves */ goto done' } /* Do search inside tree nodes */ So we have more space to maneuver our code, this is especially useful as the tree nodes search code is more complex than the leaves search code. Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 71bf92a9b8777635fede96eb4ab3b5b7bf310159 Author: Qu Wenruo Date: Mon Aug 26 15:40:39 2019 +0800 btrfs: tree-checker: Add check for INODE_REF For INODE_REF we will check: - Objectid (ino) against previous key To detect missing INODE_ITEM. - No overflow/padding in the data payload Much like DIR_ITEM, but with less members to check. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit c18679ebd86857d4dae5a7462f38c4c98d8445de Author: Qu Wenruo Date: Mon Aug 26 15:40:38 2019 +0800 btrfs: tree-checker: Try to detect missing INODE_ITEM For the following items, key->objectid is inode number: - DIR_ITEM - DIR_INDEX - XATTR_ITEM - EXTENT_DATA - INODE_REF So in the subvolume tree, such items must have its previous item share the same objectid, e.g.: (257 INODE_ITEM 0) (257 DIR_INDEX xxx) (257 DIR_ITEM xxx) (258 INODE_ITEM 0) (258 INODE_REF 0) (258 XATTR_ITEM 0) (258 EXTENT_DATA 0) But if we have the following sequence, then there is definitely something wrong, normally some INODE_ITEM is missing, like: (257 INODE_ITEM 0) (257 DIR_INDEX xxx) (257 DIR_ITEM xxx) (258 XATTR_ITEM 0) <<< objecitd suddenly changed to 258 (258 EXTENT_DATA 0) So just by checking the previous key for above inode based key types, we can detect a missing inode item. For INODE_REF key type, the check will be added along with INODE_REF checker. Reviewed-by: Nikolay Borisov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit b9fae2ebee0cc3a16e1b61fa397099886886e906 Author: Filipe Manana Date: Wed Sep 11 17:42:38 2019 +0100 Btrfs: make btrfs_wait_extents() static It's not used ouside of transaction.c Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 35b814f3c53e0635cbb1de3ea5d58776eafe8e20 Author: Nikolay Borisov Date: Thu Sep 12 18:31:44 2019 +0300 btrfs: Add assert to catch nested transaction commit A recent patch to btrfs showed that there was at least 1 case where a nested transaction was committed. Nested transaction in this case means a code which has a transaction handle calls some function which in turn obtains a copy of the same transaction handle. In such cases the correct thing to do is for the lower callee to call btrfs_end_transaction which contains appropriate checks so as to not commit the transaction which will result in stale trans handler for the caller. To catch such cases add an assert in btrfs_commit_transaction ensuring btrfs_trans_handle::use_count is always 1. Reviewed-by: Josef Bacik Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9cf35f673583ccc9f3e2507498b3079d56614ad3 Author: Goldwyn Rodrigues Date: Wed Sep 11 11:45:15 2019 -0500 btrfs: simplify inode locking for RWF_NOWAIT This is similar to 942491c9e6d6 ("xfs: fix AIM7 regression"). Apparently our current rwsem code doesn't like doing the trylock, then lock for real scheme. This causes extra contention on the lock and can be measured eg. by AIM7 benchmark. So change our read/write methods to just do the trylock for the RWF_NOWAIT case. Fixes: edf064e7c6fe ("btrfs: nowait aio support") Signed-off-by: Goldwyn Rodrigues Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit 65cc8bf99349f651a0a2cee69333525fe581f306 Author: Oliver Neukum Date: Thu Nov 14 12:27:58 2019 +0100 USB: documentation: flags on usb-storage versus UAS Document which flags work storage, UAS or both Signed-off-by: Oliver Neukum Cc: stable Link: https://lore.kernel.org/r/20191114112758.32747-4-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 335cbbd5762d5e5c67a8ddd6e6362c2aa42a328f Author: Oliver Neukum Date: Thu Nov 14 12:27:57 2019 +0100 USB: uas: heed CAPACITY_HEURISTICS There is no need to ignore this flag. We should be as close to storage in that regard as makes sense, so honor flags whose cost is tiny. Signed-off-by: Oliver Neukum Cc: stable Link: https://lore.kernel.org/r/20191114112758.32747-3-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit bff000cae1eec750d62e265c4ba2db9af57b17e1 Author: Oliver Neukum Date: Thu Nov 14 12:27:56 2019 +0100 USB: uas: honor flag to avoid CAPACITY16 Copy the support over from usb-storage to get feature parity Signed-off-by: Oliver Neukum Cc: stable Link: https://lore.kernel.org/r/20191114112758.32747-2-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 6351653febbb784d86fdf83afe41f7523a61b392 Author: Nagarjuna Kristam Date: Mon Nov 4 14:54:30 2019 +0530 usb: host: xhci-tegra: Correct phy enable sequence XUSB phy needs to be enabled before un-powergating the power partitions. However in the current sequence, it happens opposite. Correct the phy enable and powergating partition sequence to avoid any boot hangs. Signed-off-by: Nagarjuna Kristam Cc: stable Signed-off-by: Jui Chang Kuo Tested-by: Jon Hunter Acked-by: Thierry Reding Link: https://lore.kernel.org/r/1572859470-7823-1-git-send-email-nkristam@nvidia.com Signed-off-by: Greg Kroah-Hartman commit b38bcc8e12062452ae86158a3bbc4235fd395d91 Merge: 347bc8cb2638 4d6141288c33 Author: Greg Kroah-Hartman Date: Mon Nov 18 12:29:13 2019 +0100 Merge tag 'usb-ci-v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-next Peter writes: - Improve the Vbus handler - Improve the HSIC handler for i.mx serial SoC - Some other tiny changes * tag 'usb-ci-v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb: usb: chipidea: imx: pinctrl for HSIC is optional usb: chipidea: imx: refine the error handling for hsic usb: chipidea: imx: change hsic power regulator as optional usb: chipidea: imx: check data->usbmisc_data against NULL before access usb: chipidea: core: change vbus-regulator as optional usb: chipidea: imx: enable vbus and id wakeup only for OTG events usb: chipidea: udc: protect usb interrupt enable usb: chipidea: udc: add new API ci_hdrc_gadget_connect commit b020aa9d1e875c1c91b1390acdf42320e7060d84 Author: Christophe Leroy Date: Thu Aug 29 08:45:13 2019 +0000 powerpc: cleanup hw_irq.h SET_MSR_EE() is just use in this file and doesn't provide any added value compared to mtmsr(). Drop it. Add a wrtee() inline function to use wrtee/wrteei insn. Replace #ifdefs by IS_ENABLED() Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/a28a20514d5f6df9629c1a117b667e48c4272736.1567068137.git.christophe.leroy@c-s.fr commit 44448640dd0df98891c5ea4695d89a4972cb4c1f Author: Christophe Leroy Date: Thu Aug 29 08:45:12 2019 +0000 powerpc: permanently include 8xx registers in reg.h Most 8xx registers have specific names, so just include reg_8xx.h all the time in reg.h in order to have them defined even when CONFIG_PPC_8xx is not selected. This will avoid the need for #ifdefs in C code. Guard SPRN_ICTRL in an #ifdef CONFIG_PPC_8xx as this register has same name but different meaning and different spr number as another register in the mpc7450. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/dd82934ad91aab607d0eb7e626c14e6ac0d654eb.1567068137.git.christophe.leroy@c-s.fr commit b06174345f6e70200916136695514e0b6b95ac17 Author: Christophe Leroy Date: Wed Aug 28 13:42:01 2019 +0000 powerpc/reg: use ASM_FTR_IFSET() instead of opencoding fixup. mftb() includes a feature fixup for CELL ppc. Use ASM_FTR_IFSET() macro instead of opencoding the setup of the fixup sections. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/ac19713826fa55e9e7bfe3100c5a7b1712ab9526.1566999711.git.christophe.leroy@c-s.fr commit a2227a27774328507a5c2335a6dd600c079d1ff5 Author: Christophe Leroy Date: Fri Aug 23 09:56:21 2019 +0000 powerpc/32: Don't populate page tables for block mapped pages except on the 8xx. Commit d2f15e0979ee ("powerpc/32: always populate page tables for Abatron BDI.") wrongly sets page tables for any PPC32 for using BDI, and does't update them after init (remove RX on init section, set text and rodata read-only) Only the 8xx requires page tables to be populated for using the BDI. They also need to be populated in order to see the mappings in /sys/kernel/debug/kernel_page_tables On BOOK3S_32, pages that are not mapped by page tables are mapped by BATs. The BDI knows BATs and they can be viewed in /sys/kernel/debug/powerpc/block_address_translation Only set pagetables for RAM and IMMR on the 8xx and properly update them at the end of init. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c8610942203e0d93fcb02ad20c57edd3adb4c9d3.1566554029.git.christophe.leroy@c-s.fr commit 46ddcb3950a28c0df4815e8dbb8d4b91d5d9f22d Author: Christophe Leroy Date: Wed Aug 21 15:21:55 2019 +0000 powerpc/mm: Show if a bad page fault on data is read or write. DSISR (or ESR on some CPUs) has a bit to tell if the fault is due to a read or a write. Display it. Signed-off-by: Christophe Leroy Reviewed-by: Santosh Sivaraj Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/4f88d7e6fda53b5f80a71040ab400242f6c8cb93.1566400889.git.christophe.leroy@c-s.fr commit c4028fa2daa059ac9231ab3a4f57cbae814b3625 Author: Christophe Leroy Date: Wed Aug 21 10:13:32 2019 +0000 powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() powerpc always selects CONFIG_MMU and CONFIG_MMU is not checked anywhere else in powerpc code. Drop the #ifdef and the alternative part of is_ioremap_addr() Fixes: 9bd3bb6703d8 ("mm/nvdimm: add is_ioremap_addr and use that to check ioremap address") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/de395e444fb8dd7a6365c3314d78e15ebb3d7d1b.1566382245.git.christophe.leroy@c-s.fr commit 43f003bb74b9b27da6e719cfc2f7630f5652665a Author: Christophe Leroy Date: Mon Aug 19 13:06:30 2019 +0000 powerpc: Refactor BUG/WARN macros BUG(), WARN() and friends are using a similar inline assembly to implement various traps with various flags. Lets refactor via a new BUG_ENTRY() macro. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c19a82b37677ace0eebb0dc8c2120373c29c8dd1.1566219503.git.christophe.leroy@c-s.fr commit 98ba8e801322aed3a683252f36fb50d960cc0830 Merge: 0695f8bca93e a76bea0287ce Author: Michael Ellerman Date: Mon Nov 18 22:26:59 2019 +1100 Merge branch 'next' of https://git.kernel.org/pub/scm/linux/kernel/git/scottwood/linux into next Merge changes from Scott: Includes a couple of device tree fixes, a spelling fix, and leftover code cleanup. commit 347bc8cb26388791c5881a3775cb14a3f765a674 Author: Greg Kroah-Hartman Date: Mon Nov 18 10:21:19 2019 +0100 usb-serial: cp201x: support Mark-10 digital force gauge Add support for the Mark-10 digital force gauge device to the cp201x driver. Based on a report and a larger patch from Joel Jennings Reported-by: Joel Jennings Cc: stable Acked-by: Johan Hovold Link: https://lore.kernel.org/r/20191118092119.GA153852@kroah.com Signed-off-by: Greg Kroah-Hartman commit ee7b0d31f9f0192619a978b315abdb86beb27fdd Author: Hans de Goede Date: Tue Nov 12 15:17:11 2019 +0100 platform/x86: touchscreen_dmi: Add info for the ezpad 6 m4 tablet Add touchscreen info for the Jumper EZpad 6 m4 tablet. Reported-and-tested-by: youling257 Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit b97e12e594eb3d0fba35c99a83fef56ff692048b Merge: 2893c996d8ae 5051b384523b Author: Daniel Borkmann Date: Mon Nov 18 11:42:00 2019 +0100 Merge branch 'bpf-array-mmap' Andrii Nakryiko says: ==================== This patch set adds ability to memory-map BPF array maps (single- and multi-element). The primary use case is memory-mapping BPF array maps, created to back global data variables, created by libbpf implicitly. This allows for much better usability, along with avoiding syscalls to read or update data completely. Due to memory-mapping requirements, BPF array map that is supposed to be memory-mapped, has to be created with special BPF_F_MMAPABLE attribute, which triggers slightly different memory allocation strategy internally. See patch 1 for details. Libbpf is extended to detect kernel support for this flag, and if supported, will specify it for all global data maps automatically. Patch #1 refactors bpf_map_inc() and converts bpf_map's refcnt to atomic64_t to make refcounting never fail. Patch #2 does similar refactoring for bpf_prog_add()/bpf_prog_inc(). v5->v6: - add back uref counting (Daniel); v4->v5: - change bpf_prog's refcnt to atomic64_t (Daniel); v3->v4: - add mmap's open() callback to fix refcounting (Johannes); - switch to remap_vmalloc_pages() instead of custom fault handler (Johannes); - converted bpf_map's refcnt/usercnt into atomic64_t; - provide default bpf_map_default_vmops handling open/close properly; v2->v3: - change allocation strategy to avoid extra pointer dereference (Jakub); v1->v2: - fix map lookup code generation for BPF_F_MMAPABLE case; - prevent BPF_F_MMAPABLE flag for all but plain array map type; - centralize ref-counting in generic bpf_map_mmap(); - don't use uref counting (Alexei); - use vfree() directly; - print flags with %x (Song); - extend tests to verify bpf_map_{lookup,update}_elem() logic as well. ==================== Signed-off-by: Daniel Borkmann commit 5051b384523be92925d13694fabbc6bedf2f907b Author: Andrii Nakryiko Date: Sun Nov 17 09:28:06 2019 -0800 selftests/bpf: Add BPF_TYPE_MAP_ARRAY mmap() tests Add selftests validating mmap()-ing BPF array maps: both single-element and multi-element ones. Check that plain bpf_map_update_elem() and bpf_map_lookup_elem() work correctly with memory-mapped array. Also convert CO-RE relocation tests to use memory-mapped views of global data. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191117172806.2195367-6-andriin@fb.com commit 7fe74b436236b17ac57e46527166d22bcc230175 Author: Andrii Nakryiko Date: Sun Nov 17 09:28:05 2019 -0800 libbpf: Make global data internal arrays mmap()-able, if possible Add detection of BPF_F_MMAPABLE flag support for arrays and add it as an extra flag to internal global data maps, if supported by kernel. This allows users to memory-map global data and use it without BPF map operations, greatly simplifying user experience. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20191117172806.2195367-5-andriin@fb.com commit fc9702273e2edb90400a34b3be76f7b08fa3344b Author: Andrii Nakryiko Date: Sun Nov 17 09:28:04 2019 -0800 bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY Add ability to memory-map contents of BPF array map. This is extremely useful for working with BPF global data from userspace programs. It allows to avoid typical bpf_map_{lookup,update}_elem operations, improving both performance and usability. There had to be special considerations for map freezing, to avoid having writable memory view into a frozen map. To solve this issue, map freezing and mmap-ing is happening under mutex now: - if map is already frozen, no writable mapping is allowed; - if map has writable memory mappings active (accounted in map->writecnt), map freezing will keep failing with -EBUSY; - once number of writable memory mappings drops to zero, map freezing can be performed again. Only non-per-CPU plain arrays are supported right now. Maps with spinlocks can't be memory mapped either. For BPF_F_MMAPABLE array, memory allocation has to be done through vmalloc() to be mmap()'able. We also need to make sure that array data memory is page-sized and page-aligned, so we over-allocate memory in such a way that struct bpf_array is at the end of a single page of memory with array->value being aligned with the start of the second page. On deallocation we need to accomodate this memory arrangement to free vmalloc()'ed memory correctly. One important consideration regarding how memory-mapping subsystem functions. Memory-mapping subsystem provides few optional callbacks, among them open() and close(). close() is called for each memory region that is unmapped, so that users can decrease their reference counters and free up resources, if necessary. open() is *almost* symmetrical: it's called for each memory region that is being mapped, **except** the very first one. So bpf_map_mmap does initial refcnt bump, while open() will do any extra ones after that. Thus number of close() calls is equal to number of open() calls plus one more. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: John Fastabend Acked-by: Johannes Weiner Link: https://lore.kernel.org/bpf/20191117172806.2195367-4-andriin@fb.com commit 85192dbf4de08795afe2b88e52a36fc6abfc3dba Author: Andrii Nakryiko Date: Sun Nov 17 09:28:03 2019 -0800 bpf: Convert bpf_prog refcnt to atomic64_t Similarly to bpf_map's refcnt/usercnt, convert bpf_prog's refcnt to atomic64 and remove artificial 32k limit. This allows to make bpf_prog's refcounting non-failing, simplifying logic of users of bpf_prog_add/bpf_prog_inc. Validated compilation by running allyesconfig kernel build. Suggested-by: Daniel Borkmann Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191117172806.2195367-3-andriin@fb.com commit 1e0bd5a091e5d9e0f1d5b0e6329b87bb1792f784 Author: Andrii Nakryiko Date: Sun Nov 17 09:28:02 2019 -0800 bpf: Switch bpf_map ref counter to atomic64_t so bpf_map_inc() never fails 92117d8443bc ("bpf: fix refcnt overflow") turned refcounting of bpf_map into potentially failing operation, when refcount reaches BPF_MAX_REFCNT limit (32k). Due to using 32-bit counter, it's possible in practice to overflow refcounter and make it wrap around to 0, causing erroneous map free, while there are still references to it, causing use-after-free problems. But having a failing refcounting operations are problematic in some cases. One example is mmap() interface. After establishing initial memory-mapping, user is allowed to arbitrarily map/remap/unmap parts of mapped memory, arbitrarily splitting it into multiple non-contiguous regions. All this happening without any control from the users of mmap subsystem. Rather mmap subsystem sends notifications to original creator of memory mapping through open/close callbacks, which are optionally specified during initial memory mapping creation. These callbacks are used to maintain accurate refcount for bpf_map (see next patch in this series). The problem is that open() callback is not supposed to fail, because memory-mapped resource is set up and properly referenced. This is posing a problem for using memory-mapping with BPF maps. One solution to this is to maintain separate refcount for just memory-mappings and do single bpf_map_inc/bpf_map_put when it goes from/to zero, respectively. There are similar use cases in current work on tcp-bpf, necessitating extra counter as well. This seems like a rather unfortunate and ugly solution that doesn't scale well to various new use cases. Another approach to solve this is to use non-failing refcount_t type, which uses 32-bit counter internally, but, once reaching overflow state at UINT_MAX, stays there. This utlimately causes memory leak, but prevents use after free. But given refcounting is not the most performance-critical operation with BPF maps (it's not used from running BPF program code), we can also just switch to 64-bit counter that can't overflow in practice, potentially disadvantaging 32-bit platforms a tiny bit. This simplifies semantics and allows above described scenarios to not worry about failing refcount increment operation. In terms of struct bpf_map size, we are still good and use the same amount of space: BEFORE (3 cache lines, 8 bytes of padding at the end): struct bpf_map { const struct bpf_map_ops * ops __attribute__((__aligned__(64))); /* 0 8 */ struct bpf_map * inner_map_meta; /* 8 8 */ void * security; /* 16 8 */ enum bpf_map_type map_type; /* 24 4 */ u32 key_size; /* 28 4 */ u32 value_size; /* 32 4 */ u32 max_entries; /* 36 4 */ u32 map_flags; /* 40 4 */ int spin_lock_off; /* 44 4 */ u32 id; /* 48 4 */ int numa_node; /* 52 4 */ u32 btf_key_type_id; /* 56 4 */ u32 btf_value_type_id; /* 60 4 */ /* --- cacheline 1 boundary (64 bytes) --- */ struct btf * btf; /* 64 8 */ struct bpf_map_memory memory; /* 72 16 */ bool unpriv_array; /* 88 1 */ bool frozen; /* 89 1 */ /* XXX 38 bytes hole, try to pack */ /* --- cacheline 2 boundary (128 bytes) --- */ atomic_t refcnt __attribute__((__aligned__(64))); /* 128 4 */ atomic_t usercnt; /* 132 4 */ struct work_struct work; /* 136 32 */ char name[16]; /* 168 16 */ /* size: 192, cachelines: 3, members: 21 */ /* sum members: 146, holes: 1, sum holes: 38 */ /* padding: 8 */ /* forced alignments: 2, forced holes: 1, sum forced holes: 38 */ } __attribute__((__aligned__(64))); AFTER (same 3 cache lines, no extra padding now): struct bpf_map { const struct bpf_map_ops * ops __attribute__((__aligned__(64))); /* 0 8 */ struct bpf_map * inner_map_meta; /* 8 8 */ void * security; /* 16 8 */ enum bpf_map_type map_type; /* 24 4 */ u32 key_size; /* 28 4 */ u32 value_size; /* 32 4 */ u32 max_entries; /* 36 4 */ u32 map_flags; /* 40 4 */ int spin_lock_off; /* 44 4 */ u32 id; /* 48 4 */ int numa_node; /* 52 4 */ u32 btf_key_type_id; /* 56 4 */ u32 btf_value_type_id; /* 60 4 */ /* --- cacheline 1 boundary (64 bytes) --- */ struct btf * btf; /* 64 8 */ struct bpf_map_memory memory; /* 72 16 */ bool unpriv_array; /* 88 1 */ bool frozen; /* 89 1 */ /* XXX 38 bytes hole, try to pack */ /* --- cacheline 2 boundary (128 bytes) --- */ atomic64_t refcnt __attribute__((__aligned__(64))); /* 128 8 */ atomic64_t usercnt; /* 136 8 */ struct work_struct work; /* 144 32 */ char name[16]; /* 176 16 */ /* size: 192, cachelines: 3, members: 21 */ /* sum members: 154, holes: 1, sum holes: 38 */ /* forced alignments: 2, forced holes: 1, sum forced holes: 38 */ } __attribute__((__aligned__(64))); This patch, while modifying all users of bpf_map_inc, also cleans up its interface to match bpf_map_put with separate operations for bpf_map_inc and bpf_map_inc_with_uref (to match bpf_map_put and bpf_map_put_with_uref, respectively). Also, given there are no users of bpf_map_inc_not_zero specifying uref=true, remove uref flag and default to uref=false internally. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191117172806.2195367-2-andriin@fb.com commit e8d70b321ecc9b23d09b8df63e38a2f73160c209 Author: Chuck Lever Date: Fri Nov 15 08:39:07 2019 -0500 SUNRPC: Fix another issue with MIC buffer space xdr_shrink_pagelen() BUG's when @len is larger than buf->page_len. This can happen when xdr_buf_read_mic() is given an xdr_buf with a small page array (like, only a few bytes). Instead, just cap the number of bytes that xdr_shrink_pagelen() will move. Fixes: 5f1bc39979d ("SUNRPC: Fix buffer handling of GSS MIC ... ") Signed-off-by: Chuck Lever Reviewed-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit 21f86d2d63f9b0c10a3bd369ce8c97f1f786be53 Author: Chuck Lever Date: Tue Nov 5 11:04:13 2019 -0500 NFS4: Trace lock reclaims One of the most frustrating messages our sustaining team sees is the "Lock reclaim failed!" message. Add some observability in the client's lock reclaim logic so we can capture better data the first time a problem occurs. Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 511ba52e4c01fd1878140774e6215e0de6c2f36f Author: Chuck Lever Date: Tue Nov 5 11:04:07 2019 -0500 NFS4: Trace state recovery operation Add a trace point in the main state manager loop to observe state recovery operation. Help track down state recovery bugs. Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 4e121fcae809a94aa952407bd74b0757b858ce19 Merge: f751c5452594 a52c23b8b207 Author: Trond Myklebust Date: Mon Nov 18 10:55:55 2019 +0100 Merge tag 'nfs-rdma-for-5.5-1' of git://git.linux-nfs.org/projects/anna/linux-nfs NFSoRDMA Client Updates for Linux 5.5 New Features: - New tracepoints for congestion control and Local Invalidate WRs Bugfixes and Cleanups: - Eliminate log noise in call_reserveresult - Fix unstable connections after a reconnect - Clean up some code duplication - Close race between waking a sender and posting a receive - Fix MR list corruption, and clean up MR usage - Remove unused rpcrdma_sendctx fields - Try to avoid DMA mapping pages if it is too costly - Wake pending tasks if connection fails - Replace some dprintk()s with tracepoints commit b41d62201b9772c7c750360ab668d2caa502e642 Author: Thomas Gleixner Date: Mon Nov 18 10:47:29 2019 +0100 x86: Remove unused asm/rio.h The removed calgary IOMMU driver was the only user of this header file. Reported-by: Jon Mason Signed-off-by: Thomas Gleixner Cc: Christoph Hellwig commit f751c5452594f6ef77b39c78f9888275e60d0770 Author: Olga Kornievskaia Date: Fri Nov 15 15:13:19 2019 -0500 NFSv4.2 fix memory leak in nfs42_ssc_open Static analysis with Coverity detected a memory leak Reported-by: Colin King Fixes: ec4b09250898 ("NFS: inter ssc open") Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 66588abe2db066a8927b67cbb8b82a1292819086 Author: Olga Kornievskaia Date: Fri Nov 15 15:12:49 2019 -0500 NFSv4.2 fix kfree in __nfs42_copy_file_range This is triggering problems with static analysis with Coverity Reported-by: Colin King Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 843aa17a35bf00be0f3a1108f4691bc45761cd23 Author: YueHaibing Date: Fri Nov 15 11:25:22 2019 +0000 NFS: remove duplicated include from nfs4file.c Remove duplicated include. Signed-off-by: YueHaibing Signed-off-by: Trond Myklebust commit 000301042413c4e5d9f2227c60db8f12669fefce Author: YueHaibing Date: Thu Nov 14 22:01:41 2019 +0800 NFSv4: Make _nfs42_proc_copy_notify() static Fix sparse warning: fs/nfs/nfs42proc.c:527:5: warning: symbol '_nfs42_proc_copy_notify' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Trond Myklebust commit 913eca1aea87c3c6526fa5b166e524dff989deef Author: Anna Schumaker Date: Tue Nov 12 16:37:24 2019 -0500 NFS: Fallocate should use the nfs4_fattr_bitmap Changing a sparse file could have an effect not only on the file size, but also on the number of blocks used by the file in the underlying filesystem. The server's cache_consistency_bitmap doesn't update the SPACE_USED attribute, so let's switch to the nfs4_fattr_bitmap to catch this update whenever we do an ALLOCATE or DEALLOCATE. This patch fixes xfstests generic/568, which tests that fallocating an unaligned range allocates all blocks touched by that range. Without this patch, `stat` reports 0 bytes used immediately after the fallocate. Adding a `sleep 5` to the test also catches the update, but it's better to do so when we know something has changed. Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 89658c4d04c7661c2c0770c6f92f465d58eed62d Author: Anna Schumaker Date: Fri Nov 8 16:02:24 2019 -0500 NFS: Return -ETXTBSY when attempting to write to a swapfile My understanding is that -EBUSY refers to the underlying device, and that -ETXTBSY is used when attempting to access a file in use by the kernel (like a swapfile). Changing this return code helps us pass xfstests generic/569 Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 4d6141288c33b73027260e73df262464cbe1fd0d Author: Peter Chen Date: Thu Oct 10 09:20:26 2019 +0800 usb: chipidea: imx: pinctrl for HSIC is optional For imx chipidea controllers, if they use mxs PHY, they need pinctrl for HSIC. Otherwise, it doesn't need pinctrl and usbmisc control. Like imx7d and imx8mm. Reported-by: André Draszik Signed-off-by: Peter Chen commit 0e96322b241cec8e8adf6cea70dc116d614f4add Author: Saurav Girepunje Date: Tue Oct 29 14:55:22 2019 +0530 fs: nfs: sysfs: Remove NULL check before kfree Remove NULL check before kfree, NULL check is taken care on kfree. Signed-off-by: Saurav Girepunje Signed-off-by: Trond Myklebust commit 9c91fa36b6179859aca6317b23933ffbc4f76940 Author: YueHaibing Date: Fri Oct 25 21:41:19 2019 +0800 NFS: remove unneeded semicolon remove unneeded semicolon. Signed-off-by: YueHaibing Signed-off-by: Trond Myklebust commit d49dd11753f4f5dde5d67c4e1d3edf65eb35c381 Author: Ben Dooks Date: Wed Oct 16 17:28:21 2019 +0100 NFSv4: add declaration of current_stateid The current_stateid is exported from nfs4state.c but not declared in any of the headers. Add to nfs4_fs.h to remove the following warning: fs/nfs/nfs4state.c:80:20: warning: symbol 'current_stateid' was not declared. Should it be static? Signed-off-by: Ben Dooks Signed-off-by: Trond Myklebust commit 8725aa4fa7ded30211ebd28bb1c9bae806eb3841 Author: Andrew Duggan Date: Wed Oct 23 01:24:03 2019 +0000 HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device In the event that the RMI device is unreachable, the calls to rmi_set_mode() or rmi_set_page() will fail before registering the RMI transport device. When the device is removed, rmi_remove() will call rmi_unregister_transport_device() which will attempt to access the rmi_dev pointer which was not set. This patch adds a check of the RMI_STARTED bit before calling rmi_unregister_transport_device(). The RMI_STARTED bit is only set after rmi_register_transport_device() completes successfully. The kernel oops was reported in this message: https://www.spinics.net/lists/linux-input/msg58433.html [jkosina@suse.cz: reworded changelog as agreed with Andrew] Signed-off-by: Andrew Duggan Reported-by: Federico Cerutti Signed-off-by: Jiri Kosina commit 5ed0794cde59365d4d5895b89bb2f7ef7ffdbd55 Author: Michael Schmitz Date: Wed Nov 6 15:47:29 2019 +1300 m68k/atari: Convert Falcon IDE drivers to platform drivers Autoloading of Falcon IDE driver modules requires converting these drivers to platform drivers. Add platform device for Falcon IDE interface in Atari platform setup code. Use this in the pata_falcon driver in place of the simple platform device set up on the fly. Convert falconide driver to use the same platform device that is used by pata_falcon also. (With the introduction of a platform device for the Atari Falcon IDE interface, the old Falcon IDE driver no longer loads (resource already claimed by the platform device)). Tested (as built-in driver) on my Atari Falcon. Signed-off-by: Michael Schmitz Acked-by: Bartlomiej Zolnierkiewicz Link: https://lore.kernel.org/r/1573008449-8226-1-git-send-email-schmitzmic@gmail.com Signed-off-by: Geert Uytterhoeven commit b03e5774d51fe003e1020060c403a1d085b128eb Author: Heiner Kallweit Date: Mon Nov 11 22:38:11 2019 +0100 HID: quirks: remove hid-led devices from hid_have_special_driver Since e04a0442d33b ("HID: core: remove the absolute need of hid_have_special_driver[]") it's no longer needed to list these LED devices in hid_have_special_driver[]. This allows libraries needing access to the hidraw device to work properly. Signed-off-by: Heiner Kallweit Signed-off-by: Benjamin Tissoires commit f3d7c2292d104519195fdb11192daec13229c219 Author: Bradley Bolen Date: Sat Nov 16 20:00:45 2019 -0500 mmc: core: Fix size overflow for mmc partitions With large eMMC cards, it is possible to create general purpose partitions that are bigger than 4GB. The size member of the mmc_part struct is only an unsigned int which overflows for gp partitions larger than 4GB. Change this to a u64 to handle the overflow. Signed-off-by: Bradley Bolen Signed-off-by: Ulf Hansson commit c91843463e9e821dc3b48fe37e3155fa38299f6e Author: Eugeniu Rosca Date: Fri Nov 15 14:44:30 2019 +0100 mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests Isolated initially to renesas_sdhi_internal_dmac [1], Ulf suggested adding MMC_CAP_ERASE to the TMIO mmc core: On Fri, Nov 15, 2019 at 10:27:25AM +0100, Ulf Hansson wrote: -- snip -- This test and due to the discussions with Wolfram and you in this thread, I would actually suggest that you enable MMC_CAP_ERASE for all tmio variants, rather than just for this particular one. In other words, set the cap in tmio_mmc_host_probe() should be fine, as it seems none of the tmio variants supports HW busy detection at this point. -- snip -- Testing on R-Car H3ULCB-KF doesn't reveal any issues (v5.4-rc7): root@rcar-gen3:~# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT mmcblk0 179:0 0 59.2G 0 disk <--- eMMC mmcblk0boot0 179:8 0 4M 1 disk mmcblk0boot1 179:16 0 4M 1 disk mmcblk1 179:24 0 30G 0 disk <--- SD card root@rcar-gen3:~# time blkdiscard /dev/mmcblk0 real 0m8.659s user 0m0.001s sys 0m1.920s root@rcar-gen3:~# time blkdiscard /dev/mmcblk1 real 0m1.176s user 0m0.001s sys 0m0.124s [1] https://lore.kernel.org/linux-renesas-soc/20191112134808.23546-1-erosca@de.adit-jv.com/ Cc: Wolfram Sang Cc: Masahiro Yamada Cc: Andrew Gabbasov Originally-by: Harish Jenny K N Suggested-by: Ulf Hansson Signed-off-by: Eugeniu Rosca Reviewed-by: Wolfram Sang Signed-off-by: Ulf Hansson commit 11a98f37a5c11fd3cec9c7a566dfa902bceb5bde Author: Cao jin Date: Mon Nov 18 15:00:12 2019 +0800 x86: Fix typos in comments BIOSen -> BIOSes; paing -> paging. Append to 640 its proper unit "Kb". encomapssing -> encompassing. [ bp: Merge into a single patch, fix one more typo, massage. ] Signed-off-by: Cao jin Signed-off-by: Borislav Petkov Cc: "H. Peter Anvin" Cc: Baoquan He Cc: Dave Young Cc: David Howells Cc: Ingo Molnar Cc: Juergen Gross Cc: Robert Richter Cc: Thomas Gleixner Cc: Thomas Lendacky Cc: x86-ml Link: https://lkml.kernel.org/r/20191118070012.27850-1-caoj.fnst@cn.fujitsu.com commit 2dbc6f113acd74c66b04bf49fb027efd830b1c5a Author: Blaž Hrastnik Date: Wed Nov 6 20:02:46 2019 +0900 HID: Improve Windows Precision Touchpad detection. Per Microsoft spec, usage 0xC5 (page 0xFF) returns a blob containing data used to verify the touchpad as a Windows Precision Touchpad. 0x85, REPORTID_PTPHQA, // REPORT_ID (PTPHQA) 0x09, 0xC5, // USAGE (Vendor Usage 0xC5) 0x15, 0x00, // LOGICAL_MINIMUM (0) 0x26, 0xff, 0x00, // LOGICAL_MAXIMUM (0xff) 0x75, 0x08, // REPORT_SIZE (8) 0x96, 0x00, 0x01, // REPORT_COUNT (0x100 (256)) 0xb1, 0x02, // FEATURE (Data,Var,Abs) However, some devices, namely Microsoft's Surface line of products instead implement a "segmented device certification report" (usage 0xC6) which returns the same report, but in smaller chunks. 0x06, 0x00, 0xff, // USAGE_PAGE (Vendor Defined) 0x85, REPORTID_PTPHQA, // REPORT_ID (PTPHQA) 0x09, 0xC6, // USAGE (Vendor usage for segment #) 0x25, 0x08, // LOGICAL_MAXIMUM (8) 0x75, 0x08, // REPORT_SIZE (8) 0x95, 0x01, // REPORT_COUNT (1) 0xb1, 0x02, // FEATURE (Data,Var,Abs) 0x09, 0xC7, // USAGE (Vendor Usage) 0x26, 0xff, 0x00, // LOGICAL_MAXIMUM (0xff) 0x95, 0x20, // REPORT_COUNT (32) 0xb1, 0x02, // FEATURE (Data,Var,Abs) By expanding Win8 touchpad detection to also look for the segmented report, all Surface touchpads are now properly recognized by hid-multitouch. Signed-off-by: Blaž Hrastnik Signed-off-by: Benjamin Tissoires commit 3f4aad6e1a4c26a20700fb4f630e4e6c6831db47 Author: Peter Chen Date: Thu Oct 10 08:59:14 2019 +0800 usb: chipidea: imx: refine the error handling for hsic - -EPROBE_DEFER is an error, but without need show error message - If pintrol is not existed, as pintrol is NULL Signed-off-by: Peter Chen commit 7d5ec335f94e74e885ca2f6c97a3479fe9fe3b15 Author: Peter Chen Date: Thu Oct 10 08:40:46 2019 +0800 usb: chipidea: imx: change hsic power regulator as optional Not every platform needs this regulator. Signed-off-by: Peter Chen commit df17aa9fb31f6a41aad37b984909d8ef1a958271 Author: Li Jun Date: Wed Oct 9 10:52:28 2019 +0800 usb: chipidea: imx: check data->usbmisc_data against NULL before access As usbmisc_data is optional, so add the check before access its member, this fix below static checker warning: drivers/usb/chipidea/ci_hdrc_imx.c:438 ci_hdrc_imx_probe() warn: 'data->usbmisc_data' can also be NULL which is introduced by Patch 15b80f7c3a7f: "usb: chipidea: imx: enable vbus and id wakeup only for OTG events" Reported-by: Dan Carpenter Signed-off-by: Li Jun Signed-off-by: Peter Chen commit 782c1c49f3dbf335de6b95f2d97b105cca236bc9 Author: Peter Chen Date: Mon Sep 23 10:34:38 2019 +0800 usb: chipidea: core: change vbus-regulator as optional Vbus regualtor is an optional regulator, for platforms, which doesn't have this regulator, it will get a dummy regulator and show warning message. Signed-off-by: Peter Chen commit 93c2c7330a3b6d973cd82dfd7bcbd6df035752f6 Author: Li Jun Date: Mon Sep 9 14:41:41 2019 +0800 usb: chipidea: imx: enable vbus and id wakeup only for OTG events If ID or VBUS is from external block, don't enable its wakeup because it isn't used at all. Signed-off-by: Li Jun Signed-off-by: Peter Chen commit 72dc8df7920fc24eba0f586c56e900a1643ff2b3 Author: Jun Li Date: Tue Sep 10 14:54:57 2019 +0800 usb: chipidea: udc: protect usb interrupt enable We hit the problem with below sequence: - ci_udc_vbus_session() update vbus_active flag and ci->driver is valid, - before calling the ci_hdrc_gadget_connect(), usb_gadget_udc_stop() is called by application remove gadget driver, - ci_udc_vbus_session() will contine do ci_hdrc_gadget_connect() as gadget_ready is 1, so udc interrupt is enabled, but ci->driver is NULL. - USB connection irq generated but ci->driver is NULL. As udc irq only should be enabled when gadget driver is binded, so add spinlock to protect the usb irq enable for vbus session handling. Signed-off-by: Jun Li Signed-off-by: Peter Chen commit d16ab536aad208421c5ed32cdcb01b5ab6aa1f19 Author: Peter Chen Date: Tue Sep 10 10:54:52 2019 +0800 usb: chipidea: udc: add new API ci_hdrc_gadget_connect This API is used enable device function, it is called at below situations: - VBUS is connected during boots up - Hot plug occurs during runtime Signed-off-by: Peter Chen Signed-off-by: Jun Li commit 11fde161ab37f2938504bf896b48afbd18ea71cd Author: Christian Brauner Date: Mon Nov 18 08:49:44 2019 +0100 selftests/clone3: skip if clone3() is ENOSYS If the clone3() syscall is not implemented we should skip the tests. Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid") Fixes: 17a810699c18 ("selftests: add tests for clone3()") Signed-off-by: Christian Brauner commit a019ff3b8b10d1b7f5cd37edb9f4fbef3e031edf Author: Andrei Vagin Date: Sun Nov 17 22:47:50 2019 -0800 selftests/clone3: check that all pids are released on error paths This is a regression test case for an issue when pids have not been released on error paths. Signed-off-by: Andrei Vagin Link: https://lore.kernel.org/r/20191118064750.408003-3-avagin@gmail.com Signed-off-by: Christian Brauner commit 28df751539e8e3ba71c5b0d13647d1fdc7c1d287 Author: Andrei Vagin Date: Sun Nov 17 22:47:49 2019 -0800 selftests/clone3: report a correct number of fails In clone3_set_tid, a few test cases are running in a child process. And right now, if one of these test cases fails, the whole test will exit with the success status. Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid") Signed-off-by: Andrei Vagin Link: https://lore.kernel.org/r/20191118064750.408003-2-avagin@gmail.com Signed-off-by: Christian Brauner commit 4f5c289ea66a33457d51b305d4d77e1ca4c8ff17 Author: Andrei Vagin Date: Sun Nov 17 22:47:48 2019 -0800 selftests/clone3: flush stdout and stderr before clone3() and _exit() Buffers have to be flushed before clone3() to avoid double messages in the log. Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid") Signed-off-by: Andrei Vagin Link: https://lore.kernel.org/r/20191118064750.408003-1-avagin@gmail.com Signed-off-by: Christian Brauner commit 7170d1a4cc4d5fe1c55dfd95bddb9df074fe9637 Merge: a079973f462a 726b4fba94be Author: Greg Kroah-Hartman Date: Mon Nov 18 08:24:12 2019 +0100 Merge tag 'usb-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next Felipe writes: USB: changes for v5.5 We have TI's glue layer for the Cadence USB3 controller going upstream. Tegra's XUDC driver is also going upstream with this pull request. Apart from these two big features, we have a bunch of patches switching over to devm_platform_ioremap_resource() in order to simplify code a little; and a non-critical fix for DWC3 usage via kexec. * tag 'usb-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (44 commits) usb: dwc3: of-simple: add a shutdown usb: cdns3: Add TI specific wrapper driver dt-bindings: usb: Add binding for the TI wrapper for Cadence USB3 controller usb: mtu3: fix race condition about delayed_status usb: gadget: Add UDC driver for tegra XUSB device mode controller usb: dwc3: debug: Remove newline printout usb: dwc2: use a longer core rest timeout in dwc2_core_reset() usb: gadget: udc: lpc32xx: Use devm_platform_ioremap_resource() in lpc32xx_udc_probe() USB: gadget: udc: clean up an indentation issue usb: gadget: Quieten gadget config message phy: renesas: rcar-gen3-usb2: Use platform_get_irq_optional() for optional irq usb: gadget: Remove set but not used variable 'opts' in msg_do_config usb: gadget: Remove set but not used variable 'opts' in acm_ms_do_config usb: mtu3: add a new function to do status stage usb: gadget: configfs: fix concurrent issue between composite APIs usb: gadget: f_tcm: Provide support to get alternate setting in tcm function usb: gadget: Correct NULL pointer checking in fsl gadget usb: fsl: Remove unused variable USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein USB: dummy-hcd: increase max number of devices to 32 ... commit 405fe7aa0dbaa6cb8cfe62771eee67076d30aca1 Author: Christoph Hellwig Date: Mon Oct 28 13:10:42 2019 +0100 riscv: provide a flat image loader This allows just loading the kernel at a pre-set address without qemu going bonkers trying to map the ELF file. Contains a contribution from Aurabindo Jayamohanan to reuse the PAGE_OFFSET definition. Signed-off-by: Christoph Hellwig Reviewed-by: Anup Patel [paul.walmsley@sifive.com: fixed checkpatch issue; minor commit message fix] Signed-off-by: Paul Walmsley commit 6bd33e1ece528f67646db33bf97406b747dafda0 Author: Christoph Hellwig Date: Mon Oct 28 13:10:41 2019 +0100 riscv: add nommu support The kernel runs in M-mode without using page tables, and thus can't run bare metal without help from additional firmware. Most of the patch is just stubbing out code not needed without page tables, but there is an interesting detail in the signals implementation: - The normal RISC-V syscall ABI only implements rt_sigreturn as VDSO entry point, but the ELF VDSO is not supported for nommu Linux. We instead copy the code to call the syscall onto the stack. In addition to enabling the nommu code a new defconfig for a small kernel image that can run in nommu mode on qemu is also provided, to run a kernel in qemu you can use the following command line: qemu-system-riscv64 -smp 2 -m 64 -machine virt -nographic \ -kernel arch/riscv/boot/loader \ -drive file=rootfs.ext2,format=raw,id=hd0 \ -device virtio-blk-device,drive=hd0 Contains contributions from Damien Le Moal . Signed-off-by: Christoph Hellwig Reviewed-by: Anup Patel [paul.walmsley@sifive.com: updated to apply; add CONFIG_MMU guards around PCI_IOBASE definition to fix build issues; fixed checkpatch issues; move the PCI_IO_* and VMEMMAP address space macros along with the others; resolve sparse warning] Signed-off-by: Paul Walmsley commit 9e80635619b51ddc56bdeca4da4056eb7a2a77e0 Author: Christoph Hellwig Date: Mon Oct 28 13:10:40 2019 +0100 riscv: clear the instruction cache and all registers when booting When we get booted we want a clear slate without any leaks from previous supervisors or the firmware. Flush the instruction cache and then clear all registers to known good values. This is really important for the upcoming nommu support that runs on M-mode, but can't really harm when running in S-mode either. Vaguely based on the concepts from opensbi. Signed-off-by: Christoph Hellwig Reviewed-by: Anup Patel Signed-off-by: Paul Walmsley commit accb9dbc4affdb7ebf30db7e9ba71eee47280081 Author: Damien Le Moal Date: Mon Oct 28 13:10:39 2019 +0100 riscv: read the hart ID from mhartid on boot When in M-Mode, we can use the mhartid CSR to get the ID of the running HART. Doing so, direct M-Mode boot without firmware is possible. Signed-off-by: Damien Le Moal Reviewed-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Christoph Hellwig Signed-off-by: Paul Walmsley commit fcdc65375186a5cd69cc2eedfb498b86f4f5a21e Author: Christoph Hellwig Date: Mon Oct 28 13:10:38 2019 +0100 riscv: provide native clint access for M-mode RISC-V has the concept of a cpu level interrupt controller. The interface for it is split between a standardized part that is exposed as bits in the mstatus/sstatus register and the mie/mip/sie/sip CRS. But the bit to actually trigger IPIs is not standardized and just mentioned as implementable using MMIO. Add support for IPIs using MMIO using the SiFive clint layout (which is also shared by Ariane, Kendryte and the Qemu virt platform). Additionally the MMIO block also supports the time value and timer compare registers, so they are also set up using the same OF node. Support for other layouts should also be relatively easy to add in the future. Signed-off-by: Christoph Hellwig Reviewed-by: Anup Patel [paul.walmsley@sifive.com: update include guard format; fix checkpatch issues; minor commit message cleanup] Signed-off-by: Paul Walmsley commit f9c34bb529975fe9f85b870a80c53a83a3c5a182 Author: Sascha Hauer Date: Tue Nov 5 09:12:51 2019 +0100 ubi: Fix producing anchor PEBs When a new fastmap is about to be written UBI must make sure it has a free block for a fastmap anchor available. For this ubi_update_fastmap() calls ubi_ensure_anchor_pebs(). This stopped working with 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()"), with this commit the wear leveling code is blocked and can no longer produce free PEBs. UBI then more often than not falls back to write the new fastmap anchor to the same block it was already on which means the same erase block gets erased during each fastmap write and wears out quite fast. As the locking prevents us from producing the anchor PEB when we actually need it, this patch changes the strategy for creating the anchor PEB. We no longer create it on demand right before we want to write a fastmap, but instead we create an anchor PEB right after we have written a fastmap. This gives us enough time to produce a new anchor PEB before it is needed. To make sure we have an anchor PEB for the very first fastmap write we call ubi_ensure_anchor_pebs() during initialisation as well. Fixes: 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()") Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit db96d571a7c2207ff27ad2c46a82b26d870f9bdc Author: Andrey Skvortsov Date: Sat Nov 16 23:37:48 2019 +0300 rtc: tps65910: allow using RTC without alarm interrupt If tps65910 INT1 pin (IRQ output) is not wired to any IRQ controller, then it can't be used as system wakeup/alarm source, but it is still possible to read/write time from/to RTC. Signed-off-by: Andrey Skvortsov Link: https://lore.kernel.org/r/20191116203748.27166-1-andrej.skvortzov@gmail.com Signed-off-by: Alexandre Belloni commit 6abf57262166b4f4294667fb5206ae7ba1ba96f5 Author: Zhihao Cheng Date: Sat Jul 20 14:05:20 2019 +0800 ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps Running stress-test test_2 in mtd-utils on ubi device, sometimes we can get following oops message: BUG: unable to handle page fault for address: ffffffff00000140 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 280a067 P4D 280a067 PUD 0 Oops: 0000 [#1] SMP CPU: 0 PID: 60 Comm: kworker/u16:1 Kdump: loaded Not tainted 5.2.0 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0 -0-ga698c8995f-prebuilt.qemu.org 04/01/2014 Workqueue: writeback wb_workfn (flush-ubifs_0_0) RIP: 0010:rb_next_postorder+0x2e/0xb0 Code: 80 db 03 01 48 85 ff 0f 84 97 00 00 00 48 8b 17 48 83 05 bc 80 db 03 01 48 83 e2 fc 0f 84 82 00 00 00 48 83 05 b2 80 db 03 01 <48> 3b 7a 10 48 89 d0 74 02 f3 c3 48 8b 52 08 48 83 05 a3 80 db 03 RSP: 0018:ffffc90000887758 EFLAGS: 00010202 RAX: ffff888129ae4700 RBX: ffff888138b08400 RCX: 0000000080800001 RDX: ffffffff00000130 RSI: 0000000080800024 RDI: ffff888138b08400 RBP: ffff888138b08400 R08: ffffea0004a6b920 R09: 0000000000000000 R10: ffffc90000887740 R11: 0000000000000001 R12: ffff888128d48000 R13: 0000000000000800 R14: 000000000000011e R15: 00000000000007c8 FS: 0000000000000000(0000) GS:ffff88813ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff00000140 CR3: 000000013789d000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: destroy_old_idx+0x5d/0xa0 [ubifs] ubifs_tnc_start_commit+0x4fe/0x1380 [ubifs] do_commit+0x3eb/0x830 [ubifs] ubifs_run_commit+0xdc/0x1c0 [ubifs] Above Oops are due to the slab-out-of-bounds happened in do-while of function layout_in_gaps indirectly called by ubifs_tnc_start_commit. In function layout_in_gaps, there is a do-while loop placing index nodes into the gaps created by obsolete index nodes in non-empty index LEBs until rest index nodes can totally be placed into pre-allocated empty LEBs. @c->gap_lebs points to a memory area(integer array) which records LEB numbers used by 'in-the-gaps' method. Whenever a fitable index LEB is found, corresponding lnum will be incrementally written into the memory area pointed by @c->gap_lebs. The size ((@c->lst.idx_lebs + 1) * sizeof(int)) of memory area is allocated before do-while loop and can not be changed in the loop. But @c->lst.idx_lebs could be increased by function ubifs_change_lp (called by layout_leb_in_gaps->ubifs_find_dirty_idx_leb->get_idx_gc_leb) during the loop. So, sometimes oob happens when number of cycles in do-while loop exceeds the original value of @c->lst.idx_lebs. See detail in https://bugzilla.kernel.org/show_bug.cgi?id=204229. This patch fixes oob in layout_in_gaps. Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 10256f000932f12596dc043cf880ecf488a32510 Author: Zhihao Cheng Date: Tue Oct 29 20:58:23 2019 +0800 ubifs: do_kill_orphans: Fix a memory leak bug If there are more than one valid snod on the sleb->nodes list, do_kill_orphans will malloc ino more than once without releasing previous ino's memory. Finally, it will trigger memory leak. Fixes: ee1438ce5dc4 ("ubifs: Check link count of inodes when...") Signed-off-by: Zhihao Cheng Signed-off-by: zhangyi (F) Signed-off-by: Richard Weinberger commit 91cbf01178c37086b32148c53e24b04cb77557cf Author: Richard Weinberger Date: Thu Oct 24 10:25:35 2019 +0200 Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path" This reverts commit 9163e0184bd7d5f779934d34581843f699ad2ffd. At the point when ubifs_fill_super() runs, we have already a reference to the super block. So upon deactivate_locked_super() c will get free()'ed via ->kill_sb(). Cc: Wenwen Wang Fixes: 9163e0184bd7 ("ubifs: Fix memory leak bug in alloc_ubifs_info() error path") Reported-by: https://twitter.com/grsecurity/status/1180609139359277056 Signed-off-by: Richard Weinberger Tested-by: Romain Izard Signed-off-by: Richard Weinberger commit 7cc7720f06ab7102834140710cd2ae56b142d7ce Author: Ben Dooks (Codethink) Date: Wed Oct 16 11:15:03 2019 +0100 ubifs: Fix type of sup->hash_algo The sup->hash_algo is a __le16, and whilst 0xffff is the same in __le16 and u16, it would be better to use cpu_to_le16() anyway (which should deal with constants) and silence the following sparse warning: fs/ubifs/sb.c:187:32: warning: incorrect type in assignment (different base types) fs/ubifs/sb.c:187:32: expected restricted __le16 [usertype] hash_algo fs/ubifs/sb.c:187:32: got int Signed-off-by: Ben Dooks Signed-off-by: Richard Weinberger commit df22b5b3ecc6233e33bd27f67f14c0cd1b5a5897 Author: Ben Dooks (Codethink) Date: Wed Oct 16 11:08:03 2019 +0100 ubifs: Fixed missed le64_to_cpu() in journal In the ubifs_jnl_write_inode() functon, it calls ubifs_iget() with xent->inum. The xent->inum is __le64, but the ubifs_iget() takes native cpu endian. I think that this should be changed to passing le64_to_cpu(xent->inum) to fix the following sparse warning: fs/ubifs/journal.c:902:58: warning: incorrect type in argument 2 (different base types) fs/ubifs/journal.c:902:58: expected unsigned long inum fs/ubifs/journal.c:902:58: got restricted __le64 [usertype] inum Fixes: 7959cf3a7506 ("ubifs: journal: Handle xattrs like files") Signed-off-by: Ben Dooks Signed-off-by: Richard Weinberger commit 3cfa4412df98207e07de6e60d3c805c541cbce1a Author: Ben Dooks (Codethink) Date: Wed Oct 16 11:04:09 2019 +0100 ubifs: Force prandom result to __le32 In set_dent_cookie() the result of prandom_u32() is assinged to an __le32 type. Make this a forced conversion to remove the following sparse warning: fs/ubifs/journal.c:506:30: warning: incorrect type in assignment (different base types) fs/ubifs/journal.c:506:30: expected restricted __le32 [usertype] cookie fs/ubifs/journal.c:506:30: got unsigned int Signed-off-by: Ben Dooks Signed-off-by: Richard Weinberger commit b27b281f9cfa9153fe9d40dd07cbbdc58be0c7c6 Author: Richard Weinberger Date: Fri Sep 20 08:54:29 2019 +0200 ubifs: Remove obsolete TODO from dfs_file_write() AFAICT this kind of problems are no longer possible since debugfs gained file removal protection via e9117a5a4bf6 ("debugfs: implement per-file removal protection"). Cc: Christoph Hellwig Cc: Nicolai Stange Signed-off-by: Richard Weinberger commit 0997187767425f24518c876a51bb587eb64e02fd Author: Rishi Gupta Date: Thu Sep 19 07:08:18 2019 +0530 ubi: Fix warning static is not at beginning of declaration Compiler generates following warning when kernel is built with W=1: drivers/mtd/ubi/ubi.h:971:1: warning: ‘static’ is not at beginning of declaration [-Wold-style-declaration] This commit fixes this by correctly ordering keywords. Signed-off-by: Rishi Gupta Signed-off-by: Richard Weinberger commit 188945e9d926f5a55d0af7b2faf4e658a67500a6 Author: Stefan Roese Date: Tue Sep 17 08:31:08 2019 +0200 ubi: Print skip_check in ubi_dump_vol_info() It might be interesting, if "skip_check" is set or not, so lets print this flag in ubi_dump_vol_info() as well. Signed-off-by: Stefan Roese Cc: Richard Weinberger Cc: Boris Brezillon Cc: Heiko Schocher Signed-off-by: Richard Weinberger commit 589e1b6c47ce72fcae103c2e45d899610c92c11e Merge: 8389a7b909f2 777260a5c992 Author: Miquel Raynal Date: Sun Nov 17 18:34:25 2019 +0100 Merge tag 'nand/for-5.5' into mtd/next Raw NAND core * Useless extra checks dropped. * Updated the detection of the bad block markers position Raw NAND controller drivers: * Cadence : New driver * Brcmnand: Support for flash-dma v0 + fixes * Denali : Support for the legacy controller/chip DT representation dropped * Superfluous dev_err() calls removed commit 8389a7b909f252e74ea92b2794de8d660cfee96e Merge: ad39b5a1ed68 83cba933a6db Author: Miquel Raynal Date: Sun Nov 17 18:34:01 2019 +0100 Merge tag 'spi-nor/for-5.5' into mtd/next SPI NOR core changes: - introduce 'struct spi_nor_controller_ops', - clean the Register Operations methods, - use dev_dbg insted of dev_err for low level info, - fix retlen handling in sst_write(), - fix silent truncations in spi_nor_read and spi_nor_read_raw(), - fix the clearing of QE bit on lock()/unlock(), - rework the disabling of the block write protection, - rework the Quad Enable methods, - make sure nor->spimem and nor->controller_ops are mutually exclusive, - set default Quad Enable method for ISSI flashes, - add support for few flashes. SPI NOR controller drivers changes: - intel-spi: - support chips without software sequencer, - add support for Intel Cannon Lake and Intel Comet Lake-H flashes. commit ad39b5a1ed68032292794b41a5f9e41ea69f8052 Merge: 14f89e088155 c15995695ea9 Author: Miquel Raynal Date: Sun Nov 17 18:32:35 2019 +0100 Merge CFI/Hyperbus tag 'for-v5.5-rc1' into mtd/next CFI core changes: * Code cleanups related useless initializers and coding style issues * Fix for a possible double free problem in cfi_cmdset_0002 * Improved error reporting and handling in cfi_cmdset_0002 core for HyperFlash commit adbb68293fc5950a46e3e22f9dc9c619661194ae Author: Dan Williams Date: Tue Nov 12 17:00:24 2019 -0800 libnvdimm: Move nd_device_attribute_group to device_type A 'struct device_type' instance can carry default attributes for the device. Use this facility to remove the export of nd_device_attribute_group and put the responsibility on the core rather than leaf implementations to define this attribute. For regions this creates a new nd_region_attribute_groups[] added to the per-region device-type instances. Cc: Ira Weiny Cc: Michael Ellerman Cc: "Oliver O'Halloran" Cc: Vishal Verma Cc: Aneesh Kumar K.V Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309901138.1582359.12909354140826530394.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit cb719d5fefc508bc80c25ac6c875a4fe6240ba73 Author: Dan Williams Date: Wed Nov 6 19:56:46 2019 -0800 libnvdimm: Move region attribute group definition In preparation for moving region attributes from device attribute groups to the region device-type, reorder the declaration so that it can be referenced by the device-type definition without forward declarations. No functional changes are intended to result from this change. Cc: Ira Weiny Cc: Vishal Verma Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309900624.1582359.6929998072035982264.stgit@dwillia2-desk3.amr.corp.intel.com commit 78c81cc89a40114d09a5ec0693cfd97831ffbe79 Author: Dan Williams Date: Wed Nov 6 19:56:41 2019 -0800 libnvdimm: Move attribute groups to device type Statically initialize the attribute groups for each libnvdimm device_type. This is a preparation step for removing unnecessary exports of attributes that can be included in the device_type by default. Also take the opportunity to mark 'struct device_type' instances const. Cc: Ira Weiny Cc: Vishal Verma Signed-off-by: Dan Williams Reviewed-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/157309900111.1582359.2445687530383470348.stgit@dwillia2-desk3.amr.corp.intel.com commit cda93d6965a162be87f9d6dc5fb28b99335860fe Author: Alastair D'Silva Date: Fri Oct 25 15:46:57 2019 +1100 libnvdimm: Remove prototypes for nonexistent functions These functions don't exist, so remove the prototypes for them. Signed-off-by: Alastair D'Silva Reviewed-by: Andrew Donnellan Reviewed-by: Frederic Barrat Link: https://lore.kernel.org/r/20191025044721.16617-3-alastair@au1.ibm.com Signed-off-by: Dan Williams commit 4e24e37d5313edca8b4ab86f240c046c731e28d6 Author: Qian Cai Date: Thu Oct 31 10:05:19 2019 -0400 libnvdimm/btt: fix variable 'rc' set but not used drivers/nvdimm/btt.c: In function 'btt_read_pg': drivers/nvdimm/btt.c:1264:8: warning: variable 'rc' set but not used [-Wunused-but-set-variable] int rc; ^~ Add a ratelimited message in case a storm of errors is encountered. Fixes: d9b83c756953 ("libnvdimm, btt: rework error clearing") Signed-off-by: Qian Cai Reviewed-by: Vishal Verma Link: https://lore.kernel.org/r/1572530719-32161-1-git-send-email-cai@lca.pw Signed-off-by: Dan Williams commit d7c0d927ad5ca452201eae40f932712ac733c816 Author: Dan Williams Date: Wed Oct 30 16:45:53 2019 -0700 libnvdimm/pmem: Delete include of nd-core.h The entire point of nd-core.h is to hide functionality that no leaf driver should touch. In fact, the commit that added it had no need to include it. Fixes: 06e8ccdab15f ("acpi: nfit: Add support for detect platform...") Cc: Ira Weiny Cc: Dave Jiang Cc: Vishal Verma Signed-off-by: Dan Williams commit 9067f2f0b41d7e817fc8c5259bab1f17512b0147 Author: Christophe JAILLET Date: Mon Sep 23 21:07:46 2019 +0200 RDMA/iw_cgxb4: Fix an error handling path in 'c4iw_connect()' We should jump to fail3 in order to undo the 'xa_insert_irq()' call. Link: https://lore.kernel.org/r/20190923190746.10964-1-christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Signed-off-by: Jason Gunthorpe commit e1ee1e62bec4a8968355517ea11b2a06b7364408 Author: Dag Moxnes Date: Wed Oct 30 13:44:00 2019 +0100 RDMA/cma: Use ACK timeout for RoCE packetLifeTime The cma is currently using a hard-coded value, CMA_IBOE_PACKET_LIFETIME, for the PacketLifeTime, as it can not be determined from the network. This value might not be optimal for all networks. The cma module supports the function rdma_set_ack_timeout to set the ACK timeout for a QP associated with a connection. As per IBTA 12.7.34 local ACK timeout = (2 * PacketLifeTime + Local CA’s ACK delay). Assuming a negligible local ACK delay, we can use PacketLifeTime = local ACK timeout/2 as a reasonable approximation for RoCE networks. Link: https://lore.kernel.org/r/1572439440-17416-1-git-send-email-dag.moxnes@oracle.com Signed-off-by: Dag Moxnes Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 72b894b09a96b741c92562709f6629310f2b34a1 Author: Christoph Hellwig Date: Wed Nov 13 08:32:14 2019 +0100 IB/umem: remove the dmasync argument to ib_umem_get The argument is always ignored, so remove it. Link: https://lore.kernel.org/r/20191113073214.9514-3-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Acked-by: Michal Kalderon Signed-off-by: Jason Gunthorpe commit 5a5e277b8d408ef2b167282d62662be0437d381f Author: Lori Hikichi Date: Mon Sep 30 12:14:29 2019 +0530 i2c: iproc: Add i2c repeated start capability Enable handling of i2c repeated start. The current code handles a multi msg i2c transfer as separate i2c bus transactions. This change will now handle this case using the i2c repeated start protocol. The number of msgs in a transfer is limited to two, and must be a write followed by a read. Signed-off-by: Lori Hikichi Signed-off-by: Rayagonda Kokatanur Signed-off-by: Icarus Chau Signed-off-by: Ray Jui Signed-off-by: Shivaraj Shetty Signed-off-by: Wolfram Sang commit 7763baace1b738d65efa46d68326c9406311c6bf Author: Valentin Schneider Date: Fri Nov 15 10:39:08 2019 +0000 sched/uclamp: Fix overzealous type replacement Some uclamp helpers had their return type changed from 'unsigned int' to 'enum uclamp_id' by commit 0413d7f33e60 ("sched/uclamp: Always use 'enum uclamp_id' for clamp_id values") but it happens that some do return a value in the [0, SCHED_CAPACITY_SCALE] range, which should really be unsigned int. The affected helpers are uclamp_none(), uclamp_rq_max_value() and uclamp_eff_value(). Fix those up. Note that this doesn't lead to any obj diff using a relatively recent aarch64 compiler (8.3-2019.03). The current code of e.g. uclamp_eff_value() properly returns an 11 bit value (bits_per(1024)) and doesn't seem to do anything funny. I'm still marking this as fixing the above commit to be on the safe side. Signed-off-by: Valentin Schneider Reviewed-by: Qais Yousef Acked-by: Vincent Guittot Cc: Dietmar.Eggemann@arm.com Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: patrick.bellasi@matbug.net Cc: qperret@google.com Cc: surenb@google.com Cc: tj@kernel.org Fixes: 0413d7f33e60 ("sched/uclamp: Always use 'enum uclamp_id' for clamp_id values") Link: https://lkml.kernel.org/r/20191115103908.27610-1-valentin.schneider@arm.com Signed-off-by: Ingo Molnar commit a76bea0287ce13d28494b19649d80d8ee5e7b757 Author: Valentin Longchamp Date: Tue Nov 12 20:56:23 2019 +0100 powerpc/kmcent2: add ranges to the pci bridges This removes the warnings about the fact that the 4 pci bridges (i.e. the 4 pci hosts) don't have any ranges. Signed-off-by: Valentin Longchamp Signed-off-by: Scott Wood commit 3a0990ca1a00cb9fd0278410b9b71a670ffcbffc Author: Geert Uytterhoeven Date: Fri Oct 25 11:29:01 2019 +0200 powerpc/booke: Spelling s/date/data/ Caching dates is never a good idea ;-) Fixes: e7affb1dba0e9068 ("powerpc/cache: add cache flush operation for various e500") Signed-off-by: Geert Uytterhoeven Signed-off-by: Scott Wood commit 3e4282e484b3b45f1de3f2e9e6c8b192d3ac9fcf Author: Rasmus Villemoes Date: Wed Oct 23 14:54:48 2019 +0200 powerpc/85xx: remove mostly pointless mpc85xx_qe_init() Since commit 302c059f2e7b (QE: use subsys_initcall to init qe), mpc85xx_qe_init() has done nothing apart from possibly emitting a pr_err(). As part of reducing the amount of QE-related code in arch/powerpc/ (and eventually support QE on other architectures), remove this low-hanging fruit. Signed-off-by: Rasmus Villemoes Signed-off-by: Scott Wood commit ea67a5519d61f14517f9ee35b3151f44202c2023 Author: Valentin Longchamp Date: Sun Jul 14 22:05:01 2019 +0200 powerpc/kmcent2: update the ethernet devices' phy properties Change all phy-connection-type properties to phy-mode that are better supported by the fman driver. Use the more readable fixed-link node for the 2 sgmii links. Change the RGMII link to rgmii-id as the clock delays are added by the phy. Signed-off-by: Valentin Longchamp Acked-by: Madalin Bucur Signed-off-by: Scott Wood commit 19b7e21c55c81713c4011278143006af9f232504 Merge: 1e8795b1b20d 1d4c79ed324a Author: David S. Miller Date: Sat Nov 16 18:47:31 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Lots of overlapping changes and parallel additions, stuff like that. Signed-off-by: David S. Miller commit 9e8d42a0f7eb9056f8bdb241b91738b5a2923f4c Author: Sebastian Andrzej Siewior Date: Fri Nov 8 18:35:53 2019 +0100 percpu-refcount: Use normal instead of RCU-sched" This is a revert of commit a4244454df129 ("percpu-refcount: use RCU-sched insted of normal RCU") which claims the only reason for using RCU-sched is "rcu_read_[un]lock() … are slightly more expensive than preempt_disable/enable()" and "As the RCU critical sections are extremely short, using sched-RCU shouldn't have any latency implications." The problem with using RCU-sched here is that it disables preemption and the release callback (called from percpu_ref_put_many()) must not acquire any sleeping locks like spinlock_t. This breaks PREEMPT_RT because some of the users acquire spinlock_t locks in their callbacks. Using rcu_read_lock() on PREEMPTION=n kernels is not any different compared to rcu_read_lock_sched(). On PREEMPTION=y kernels there are already performance issues due to additional preemption points. Looking at the code, the rcu_read_lock() is just an increment and unlock is almost just a decrement unless there is something special to do. Both are functions while disabling preemption is inlined. Doing a small benchmark, the minimal amount of time required was mostly the same. The average time required was higher due to the higher MAX value (which could be preemption). With DEBUG_PREEMPT=y it is rcu_read_lock_sched() that takes a little longer due to the additional debug code. Convert back to normal RCU. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Dennis Zhou commit 5620eb6c9d814b1e26e53b31adb40a57dc904b35 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:54 2019 +0100 crypto: ccree - update a stale reference to ablkcipher The ccree driver does not use the ablkcipher interface but contains a rudimentary reference to it in the naming of an unrelated macro. Let's rename it to avoid confusion. Acked-by: Gilad Ben-Yossef Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit d63007eb954e425f45766482813738f41db9af45 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:53 2019 +0100 crypto: ablkcipher - remove deprecated and unused ablkcipher support Now that all users of the deprecated ablkcipher interface have been moved to the skcipher interface, ablkcipher is no longer used and can be removed. Reviewed-by: Eric Biggers Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 809abaefa4d25a46bfa35e595049f23f3e35e4e6 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:52 2019 +0100 crypto: nx - remove stale comment referring to the blkcipher walk API These drivers do not use either the deprecated blkcipher or the current skcipher walk API, so this comment must refer to a previous state of the driver that no longer exists. So drop the comments. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 8160ee7e285dc9cb69cae12b4505af7b425625b7 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:51 2019 +0100 crypto: marvell/cesa - rename blkcipher to skcipher The driver specific types contain some rudimentary references to the blkcipher API, which is deprecated and will be removed. To avoid confusion, rename these to skcipher. This is a cosmetic change only, as the code does not actually use the blkcipher API. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 7fe948a52287adf2c0b6a76077386758322d8f6e Author: Ard Biesheuvel Date: Sat Nov 9 18:09:50 2019 +0100 crypto: qat - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Co-developed-by: Giovanni Cabiddu Signed-off-by: Giovanni Cabiddu Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 373960d794d2b075e8c782093189cc11df5b7139 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:49 2019 +0100 crypto: talitos - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit ce0183cb6464bacc170ccfddb4d93bbe10d1045b Author: Ard Biesheuvel Date: Sat Nov 9 18:09:48 2019 +0100 crypto: rockchip - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Cc: Heiko Stuebner Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 23a6564a6b51453ab905252c19180c07028e3f7e Author: Ard Biesheuvel Date: Sat Nov 9 18:09:47 2019 +0100 crypto: niagara2 - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Acked-by: David S. Miller Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 47ece4813f19f18d00c337033bd13370611fcb33 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:46 2019 +0100 crypto: stm32 - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Cc: Maxime Coquelin Cc: Alexandre Torgue Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 8bf0871539faa090fa057cee83cf06ef4e76e7c5 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:45 2019 +0100 crypto: qce - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Reviewed-by: Stanimir Varbanov Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit b3cde6bab4e8d2d76e3a2f2a41336136a51ee6e7 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:44 2019 +0100 crypto: picoxcell - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Cc: Jamie Iles Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 44c10a837c1f3694fe1b12c3b26639b948f985ea Author: Ard Biesheuvel Date: Sat Nov 9 18:09:43 2019 +0100 crypto: sahara - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit c2609391f95b140eaa21442581c6675ba10388d9 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:42 2019 +0100 crypto: mediatek - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Cc: Matthias Brugger Cc: linux-mediatek@lists.infradead.org Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 9acb3247e0e1d94e667a59568730f990486d6b25 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:41 2019 +0100 crypto: mxs - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Tested-by: Horia Geantă Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 4aaf384095ec7d6c215eee31ac5189e4291abdd5 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:40 2019 +0100 crypto: ixp4xx - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Reviewed-by: Linus Walleij Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit b462973aa9cd3caf529f32c69aa420c68339ba08 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:39 2019 +0100 crypto: hifn - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 7cea6d3e01c2f4bf5e0687dcc8b4215b92580c16 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:38 2019 +0100 crypto: chelsio - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Cc: Atul Gupta Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit ac0d3d130f909f4d8f402b185a68d76150ebdf78 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:37 2019 +0100 crypto: cavium/cpt - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit e8306261a3625f7ef8b25bd6a71431a519cea607 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:36 2019 +0100 crypto: nitrox - remove cra_type reference to ablkcipher Setting the cra_type field is not necessary for skciphers, and ablkcipher will be removed, so drop the assignment from the nitrox driver. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit a9c01cd608c43912320c830275395f2c78c94719 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:35 2019 +0100 crypto: bcm-spu - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 967d4910ef0e832d42c23f62a548336939164def Author: Ard Biesheuvel Date: Sat Nov 9 18:09:34 2019 +0100 crypto: atmel-tdes - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Cc: Nicolas Ferre Cc: Alexandre Belloni Cc: Ludovic Desroches Tested-by: Tudor Ambarus Signed-off-by: Ard Biesheuvel Reviewed-by: Tudor Ambarus Signed-off-by: Herbert Xu commit 7ada42d2519e8197462f44311acda8caaa634be4 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:33 2019 +0100 crypto: atmel-aes - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Cc: Nicolas Ferre Cc: Alexandre Belloni Cc: Ludovic Desroches Tested-by: Tudor Ambarus Signed-off-by: Ard Biesheuvel Reviewed-by: Tudor Ambarus Signed-off-by: Herbert Xu commit e6b98ce6145a2c681765a9b8026c2b26fff5629d Author: Ard Biesheuvel Date: Sat Nov 9 18:09:32 2019 +0100 crypto: s5p - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Reviewed-by: Kamil Konieczny Tested-by: Kamil Konieczny Acked-by: Krzysztof Kozlowski Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit b5e5c373ead45c6f5492520b46d53222324a068f Author: Ard Biesheuvel Date: Sat Nov 9 18:09:31 2019 +0100 crypto: ux500 - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Reviewed-by: Linus Walleij Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit b3e3f0fe4f555232ddd64af86e383891dda86c26 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:30 2019 +0100 crypto: omap - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Cc: Tony Lindgren Cc: linux-omap@vger.kernel.org Reviewed-by: Tero Kristo Tested-by: Tero Kristo Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit be9fe620af63e76781d869f61d7e306bbe482415 Author: Ard Biesheuvel Date: Sat Nov 9 18:09:29 2019 +0100 crypto: ccp - switch from ablkcipher to skcipher Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Reviewed-by: Gary R Hook Tested-by: Gary R Hook Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit eee1d6fca0a02f5a089ad063812f98e717b8e7df Author: Ard Biesheuvel Date: Sat Nov 9 18:09:28 2019 +0100 crypto: virtio - switch to skcipher API Commit 7a7ffe65c8c5 ("crypto: skcipher - Add top-level skcipher interface") dated 20 august 2015 introduced the new skcipher API which is supposed to replace both blkcipher and ablkcipher. While all consumers of the API have been converted long ago, some producers of the ablkcipher remain, forcing us to keep the ablkcipher support routines alive, along with the matching code to expose [a]blkciphers via the skcipher API. So switch this driver to the skcipher API, allowing us to finally drop the ablkcipher code in the near future. Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Gonglei Cc: virtualization@lists.linux-foundation.org Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 19c5da7d4a2662e85ea67d2d81df57e038fde3ab Author: Ard Biesheuvel Date: Sat Nov 9 18:09:27 2019 +0100 crypto: virtio - deal with unsupported input sizes Return -EINVAL for input sizes that are not a multiple of the AES block size, since they are not supported by our CBC chaining mode. While at it, remove the pr_err() that reports unsupported key sizes being used: we shouldn't spam the kernel log with that. Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver") Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Gonglei Cc: virtualization@lists.linux-foundation.org Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 500e6807ce93b1fdc7d5b827c5cc167cc35630db Author: Ard Biesheuvel Date: Sat Nov 9 18:09:26 2019 +0100 crypto: virtio - implement missing support for output IVs In order to allow for CBC to be chained, which is something that the CTS template relies upon, implementations of CBC need to pass the IV to be used for subsequent invocations via the IV buffer. This was not implemented yet for virtio-crypto so implement it now. Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver") Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Gonglei Cc: virtualization@lists.linux-foundation.org Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 07d8f18588324b71aa8188cea5df3f1de5e354cb Author: Corentin Labbe Date: Fri Nov 8 15:42:13 2019 +0000 crypto: tcrypt - constify check alg list this patchs constify the alg list because this list is never modified. Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu commit d95312a3ccc0cd544d374be2fc45aeaa803e5fd9 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:40 2019 +0100 crypto: lib/chacha20poly1305 - reimplement crypt_from_sg() routine Reimplement the library routines to perform chacha20poly1305 en/decryption on scatterlists, without [ab]using the [deprecated] blkcipher interface, which is rather heavyweight and does things we don't really need. Instead, we use the sg_miter API in a novel and clever way, to iterate over the scatterlist in-place (i.e., source == destination, which is the only way this library is expected to be used). That way, we don't have to iterate over two scatterlists in parallel. Another optimization is that, instead of relying on the blkcipher walker to present the input in suitable chunks, we recognize that ChaCha is a streamcipher, and so we can simply deal with partial blocks by keeping a block of cipherstream on the stack and use crypto_xor() to mix it with the in/output. Finally, we omit the scatterwalk_and_copy() call if the last element of the scatterlist covers the MAC as well (which is the common case), avoiding the need to walk the scatterlist and kmap() the page twice. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit ed20078b7e3331e82828be357147af6a3282e4ce Author: Ard Biesheuvel Date: Fri Nov 8 13:22:39 2019 +0100 crypto: chacha20poly1305 - import construction and selftest from Zinc This incorporates the chacha20poly1305 from the Zinc library, retaining the library interface, but replacing the implementation with calls into the code that already existed in the kernel's crypto API. Note that this library API does not implement RFC7539 fully, given that it is limited to 64-bit nonces. (The 96-bit nonce version that was part of the selftest only has been removed, along with the 96-bit nonce test vectors that only tested the selftest but not the actual library itself) Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit d8f1308a025fc7e00414194ed742d5f05a21e13c Author: Jason A. Donenfeld Date: Fri Nov 8 13:22:38 2019 +0100 crypto: arm/curve25519 - wire up NEON implementation This ports the SUPERCOP implementation for usage in kernel space. In addition to the usual header, macro, and style changes required for kernel space, it makes a few small changes to the code: - The stack alignment is relaxed to 16 bytes. - Superfluous mov statements have been removed. - ldr for constants has been replaced with movw. - ldreq has been replaced with moveq. - The str epilogue has been made more idiomatic. - SIMD registers are not pushed and popped at the beginning and end. - The prologue and epilogue have been made idiomatic. - A hole has been removed from the stack, saving 32 bytes. - We write-back the base register whenever possible for vld1.8. - Some multiplications have been reordered for better A7 performance. There are more opportunities for cleanup, since this code is from qhasm, which doesn't always do the most opportune thing. But even prior to extensive hand optimizations, this code delivers significant performance improvements (given in get_cycles() per call): ----------- ------------- | generic C | this commit | ------------ ----------- ------------- | Cortex-A7 | 49136 | 22395 | ------------ ----------- ------------- | Cortex-A17 | 17326 | 4983 | ------------ ----------- ------------- Signed-off-by: Jason A. Donenfeld [ardb: - move to arch/arm/crypto - wire into lib/crypto framework - implement crypto API KPP hooks ] Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit f0fb006b604f98e2309a30f34ef455ac734f7c1c Author: Jason A. Donenfeld Date: Fri Nov 8 13:22:37 2019 +0100 crypto: arm/curve25519 - import Bernstein and Schwabe's Curve25519 ARM implementation This comes from Dan Bernstein and Peter Schwabe's public domain NEON code, and is included here in raw form so that subsequent commits that fix these up for the kernel can see how it has changed. This code does have some entirely cosmetic formatting differences, adding indentation and so forth, so that when we actually port it for use in the kernel in the subsequent commit, it's obvious what's changed in the process. This code originates from SUPERCOP 20180818, available at . Signed-off-by: Jason A. Donenfeld Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit bb611bdfd6be34d9f822c73305fcc83720499d38 Author: Jason A. Donenfeld Date: Fri Nov 8 13:22:36 2019 +0100 crypto: curve25519 - x86_64 library and KPP implementations This implementation is the fastest available x86_64 implementation, and unlike Sandy2x, it doesn't requie use of the floating point registers at all. Instead it makes use of BMI2 and ADX, available on recent microarchitectures. The implementation was written by Armando Faz-Hernández with contributions (upstream) from Samuel Neves and me, in addition to further changes in the kernel implementation from us. Signed-off-by: Jason A. Donenfeld Signed-off-by: Samuel Neves Co-developed-by: Samuel Neves [ardb: - move to arch/x86/crypto - wire into lib/crypto framework - implement crypto API KPP hooks ] Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 660bb8e1f833ea63185fe80fde847e3e42f18e3b Author: Ard Biesheuvel Date: Fri Nov 8 13:22:35 2019 +0100 crypto: lib/curve25519 - work around Clang stack spilling issue Arnd reports that the 32-bit generic library code for Curve25119 ends up using an excessive amount of stack space when built with Clang: lib/crypto/curve25519-fiat32.c:756:6: error: stack frame size of 1384 bytes in function 'curve25519_generic' [-Werror,-Wframe-larger-than=] Let's give some hints to the compiler regarding which routines should not be inlined, to prevent it from running out of registers and spilling to the stack. The resulting code performs identically under both GCC and Clang, and makes the warning go away. Suggested-by: Arnd Bergmann Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit ee772cb641135739c1530647391d5a04c39db192 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:34 2019 +0100 crypto: curve25519 - implement generic KPP driver Expose the generic Curve25519 library via the crypto API KPP interface. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit f613457a7af085728297bef71233c37faf3c01b1 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:33 2019 +0100 crypto: curve25519 - add kpp selftest In preparation of introducing KPP implementations of Curve25519, import the set of test cases proposed by the Zinc patch set, but converted to the KPP format. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 0ed42a6f431e930b2e8fae21955406e09fe75d70 Author: Jason A. Donenfeld Date: Fri Nov 8 13:22:32 2019 +0100 crypto: curve25519 - generic C library implementations This contains two formally verified C implementations of the Curve25519 scalar multiplication function, one for 32-bit systems, and one for 64-bit systems whose compiler supports efficient 128-bit integer types. Not only are these implementations formally verified, but they are also the fastest available C implementations. They have been modified to be friendly to kernel space and to be generally less horrendous looking, but still an effort has been made to retain their formally verified characteristic, and so the C might look slightly unidiomatic. The 64-bit version comes from HACL*: https://github.com/project-everest/hacl-star The 32-bit version comes from Fiat: https://github.com/mit-plv/fiat-crypto Information: https://cr.yp.to/ecdh.html Signed-off-by: Jason A. Donenfeld [ardb: - move from lib/zinc to lib/crypto - replace .c #includes with Kconfig based object selection - drop simd handling and simplify support for per-arch versions ] Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit ed0356eda153f6a95649e11feb7b07083caf9e20 Author: Jason A. Donenfeld Date: Fri Nov 8 13:22:31 2019 +0100 crypto: blake2s - x86_64 SIMD implementation These implementations from Samuel Neves support AVX and AVX-512VL. Originally this used AVX-512F, but Skylake thermal throttling made AVX-512VL more attractive and possible to do with negligable difference. Signed-off-by: Jason A. Donenfeld Signed-off-by: Samuel Neves Co-developed-by: Samuel Neves [ardb: move to arch/x86/crypto, wire into lib/crypto framework] Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 7f9b0880925f1f9d7d59504ea0892d2ae9cfc233 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:30 2019 +0100 crypto: blake2s - implement generic shash driver Wire up our newly added Blake2s implementation via the shash API. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 17e1df67023a5c9ccaeb5de8bf5b88f63127ecf7 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:29 2019 +0100 crypto: testmgr - add test cases for Blake2s As suggested by Eric for the Blake2b implementation contributed by David, introduce a set of test vectors for Blake2s covering different digest and key sizes. blake2s-128 blake2s-160 blake2s-224 blake2s-256 --------------------------------------------------- len=0 | klen=0 klen=1 klen=16 klen=32 len=1 | klen=16 klen=32 klen=0 klen=1 len=7 | klen=32 klen=0 klen=1 klen=16 len=15 | klen=1 klen=16 klen=32 klen=0 len=64 | klen=0 klen=1 klen=16 klen=32 len=247 | klen=16 klen=32 klen=0 klen=1 len=256 | klen=32 klen=0 klen=1 klen=16 Cc: David Sterba Cc: Eric Biggers Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 66d7fb94e4ffe5acc589e0b2b4710aecc1f07a28 Author: Jason A. Donenfeld Date: Fri Nov 8 13:22:28 2019 +0100 crypto: blake2s - generic C library implementation and selftest The C implementation was originally based on Samuel Neves' public domain reference implementation but has since been heavily modified for the kernel. We're able to do compile-time optimizations by moving some scaffolding around the final function into the header file. Information: https://blake2.net/ Signed-off-by: Jason A. Donenfeld Signed-off-by: Samuel Neves Co-developed-by: Samuel Neves [ardb: - move from lib/zinc to lib/crypto - remove simd handling - rewrote selftest for better coverage - use fixed digest length for blake2s_hmac() and rename to blake2s256_hmac() ] Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit c12d3362a74bf0cd9e1d488918d40607b62a3104 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:27 2019 +0100 int128: move __uint128_t compiler test to Kconfig In order to use 128-bit integer arithmetic in C code, the architecture needs to have declared support for it by setting ARCH_SUPPORTS_INT128, and it requires a version of the toolchain that supports this at build time. This is why all existing tests for ARCH_SUPPORTS_INT128 also test whether __SIZEOF_INT128__ is defined, since this is only the case for compilers that can support 128-bit integers. Let's fold this additional test into the Kconfig declaration of ARCH_SUPPORTS_INT128 so that we can also use the symbol in Makefiles, e.g., to decide whether a certain object needs to be included in the first place. Cc: Masahiro Yamada Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit a11d055e7a64ac34a5e99b6fe731299449cbcd58 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:26 2019 +0100 crypto: mips/poly1305 - incorporate OpenSSL/CRYPTOGAMS optimized implementation This is a straight import of the OpenSSL/CRYPTOGAMS Poly1305 implementation for MIPS authored by Andy Polyakov, a prior 64-bit only version of which has been contributed by him to the OpenSSL project. The file 'poly1305-mips.pl' is taken straight from this upstream GitHub repository [0] at commit d22ade312a7af958ec955620b0d241cf42c37feb, and already contains all the changes required to build it as part of a Linux kernel module. [0] https://github.com/dot-asm/cryptogams Co-developed-by: Andy Polyakov Signed-off-by: Andy Polyakov Co-developed-by: René van Dorst Signed-off-by: René van Dorst Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit a6b803b3ddc793d6db0c16f12fc12d30d20fa9cc Author: Ard Biesheuvel Date: Fri Nov 8 13:22:25 2019 +0100 crypto: arm/poly1305 - incorporate OpenSSL/CRYPTOGAMS NEON implementation This is a straight import of the OpenSSL/CRYPTOGAMS Poly1305 implementation for NEON authored by Andy Polyakov, and contributed by him to the OpenSSL project. The file 'poly1305-armv4.pl' is taken straight from this upstream GitHub repository [0] at commit ec55a08dc0244ce570c4fc7cade330c60798952f, and already contains all the changes required to build it as part of a Linux kernel module. [0] https://github.com/dot-asm/cryptogams Co-developed-by: Andy Polyakov Signed-off-by: Andy Polyakov Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit f569ca16475155013525686d0f73bc379c67e635 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:24 2019 +0100 crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS NEON implementation This is a straight import of the OpenSSL/CRYPTOGAMS Poly1305 implementation for NEON authored by Andy Polyakov, and contributed by him to the OpenSSL project. The file 'poly1305-armv8.pl' is taken straight from this upstream GitHub repository [0] at commit ec55a08dc0244ce570c4fc7cade330c60798952f, and already contains all the changes required to build it as part of a Linux kernel module. [0] https://github.com/dot-asm/cryptogams Co-developed-by: Andy Polyakov Signed-off-by: Andy Polyakov Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit f0e89bcfbb894e5844cd1bbf6b3cf7c63cb0f5ac Author: Ard Biesheuvel Date: Fri Nov 8 13:22:23 2019 +0100 crypto: x86/poly1305 - expose existing driver as poly1305 library Implement the arch init/update/final Poly1305 library routines in the accelerated SIMD driver for x86 so they are accessible to users of the Poly1305 library interface as well. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 1b2c6a5120489d41c8ea3b8dacd0b4586289b158 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:22 2019 +0100 crypto: x86/poly1305 - depend on generic library not generic shash Remove the dependency on the generic Poly1305 driver. Instead, depend on the generic library so that we only reuse code without pulling in the generic skcipher implementation as well. While at it, remove the logic that prefers the non-SIMD path for short inputs - this is no longer necessary after recent FPU handling changes on x86. Since this removes the last remaining user of the routines exported by the generic shash driver, unexport them and make them static. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit a1d93064094cc5e24d64e35cf093e7191d0c9344 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:21 2019 +0100 crypto: poly1305 - expose init/update/final library interface Expose the existing generic Poly1305 code via a init/update/final library interface so that callers are not required to go through the crypto API's shash abstraction to access it. At the same time, make some preparations so that the library implementation can be superseded by an accelerated arch-specific version in the future. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit ad8f5b88383ea685f2b8df2a12ee3e08089a1287 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:20 2019 +0100 crypto: x86/poly1305 - unify Poly1305 state struct with generic code In preparation of exposing a Poly1305 library interface directly from the accelerated x86 driver, align the state descriptor of the x86 code with the one used by the generic driver. This is needed to make the library interface unified between all implementations. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 48ea8c6ebc96bc0990e12ee1c43d0832c23576bb Author: Ard Biesheuvel Date: Fri Nov 8 13:22:19 2019 +0100 crypto: poly1305 - move core routines into a separate library Move the core Poly1305 routines shared between the generic Poly1305 shash driver and the Adiantum and NHPoly1305 drivers into a separate library so that using just this pieces does not pull in the crypto API pieces of the generic Poly1305 routine. In a subsequent patch, we will augment this generic library with init/update/final routines so that Poyl1305 algorithm can be used directly without the need for using the crypto API's shash abstraction. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 22cf705360707ced15f9fe5423938f313c7df536 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:18 2019 +0100 crypto: chacha - unexport chacha_generic routines Now that all users of generic ChaCha code have moved to the core library, there is no longer a need for the generic ChaCha skcpiher driver to export parts of it implementation for reuse by other drivers. So drop the exports, and make the symbols static. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 3a2f58f3ba4f6f44e33d1a48240d5eadb882cb59 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:17 2019 +0100 crypto: mips/chacha - wire up accelerated 32r2 code from Zinc This integrates the accelerated MIPS 32r2 implementation of ChaCha into both the API and library interfaces of the kernel crypto stack. The significance of this is that, in addition to becoming available as an accelerated library implementation, it can also be used by existing crypto API code such as Adiantum (for block encryption on ultra low performance cores) or IPsec using chacha20poly1305. These are use cases that have already opted into using the abstract crypto API. In order to support Adiantum, the core assembler routine has been adapted to take the round count as a function argument rather than hardcoding it to 20. Co-developed-by: René van Dorst Signed-off-by: René van Dorst Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 49aa7c00eddf8d8f462b0256bd82e81762d7b0c6 Author: Jason A. Donenfeld Date: Fri Nov 8 13:22:16 2019 +0100 crypto: mips/chacha - import 32r2 ChaCha code from Zinc This imports the accelerated MIPS 32r2 ChaCha20 implementation from the Zinc patch set. Co-developed-by: René van Dorst Signed-off-by: René van Dorst Signed-off-by: Jason A. Donenfeld Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit a44a3430d71bad4ee56788a59fff099b291ea54c Author: Ard Biesheuvel Date: Fri Nov 8 13:22:15 2019 +0100 crypto: arm/chacha - expose ARM ChaCha routine as library function Expose the accelerated NEON ChaCha routine directly as a symbol export so that users of the ChaCha library API can use it directly. Given that calls into the library API will always go through the routines in this module if it is enabled, switch to static keys to select the optimal implementation available (which may be none at all, in which case we defer to the generic implementation for all invocations). Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit b36d8c09e710c71f6a9690b6586fea2d1c9e1e27 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:14 2019 +0100 crypto: arm/chacha - remove dependency on generic ChaCha driver Instead of falling back to the generic ChaCha skcipher driver for non-SIMD cases, use a fast scalar implementation for ARM authored by Eric Biggers. This removes the module dependency on chacha-generic altogether, which also simplifies things when we expose the ChaCha library interface from this module. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 29621d099f9c642b22a69dc8e7e20c108473a392 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:13 2019 +0100 crypto: arm/chacha - import Eric Biggers's scalar accelerated ChaCha code Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit b3aad5bad26a01a4bd8c49a5c5f52aec665f3b7c Author: Ard Biesheuvel Date: Fri Nov 8 13:22:12 2019 +0100 crypto: arm64/chacha - expose arm64 ChaCha routine as library function Expose the accelerated NEON ChaCha routine directly as a symbol export so that users of the ChaCha library API can use it directly. Given that calls into the library API will always go through the routines in this module if it is enabled, switch to static keys to select the optimal implementation available (which may be none at all, in which case we defer to the generic implementation for all invocations). Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit c77da4867cbb7841177275dbb250f5c09679fae4 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:11 2019 +0100 crypto: arm64/chacha - depend on generic chacha library instead of crypto driver Depend on the generic ChaCha library routines instead of pulling in the generic ChaCha skcipher driver, which is more than we need, and makes managing the dependencies between the generic library, generic driver, accelerated library and driver more complicated. While at it, drop the logic to prefer the scalar code on short inputs. Turning the NEON on and off is cheap these days, and one major use case for ChaCha20 is ChaCha20-Poly1305, which is guaranteed to hit the scalar path upon every invocation (when doing the Poly1305 nonce generation) Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 84e03fa39fbe95a5567d43bff458c6d3b3a23ad1 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:10 2019 +0100 crypto: x86/chacha - expose SIMD ChaCha routine as library function Wire the existing x86 SIMD ChaCha code into the new ChaCha library interface, so that users of the library interface will get the accelerated version when available. Given that calls into the library API will always go through the routines in this module if it is enabled, switch to static keys to select the optimal implementation available (which may be none at all, in which case we defer to the generic implementation for all invocations). Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 28e8d89b1ce8d2e7badfb5f69971dd635acb8863 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:09 2019 +0100 crypto: x86/chacha - depend on generic chacha library instead of crypto driver In preparation of extending the x86 ChaCha driver to also expose the ChaCha library interface, drop the dependency on the chacha_generic crypto driver as a non-SIMD fallback, and depend on the generic ChaCha library directly. This way, we only pull in the code we actually need, without registering a set of ChaCha skciphers that we will never use. Since turning the FPU on and off is cheap these days, simplify the SIMD routine by dropping the per-page yield, which makes for a cleaner switch to the library API as well. This also allows use to invoke the skcipher walk routines in non-atomic mode. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 5fb8ef25803ef33e2eb60b626435828b937bed75 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:08 2019 +0100 crypto: chacha - move existing library code into lib/crypto Currently, our generic ChaCha implementation consists of a permute function in lib/chacha.c that operates on the 64-byte ChaCha state directly [and which is always included into the core kernel since it is used by the /dev/random driver], and the crypto API plumbing to expose it as a skcipher. In order to support in-kernel users that need the ChaCha streamcipher but have no need [or tolerance] for going through the abstractions of the crypto API, let's expose the streamcipher bits via a library API as well, in a way that permits the implementation to be superseded by an architecture specific one if provided. So move the streamcipher code into a separate module in lib/crypto, and expose the init() and crypt() routines to users of the library. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 746b2e024c67aa605ac12d135cd7085a49cf9dc4 Author: Ard Biesheuvel Date: Fri Nov 8 13:22:07 2019 +0100 crypto: lib - tidy up lib/crypto Kconfig and Makefile In preparation of introducing a set of crypto library interfaces, tidy up the Makefile and split off the Kconfig symbols into a separate file. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 20cc01baa33463e9e8b202b0cbaeafbac0f9202c Author: Herbert Xu Date: Fri Nov 8 18:41:58 2019 +0800 crypto: aead - Split out geniv into its own module If aead is built as a module along with cryptomgr, it creates a dependency loop due to the dependency chain aead => crypto_null => cryptomgr => aead. This is due to the presence of the AEAD geniv code. This code is not really part of the AEAD API but simply support code for IV generators such as seqiv. This patch moves the geniv code into its own module thus breaking the dependency loop. Signed-off-by: Herbert Xu commit 8ab23d547f652979bafd710d9e34983aaceea517 Author: Herbert Xu Date: Fri Nov 8 18:26:30 2019 +0800 crypto: api - Add softdep on cryptomgr The crypto API requires cryptomgr to be present for probing to work so we need a softdep to ensure that cryptomgr is added to the initramfs. This was usually not a problem because until very recently it was not practical to build crypto API as module but with the recent work to eliminate direct AES users this is now possible. Signed-off-by: Herbert Xu commit 3bbcdb152b28a3d4e616251b1a97aa654ca38da8 Author: Corentin Labbe Date: Fri Nov 8 10:13:06 2019 +0000 MAINTAINERS: add linux-amlogic list for amlogic crypto The linux-amlogic mailing list need to be in copy of all patch for the amlogic crypto. Signed-off-by: Corentin Labbe Acked-by: Neil Armstrong Signed-off-by: Herbert Xu commit 56601574c12ff91bf6b0b5e913178b43541a0ca7 Author: Corentin Labbe Date: Fri Nov 8 09:45:17 2019 +0000 crypto: amlogic - fix two resources leak This patch fixes two resources leak that occur on error path. Reported-by: coverity-bot Addresses-Coverity-ID: 1487403 ("RESOURCE_LEAK") Addresses-Coverity-ID: 1487401 ("Resource leaks") Fixes: 48fe583fe541 ("crypto: amlogic - Add crypto accelerator for amlogic GXL") Signed-off-by: Corentin Labbe Reviewed-by: Kees Cook Signed-off-by: Herbert Xu commit b8151220f35da4653d95c840e03b8a9db2c0d1c0 Author: Pascal van Leeuwen Date: Fri Nov 8 10:00:21 2019 +0100 crypto: inside-secure - Fixed authenc w/ (3)DES fails on Macchiatobin Fixed 2 copy-paste mistakes in the commit mentioned below that caused authenc w/ (3)DES to consistently fail on Macchiatobin (but strangely work fine on x86+FPGA??). Now fully tested on both platforms. Fixes: 13a1bb93f7b1c9 ("crypto: inside-secure - Fixed warnings...") Signed-off-by: Pascal van Leeuwen Signed-off-by: Herbert Xu commit 4a97bfc79619c40d400f2a7b763a0d9cd1d33891 Author: Greg Kroah-Hartman Date: Thu Nov 7 09:52:00 2019 +0100 crypto: hisilicon - no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Zhou Wang Cc: Herbert Xu Cc: "David S. Miller" Cc: linux-crypto@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Herbert Xu commit 39977f4b51cdc544de4e5950751655f6693654a7 Author: Hao Fang Date: Thu Nov 7 11:48:29 2019 +0800 crypto: hisilicon - add vfs_num module param for zip Currently the VF can be enabled only through sysfs interface after module loaded, but this also needs to be done when the module loaded in some scenarios. This patch adds module param vfs_num, adds hisi_zip_sriov_enable() in probe, and also adjusts the position of probe. Signed-off-by: Hao Fang Signed-off-by: Zhou Wang Signed-off-by: Herbert Xu commit c3510fec6e824cd7ab75f77c80412b746928aa2b Author: Pascal van Leeuwen Date: Wed Nov 6 16:13:07 2019 +0100 crypto: inside-secure - Fix hangup during probing for EIP97 engine Fixed mask used for CFSIZE and RFSIZE fields of HIA_OPTIONS register, these were all 1 bit too wide. Which caused the probing of a standard EIP97 to actually hang due to assume way too large descriptor FIFO's. Signed-off-by: Pascal van Leeuwen Signed-off-by: Herbert Xu commit 6d01d8511dceb9cd40f72eb102b7d24f0b2e997b Author: Alexander Sverdlin Date: Wed Nov 6 09:30:49 2019 +0000 hwrng: ks-sa - Add minimum sleep time before ready-polling Current polling timeout is 25 us. The hardware is currently configured to harvest the entropy for 81920 us. This leads to timeouts even during blocking read (wait=1). Log snippet: [ 5.727589] [] (ks_sa_rng_probe) from [] (platform_drv_probe+0x58/0xb4) ... [ 5.727805] hwrng: no data available ... [ 13.157016] random: systemd: uninitialized urandom read (16 bytes read) [ 13.157033] systemd[1]: Initializing machine ID from random generator. ... [ 15.848770] random: fast init done ... [ 15.848807] random: crng init done After the patch: [ 6.223534] random: systemd: uninitialized urandom read (16 bytes read) [ 6.223551] systemd[1]: Initializing machine ID from random generator. ... [ 6.876075] random: fast init done ... [ 6.954200] random: systemd: uninitialized urandom read (16 bytes read) [ 6.955244] random: systemd: uninitialized urandom read (16 bytes read) ... [ 7.121948] random: crng init done Signed-off-by: Alexander Sverdlin Signed-off-by: Herbert Xu commit db6efda85437d783dd921da5d67ec818826adb12 Merge: 002d3c65ee81 03212e347f94 Author: Olof Johansson Date: Sat Nov 16 15:38:57 2019 -0800 Merge tag 'tee-fixes-for-v5.4' of git://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes Two OP-TE driver fixes: - Add proper cleanup on optee_enumerate_devices() failure - Make sure to register kernel allocations of dynamic shared memory * tag 'tee-fixes-for-v5.4' of git://git.linaro.org/people/jens.wiklander/linux-tee: (591 commits) tee: optee: fix device enumeration error handling tee: optee: Fix dynamic shm pool allocations Linux 5.4-rc3 tracing: Initialize iter->seq after zeroing in tracing_read_pipe() tracing/hwlat: Don't ignore outer-loop duration when calculating max_latency tracing/hwlat: Report total time spent in all NMIs during the sample recordmcount: Fix nop_mcount() function tracing: Do not create tracefs files if tracefs lockdown is in effect tracing: Add locked_down checks to the open calls of files created for tracefs tracing: Add tracing_check_open_get_tr() tracing: Have trace events system open call tracing_open_generic_tr() tracing: Get trace_array reference for available_tracers files ftrace: Get a reference counter for the trace_array on filter files tracefs: Revert ccbd54ff54e8 ("tracefs: Restrict tracefs when the kernel is locked down") perf/x86/cstate: Add Tiger Lake CPU support perf/x86/msr: Add Tiger Lake CPU support perf/x86/intel: Add Tiger Lake CPU support perf/x86/cstate: Update C-state counters for Ice Lake perf/x86/msr: Add new CPU model numbers for Ice Lake perf/x86/cstate: Add Comet Lake CPU support ... Link: https://lore.kernel.org/r/20191115105353.GA26176@jax Signed-off-by: Olof Johansson commit a235f803dbc878d1db83cbaabf6963ca9ef3a1a2 Merge: 8400f492a068 b50a85c023f4 Author: Olof Johansson Date: Sat Nov 16 15:37:40 2019 -0800 Merge tag 'aspeed-5.5-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/aspeed into arm/defconfig ASPEED device tree updates for 5.5 This adds recently merged drivers to the aspeed g4 and g5 defconfigs, and to the multi v5 and v7 shared defconfigs. * tag 'aspeed-5.5-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/aspeed: ARM: config: multi_v5: ASPEED SDHCI, SGPIO ARM: configs: multi_v7: ASPEED network, gpio, FSI ARM: config: aspeed-g4: Add MMC, and cleanup ARM: config: aspeed-g5: Add SGPIO and FSI drivers ARM: config: aspeed-g5: Enable 8250_DW quirks Link: https://lore.kernel.org/r/CACPK8Xc3a=6irkTSfwyPrr=nWv_fa9nMxthtC2AyqFJEWvuMwg@mail.gmail.com Signed-off-by: Olof Johansson commit 3f6939aec712a15152c32516c1c543a91ac1e717 Merge: 84a1b6e1d938 7bd39bc6bfdf Author: Olof Johansson Date: Sat Nov 16 15:33:24 2019 -0800 Merge tag 'scmi-fix-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/drivers ARM SCMI fix for v5.5 Just a single fix to correct the SCMI fast channel doorbell ring logic when CONFIG_64BIT is not set. * tag 'scmi-fix-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix doorbell ring logic for !CONFIG_64BIT Link: https://lore.kernel.org/r/20191114164555.GA19398@bogus Signed-off-by: Olof Johansson commit 1e8795b1b20d2721620165434cdcf427ecd2ba85 Author: kbuild test robot Date: Sat Nov 16 06:38:34 2019 +0800 mscc.c: fix semicolon.cocci warnings drivers/net/phy/mscc.c:1683:3-4: Unneeded semicolon Remove unneeded semicolon. Generated by: scripts/coccinelle/misc/semicolon.cocci Fixes: 75a1ccfe6c72 ("mscc.c: Add support for additional VSC PHYs") CC: Bryan Whitehead Signed-off-by: kbuild test robot Signed-off-by: David S. Miller commit 597b01edafac57aafdbf1ca51e26ceb41c371912 Author: Eric Dumazet Date: Fri Nov 15 17:55:54 2019 -0800 selftests: net: avoid ptl lock contention in tcp_mmap tcp_mmap is used as a reference program for TCP rx zerocopy, so it is important to point out some potential issues. If multiple threads are concurrently using getsockopt(... TCP_ZEROCOPY_RECEIVE), there is a chance the low-level mm functions compete on shared ptl lock, if vma are arbitrary placed. Instead of letting the mm layer place the chunks back to back, this patch enforces an alignment so that each thread uses a different ptl lock. Performance measured on a 100 Gbit NIC, with 8 tcp_mmap clients launched at the same time : $ for f in {1..8}; do ./tcp_mmap -H 2002:a05:6608:290:: & done In the following run, we reproduce the old behavior by requesting no alignment : $ tcp_mmap -sz -C $((128*1024)) -a 4096 received 32768 MB (100 % mmap'ed) in 9.69532 s, 28.3516 Gbit cpu usage user:0.08634 sys:3.86258, 120.511 usec per MB, 171839 c-switches received 32768 MB (100 % mmap'ed) in 25.4719 s, 10.7914 Gbit cpu usage user:0.055268 sys:21.5633, 659.745 usec per MB, 9065 c-switches received 32768 MB (100 % mmap'ed) in 28.5419 s, 9.63069 Gbit cpu usage user:0.057401 sys:23.8761, 730.392 usec per MB, 14987 c-switches received 32768 MB (100 % mmap'ed) in 28.655 s, 9.59268 Gbit cpu usage user:0.059689 sys:23.8087, 728.406 usec per MB, 18509 c-switches received 32768 MB (100 % mmap'ed) in 28.7808 s, 9.55074 Gbit cpu usage user:0.066042 sys:23.4632, 718.056 usec per MB, 24702 c-switches received 32768 MB (100 % mmap'ed) in 28.8259 s, 9.5358 Gbit cpu usage user:0.056547 sys:23.6628, 723.858 usec per MB, 23518 c-switches received 32768 MB (100 % mmap'ed) in 28.8808 s, 9.51767 Gbit cpu usage user:0.059357 sys:23.8515, 729.703 usec per MB, 14691 c-switches received 32768 MB (100 % mmap'ed) in 28.8879 s, 9.51534 Gbit cpu usage user:0.047115 sys:23.7349, 725.769 usec per MB, 21773 c-switches New behavior (automatic alignment based on Hugepagesize), we can see the system overhead being dramatically reduced. $ tcp_mmap -sz -C $((128*1024)) received 32768 MB (100 % mmap'ed) in 13.5339 s, 20.3103 Gbit cpu usage user:0.122644 sys:3.4125, 107.884 usec per MB, 168567 c-switches received 32768 MB (100 % mmap'ed) in 16.0335 s, 17.1439 Gbit cpu usage user:0.132428 sys:3.55752, 112.608 usec per MB, 188557 c-switches received 32768 MB (100 % mmap'ed) in 17.5506 s, 15.6621 Gbit cpu usage user:0.155405 sys:3.24889, 103.891 usec per MB, 226652 c-switches received 32768 MB (100 % mmap'ed) in 19.1924 s, 14.3222 Gbit cpu usage user:0.135352 sys:3.35583, 106.542 usec per MB, 207404 c-switches received 32768 MB (100 % mmap'ed) in 22.3649 s, 12.2906 Gbit cpu usage user:0.142429 sys:3.53187, 112.131 usec per MB, 250225 c-switches received 32768 MB (100 % mmap'ed) in 22.5336 s, 12.1986 Gbit cpu usage user:0.140654 sys:3.61971, 114.757 usec per MB, 253754 c-switches received 32768 MB (100 % mmap'ed) in 22.5483 s, 12.1906 Gbit cpu usage user:0.134035 sys:3.55952, 112.718 usec per MB, 252997 c-switches received 32768 MB (100 % mmap'ed) in 22.6442 s, 12.139 Gbit cpu usage user:0.126173 sys:3.71251, 117.147 usec per MB, 253728 c-switches Signed-off-by: Eric Dumazet Cc: Soheil Hassas Yeganeh Cc: Arjun Roy Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller commit 229c1e0dfd3dfac23b33b7cd88bcb7a9e391b000 Author: Heiner Kallweit Date: Fri Nov 15 22:38:25 2019 +0100 r8169: load firmware for RTL8168fp/RTL8117 Load Realtek-provided firmware for RTL8168fp/RTL8117. Unlike the firmware for other chip versions which is for the PHY, firmware for RTL8168fp/RTL8117 is for the MAC. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 718af5bc9709dbab643788719af32d4dfd9d9d35 Author: Heiner Kallweit Date: Fri Nov 15 21:35:22 2019 +0100 r8169: improve conditional firmware loading for RTL8168d Using constant MII_EXPANSION is misleading here because register 0x06 has a different meaning on page 0x0005. Here a proprietary PHY parameter is read by writing the parameter id to register 0x05 on page 0x0005, followed by reading the parameter value from register 0x06. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 725ea4bff9ad6d594e2a633fcdc673dfcaf55d43 Author: Russell King Date: Fri Nov 15 20:05:45 2019 +0000 net: phylink: update to use phy_support_asym_pause() Use phy_support_asym_pause() rather than open-coding it. Signed-off-by: Russell King Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 50bef71900d25433418529476e7ea8f5826f6c2d Merge: df98be06c94d 4f5969c36a45 Author: David S. Miller Date: Sat Nov 16 13:06:07 2019 -0800 Merge tag 'wireless-drivers-next-2019-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for v5.5 Second set of patches for v5.5. Nothing special this time, smaller features to various drivers and of course fixes all over. Major changes: iwlwifi * update scan FW API * bump the supported FW API version * add debug dump collection on assert in WoWLAN * enable adaptive dwell on P2P interfaces ath10k * request for PM_QOS_CPU_DMA_LATENCY to improve firmware initialisation time qtnfmac * add support for getting/setting transmit power * handle MIC failure event from firmware rtl8xxxu * add support for Edimax EW-7611ULB wil6210 * add SPDX license identifiers ==================== Signed-off-by: David S. Miller commit df98be06c94d23e2a8e12065bf2df5b186b81f0f Author: Matteo Croce Date: Fri Nov 15 12:10:37 2019 +0100 bonding: symmetric ICMP transmit A bonding with layer2+3 or layer3+4 hashing uses the IP addresses and the ports to balance packets between slaves. With some network errors, we receive an ICMP error packet by the remote host or a router. If sent by a router, the source IP can differ from the remote host one. Additionally the ICMP protocol has no port numbers, so a layer3+4 bonding will get a different hash than the previous one. These two conditions could let the packet go through a different interface than the other packets of the same flow: # tcpdump -qltnni veth0 |sed 's/^/0: /' & # tcpdump -qltnni veth1 |sed 's/^/1: /' & # hping3 -2 192.168.0.2 -p 9 0: IP 192.168.0.1.2251 > 192.168.0.2.9: UDP, length 0 1: IP 192.168.0.2 > 192.168.0.1: ICMP 192.168.0.2 udp port 9 unreachable, length 36 1: IP 192.168.0.1.2252 > 192.168.0.2.9: UDP, length 0 1: IP 192.168.0.2 > 192.168.0.1: ICMP 192.168.0.2 udp port 9 unreachable, length 36 1: IP 192.168.0.1.2253 > 192.168.0.2.9: UDP, length 0 1: IP 192.168.0.2 > 192.168.0.1: ICMP 192.168.0.2 udp port 9 unreachable, length 36 0: IP 192.168.0.1.2254 > 192.168.0.2.9: UDP, length 0 1: IP 192.168.0.2 > 192.168.0.1: ICMP 192.168.0.2 udp port 9 unreachable, length 36 An ICMP error packet contains the header of the packet which caused the network error, so inspect it and match the flow against it, so we can send the ICMP via the same interface of the previous packet in the flow. Move the IP and port dissect code into a generic function bond_flow_ip() and if we are dissecting an ICMP error packet, call it again with the adjusted offset. # hping3 -2 192.168.0.2 -p 9 1: IP 192.168.0.1.1224 > 192.168.0.2.9: UDP, length 0 1: IP 192.168.0.2 > 192.168.0.1: ICMP 192.168.0.2 udp port 9 unreachable, length 36 1: IP 192.168.0.1.1225 > 192.168.0.2.9: UDP, length 0 1: IP 192.168.0.2 > 192.168.0.1: ICMP 192.168.0.2 udp port 9 unreachable, length 36 0: IP 192.168.0.1.1226 > 192.168.0.2.9: UDP, length 0 0: IP 192.168.0.2 > 192.168.0.1: ICMP 192.168.0.2 udp port 9 unreachable, length 36 0: IP 192.168.0.1.1227 > 192.168.0.2.9: UDP, length 0 0: IP 192.168.0.2 > 192.168.0.1: ICMP 192.168.0.2 udp port 9 unreachable, length 36 Signed-off-by: Matteo Croce Signed-off-by: David S. Miller commit 4214fa1efffd4c6236231f1104eddc156b4e9104 Author: Horatiu Vultur Date: Fri Nov 15 11:11:15 2019 +0100 net: mscc: ocelot: omit error check from of_get_phy_mode The commit 0c65b2b90d13c ("net: of_get_phy_mode: Change API to solve int/unit warnings") updated the function of_get_phy_mode declaration. Now it returns an error code and in case the node doesn't contain the property 'phy-mode' or 'phy-connection-type' it returns -EINVAL and would set the phy_interface_t to PHY_INTERFACE_MODE_NA. Ocelot VSC7514 has 4 internal phys which have the phy interface PHY_INTERFACE_MODE_NA. So because of_get_phy_mode would assign PHY_INTERFACE_MODE_NA to phy_mode when there is an error, there is no need to add the error check. Updates for v2: - drop error check because of_get_phy_mode already assigns phy_interface to PHY_INTERFACE_MODE in case of error. Signed-off-by: Horatiu Vultur Signed-off-by: David S. Miller commit 8aef998df3979faa19626acf889abecb733342db Author: Alexander Lobakin Date: Fri Nov 15 12:11:35 2019 +0300 net: core: allow fast GRO for skbs with Ethernet header in head Commit 78d3fd0b7de8 ("gro: Only use skb_gro_header for completely non-linear packets") back in May'09 (v2.6.31-rc1) has changed the original condition '!skb_headlen(skb)' to 'skb->mac_header == skb->tail' in gro_reset_offset() saying: "Since the drivers that need this optimisation all provide completely non-linear packets" (note that this condition has become the current 'skb_mac_header(skb) == skb_tail_pointer(skb)' later with commmit ced14f6804a9 ("net: Correct comparisons and calculations using skb->tail and skb-transport_header") without any functional changes). For now, we have the following rough statistics for v5.4-rc7: 1) napi_gro_frags: 14 2) napi_gro_receive with skb->head containing (most of) payload: 83 3) napi_gro_receive with skb->head containing all the headers: 20 4) napi_gro_receive with skb->head containing only Ethernet header: 2 With the current condition, fast GRO with the usage of NAPI_GRO_CB(skb)->frag0 is available only in the [1] case. Packets pushed by [2] and [3] go through the 'slow' path, but it's not a problem for them as they already contain all the needed headers in skb->head, so pskb_may_pull() only moves skb->data. The layout of skbs in the fourth [4] case at the moment of dev_gro_receive() is identical to skbs that have come through [1], as napi_frags_skb() pulls Ethernet header to skb->head. The only difference is that the mentioned condition is always false for them, because skb_put() and friends irreversibly alter the tail pointer. They also go through the 'slow' path, but now every single pskb_may_pull() in every single .gro_receive() will call the *really* slow __pskb_pull_tail() to pull headers to head. This significantly decreases the overall performance for no visible reasons. The only two users of method [4] is: * drivers/staging/qlge * drivers/net/wireless/iwlwifi (all three variants: dvm, mvm, mvm-mq) Note that in case with wireless drivers we can't use [1] (napi_gro_frags()) at least for now and mac80211 stack always performs pushes and pulls anyways, so performance hit is inavoidable. At the moment of v2.6.31 the mentioned change was necessary (that's why I don't add the "Fixes:" tag), but it became obsolete since skb_gro_mac_header() has gone in commit a50e233c50db ("net-gro: restore frag0 optimization"), so we can simply revert the condition in gro_reset_offset() to allow skbs from [4] go through the 'fast' path just like in case [1]. This was tested on a 600 MHz MIPS CPU and a custom driver and this patch gave boosts up to 40 Mbps to method [4] in both directions comparing to net-next, which made overall performance relatively close to [1] (without it, [4] is the slowest). v2: - Add more references and explanations to commit message - Fix some typos ibid - No functional changes Signed-off-by: Alexander Lobakin Signed-off-by: David S. Miller commit f92e88dbd46147fa34a3151acce0959d8b221e06 Merge: 2e47cb415f0a 548e5ffe2e11 Author: David S. Miller Date: Sat Nov 16 12:50:57 2019 -0800 Merge branch 'bnx2x-Remove-function-casts' Kees Cook says: ==================== bnx2x: Remove function casts In order to make the entire kernel usable under Clang's Control Flow Integrity protections, function prototype casts need to be avoided because this will trip CFI checks at runtime (i.e. a mismatch between the caller's expected function prototype and the destination function's prototype). Many of these cases can be found with -Wcast-function-type, which found that bnx2x had a bunch of needless (or at least confusing) function casts. This series removes them all. ==================== Signed-off-by: David S. Miller commit 548e5ffe2e11d10c54f8425019900c87788fd838 Author: Kees Cook Date: Thu Nov 14 21:07:15 2019 -0800 bnx2x: Remove hw_reset_t function casts All .rw_reset callbacks except bnx2x_84833_hw_reset_phy() use a void return type. No callers of .hw_reset check a return value and bnx2x_84833_hw_reset_phy() unconditionally returns 0. Remove all hw_reset_t casts and fix the return type to void. Signed-off-by: Kees Cook Signed-off-by: David S. Miller commit 26658f6bdb65ff192ff9b4b7ed9f3408d74ceeea Author: Kees Cook Date: Thu Nov 14 21:07:14 2019 -0800 bnx2x: Remove format_fw_ver_t function casts The return values for format_fw_ver_t callbacks are supposed to be "int", not "u8". Ultimately, the top-level caller doesn't actually check the return value at all, but just clean this all up anyway and fix the prototypes so that casts are no longer needed. Signed-off-by: Kees Cook Signed-off-by: David S. Miller commit 3e19d1f2654ffd0e379c0f4ba30424bb57ed8acc Author: Kees Cook Date: Thu Nov 14 21:07:13 2019 -0800 bnx2x: Remove config_init_t function casts No callers of .config_init check return values. Remove the casting and change all callbacks to have the correct function prototype. Signed-off-by: Kees Cook Signed-off-by: David S. Miller commit 2c855d73f2f6107f5b8ebc45f8b934bf7f4419e0 Author: Kees Cook Date: Thu Nov 14 21:07:12 2019 -0800 bnx2x: Remove read_status_t function casts The function casts for .read_status callbacks end up casting some int return values to u8. This seems to be bug-prone (-EINVAL being returned into something that appears to be true/false), but fixing the function prototypes doesn't change the existing behavior. Fix the return values to remove the casts. Signed-off-by: Kees Cook Signed-off-by: David S. Miller commit 86c1fe8857afb379522fd8dabce9d348672c31c1 Author: Kees Cook Date: Thu Nov 14 21:07:11 2019 -0800 bnx2x: Drop redundant callback function casts NULL is already "void *" so it will auto-cast in assignments and initializers. Additionally, all the callbacks for .link_reset, .config_loopback, .set_link_led, and .phy_specific_func are already correct. No casting is needed for these, so remove them. Signed-off-by: Kees Cook Signed-off-by: David S. Miller commit 2e47cb415f0a0ec6555d71598361e90f8c144fb2 Author: Po Liu Date: Fri Nov 15 03:33:41 2019 +0000 enetc: update TSN Qbv PSPEED set according to adjust link speed ENETC has a register PSPEED to indicate the link speed of hardware. It is need to update accordingly. PSPEED field needs to be updated with the port speed for QBV scheduling purposes. Or else there is chance for gate slot not free by frame taking the MAC if PSPEED and phy speed not match. So update PSPEED when link adjust. This is implement by the adjust_link. Signed-off-by: Po Liu Signed-off-by: Claudiu Manoil Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 34c6adf1977b611fca3b824ad12a2a415e1e420e Author: Po Liu Date: Fri Nov 15 03:33:33 2019 +0000 enetc: Configure the Time-Aware Scheduler via tc-taprio offload ENETC supports in hardware for time-based egress shaping according to IEEE 802.1Qbv. This patch implement the Qbv enablement by the hardware offload method qdisc tc-taprio method. Also update cbdr writeback to up level since control bd ring may writeback data to control bd ring. Signed-off-by: Po Liu Signed-off-by: Vladimir Oltean Signed-off-by: Claudiu Manoil Signed-off-by: David S. Miller commit c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 Author: Jonathan Lemon Date: Thu Nov 14 14:13:00 2019 -0800 page_pool: do not release pool until inflight == 0. The page pool keeps track of the number of pages in flight, and it isn't safe to remove the pool until all pages are returned. Disallow removing the pool until all pages are back, so the pool is always available for page producers. Make the page pool responsible for its own delayed destruction instead of relying on XDP, so the page pool can be used without the xdp memory model. When all pages are returned, free the pool and notify xdp if the pool is registered with the xdp memory system. Have the callback perform a table walk since some drivers (cpsw) may share the pool among multiple xdp_rxq_info. Note that the increment of pages_state_release_cnt may result in inflight == 0, resulting in the pool being released. Fixes: d956a048cd3f ("xdp: force mem allocator removal and periodic warning") Signed-off-by: Jonathan Lemon Acked-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 3af7ff93e43bcab458bd223180b73970b446a8b8 Merge: c39e342a050a ab8536ca783d Author: David S. Miller Date: Sat Nov 16 12:26:49 2019 -0800 Merge branch 'smc-last-part-of-termination-improvements' Karsten Graul says: ==================== last part of termination improvements Patches 1 and 2 finish the set of termination patches, introducing a reboot handler that terminates all link groups. Patch 3 adds an rcu_barrier before the module is unloaded, and patch 4 is cleanup. ==================== Signed-off-by: David S. Miller commit ab8536ca783db9ef863e0a2246946ebae701df5a Author: Ursula Braun Date: Sat Nov 16 17:47:32 2019 +0100 net/smc: remove unused constant Constant SMC_CLOSE_WAIT_LISTEN_CLCSOCK_TIME is defined, but since commit 3d502067599f ("net/smc: simplify wait when closing listen socket") no longer used. Remove it. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 4ead9c96d528e1b9937382321910a2bf35fc1a86 Author: Ursula Braun Date: Sat Nov 16 17:47:31 2019 +0100 net/smc: use rcu_barrier() on module unload Add rcu_barrier() to make sure no RCU readers or callbacks are pending when the module is unloaded. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit a33a803cfe64309d330540ae4a8df17158bcb6ea Author: Ursula Braun Date: Sat Nov 16 17:47:30 2019 +0100 net/smc: guarantee removal of link groups in reboot When rebooting it should be guaranteed all link groups are cleaned up and freed. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 6dabd405451f35c905dfadb6a06f5c981074fc14 Author: Ursula Braun Date: Sat Nov 16 17:47:29 2019 +0100 net/smc: introduce bookkeeping of SMCR link groups If the smc module is unloaded return control from exit routine only, if all link groups are freed. If an IB device is thrown away return control from device removal only, if all link groups belonging to this device are freed. Counters for the total number of SMCR link groups and for the total number of SMCR links per IB device are introduced. smc module unloading continues only if the total number of SMCR link groups is zero. IB device removal continues only it the total number of SMCR links per IB device has decreased to zero. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit cd5a2aa89e847bdda7b62029d94e95488d73f6b2 Author: Waiman Long Date: Fri Nov 15 11:14:45 2019 -0500 x86/speculation: Fix redundant MDS mitigation message Since MDS and TAA mitigations are inter-related for processors that are affected by both vulnerabilities, the followiing confusing messages can be printed in the kernel log: MDS: Vulnerable MDS: Mitigation: Clear CPU buffers To avoid the first incorrect message, defer the printing of MDS mitigation after the TAA mitigation selection has been done. However, that has the side effect of printing TAA mitigation first before MDS mitigation. [ bp: Check box is affected/mitigations are disabled first before printing and massage. ] Suggested-by: Pawan Gupta Signed-off-by: Waiman Long Signed-off-by: Borislav Petkov Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Josh Poimboeuf Cc: Mark Gross Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Tim Chen Cc: Tony Luck Cc: Tyler Hicks Cc: x86-ml Link: https://lkml.kernel.org/r/20191115161445.30809-3-longman@redhat.com commit a079973f462a3d506c6a7f00c770a55b167ed094 Author: Hans de Goede Date: Thu Nov 14 12:18:40 2019 +0100 usb: typec: tcpm: Remove tcpc_config configuration mechanism All configuration can and should be done through fwnodes instead of through the tcpc_config struct and there are no existing users left of struct tcpc_config, so lets remove it. Signed-off-by: Hans de Goede Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20191114111840.40876-1-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman commit 6cfed598480493d814414ce7e53027bd6fc45c49 Author: Kees Cook Date: Fri Nov 15 09:28:28 2019 -0800 staging: rtl*: Remove tasklet callback casts In order to make the entire kernel usable under Clang's Control Flow Integrity protections, function prototype casts need to be avoided because this will trip CFI checks at runtime (i.e. a mismatch between the caller's expected function prototype and the destination function's prototype). Many of these cases can be found with -Wcast-function-type, which found that the rtl wifi drivers had a bunch of needless function casts. Remove function casts for tasklet callbacks in the various drivers. Signed-off-by: Kees Cook Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/201911150926.2894A4F973@keescook Signed-off-by: Greg Kroah-Hartman commit 64870ed1b12e235cfca3f6c6da75b542c973ff78 Author: Waiman Long Date: Fri Nov 15 11:14:44 2019 -0500 x86/speculation: Fix incorrect MDS/TAA mitigation status For MDS vulnerable processors with TSX support, enabling either MDS or TAA mitigations will enable the use of VERW to flush internal processor buffers at the right code path. IOW, they are either both mitigated or both not. However, if the command line options are inconsistent, the vulnerabilites sysfs files may not report the mitigation status correctly. For example, with only the "mds=off" option: vulnerabilities/mds:Vulnerable; SMT vulnerable vulnerabilities/tsx_async_abort:Mitigation: Clear CPU buffers; SMT vulnerable The mds vulnerabilities file has wrong status in this case. Similarly, the taa vulnerability file will be wrong with mds mitigation on, but taa off. Change taa_select_mitigation() to sync up the two mitigation status and have them turned off if both "mds=off" and "tsx_async_abort=off" are present. Update documentation to emphasize the fact that both "mds=off" and "tsx_async_abort=off" have to be specified together for processors that are affected by both TAA and MDS to be effective. [ bp: Massage and add kernel-parameters.txt change too. ] Fixes: 1b42f017415b ("x86/speculation/taa: Add mitigation for TSX Async Abort") Signed-off-by: Waiman Long Signed-off-by: Borislav Petkov Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jiri Kosina Cc: Jonathan Corbet Cc: Josh Poimboeuf Cc: linux-doc@vger.kernel.org Cc: Mark Gross Cc: Cc: Pawan Gupta Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Tim Chen Cc: Tony Luck Cc: Tyler Hicks Cc: x86-ml Link: https://lkml.kernel.org/r/20191115161445.30809-2-longman@redhat.com commit 64498695dd800bcb494d96b94f99356ece91ea90 Author: Alexander Usyskin Date: Sat Nov 16 16:21:36 2019 +0200 mei: bus: add more client attributes to sysfs Export more client attributes via sysfs that are usually obtained upon connection. In some cases, for example a monitoring application may wish to know the attributes without actually performing the connection. Added attributes: max number of connections, fixed address, max message length. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20191116142136.17535-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit 45c08383141794a7e9b26f35d491b74f33ac469e Author: Thomas Gleixner Date: Wed Oct 23 14:27:07 2019 +0200 x86/entry/64: Remove pointless jump in paranoid_exit Jump directly to restore_regs_and_return_to_kernel instead of making a pointless extra jump through .Lparanoid_exit_restore Signed-off-by: Thomas Gleixner Reviewed-by: Sean Christopherson Reviewed-by: Alexandre Chartre Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191023123117.779277679@linutronix.de commit df1a7524741b6c094786032e12a21a448321d9f6 Author: Thomas Gleixner Date: Wed Oct 23 14:27:06 2019 +0200 x86/entry/32: Remove unused resume_userspace label The C reimplementation of SYSENTER left that unused ENTRY() label around. Remove it. Fixes: 5f310f739b4c ("x86/entry/32: Re-implement SYSENTER using the new C path") Originally-by: Peter Zijlstra Signed-off-by: Thomas Gleixner Reviewed-by: Sean Christopherson Reviewed-by: Alexandre Chartre Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20191023123117.686514045@linutronix.de commit 022eb8ae8b5ee8c5c813923c69b5ebb1e9612c4c Author: Benjamin Gaignard Date: Tue Nov 12 16:16:46 2019 +0100 ARM: 8938/1: kernel: initialize broadcast hrtimer based clock event device On platforms implementing CPU power management, the CPUidle subsystem can allow CPUs to enter idle states where local timers logic is lost on power down. To keep the software timers functional the kernel relies on an always-on broadcast timer to be present in the platform to relay the interrupt signalling the timer expiries. For platforms implementing CPU core gating that do not implement an always-on HW timer or implement it in a broken way, this patch adds code to initialize the kernel hrtimer based clock event device upon boot (which can be chosen as tick broadcast device by the kernel). It relies on a dynamically chosen CPU to be always powered-up. This CPU then relays the timer interrupt to CPUs in deep-idle states through its HW local timer device. Having a CPU always-on has implications on power management platform capabilities and makes CPUidle suboptimal, since at least a CPU is kept always in a shallow idle state by the kernel to relay timer interrupts, but at least leaves the kernel with a functional system with some working power management capabilities. The hrtimer based clock event device is unconditionally registered, but has the lowest possible rating such that any broadcast-capable HW clock event device present will be chosen in preference as the tick broadcast device. Signed-off-by: Benjamin Gaignard Signed-off-by: Russell King commit 4ae5061a19b550dfe25397843427ed2ebab16b16 Author: Doug Berger Date: Mon Nov 11 04:32:04 2019 +0100 ARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening When the default processor handling was added to the function cpu_v7_spectre_init() it only excluded other ARM implemented processor cores. The Broadcom Brahma B53 core is not implemented by ARM so it ended up falling through into the set of processors that attempt to use the ARM_SMCCC_ARCH_WORKAROUND_1 service to harden the branch predictor. Since this workaround is not necessary for the Brahma-B53 this commit explicitly checks for it and prevents it from applying a branch predictor hardening workaround. Fixes: 10115105cb3a ("ARM: spectre-v2: add firmware based hardening") Signed-off-by: Doug Berger Signed-off-by: Florian Fainelli Signed-off-by: Russell King commit a3ba966066afbe8fd0d3605ffe04c633083752f1 Author: Thomas Gleixner Date: Sat Nov 16 11:12:03 2019 +0100 x86/entry/32: Clarify register saving in __switch_to_asm() commit 6690e86be83a ("sched/x86: Save [ER]FLAGS on context switch") re-introduced the flags saving on context switch to prevent AC leakage. The pushf/popf instructions are right among the callee saved register section, so the comment explaining the save/restore is not entirely correct. Add a seperate comment to pushf/popf explaining the reason. Reported-by: Linus Torvalds Signed-off-by: Thomas Gleixner commit e638ad00809a323cbe13dfa0952d4234d9b36732 Author: Thomas Gleixner Date: Mon Nov 11 23:03:30 2019 +0100 selftests/x86/iopl: Extend test to cover IOPL emulation Add tests that the now emulated iopl() functionality: - does not longer allow user space to disable interrupts. - does restore a I/O bitmap when IOPL is dropped Signed-off-by: Thomas Gleixner commit 111e7b15cf10f6e973ccf537c70c66a5de539060 Author: Thomas Gleixner Date: Tue Nov 12 21:40:33 2019 +0100 x86/ioperm: Extend IOPL config to control ioperm() as well If iopl() is disabled, then providing ioperm() does not make much sense. Rename the config option and disable/enable both syscalls with it. Guard the code with #ifdefs where appropriate. Suggested-by: Andy Lutomirski Signed-off-by: Thomas Gleixner commit a24ca9976843156eabbc5f2d798954b5674d1b61 Author: Thomas Gleixner Date: Mon Nov 11 23:03:29 2019 +0100 x86/iopl: Remove legacy IOPL option The IOPL emulation via the I/O bitmap is sufficient. Remove the legacy cruft dealing with the (e)flags based IOPL mechanism. Signed-off-by: Thomas Gleixner Reviewed-by: Juergen Gross (Paravirt and Xen parts) Acked-by: Andy Lutomirski commit c8137ace56383688af911fea5934c71ad158135e Author: Thomas Gleixner Date: Mon Nov 11 23:03:28 2019 +0100 x86/iopl: Restrict iopl() permission scope The access to the full I/O port range can be also provided by the TSS I/O bitmap, but that would require to copy 8k of data on scheduling in the task. As shown with the sched out optimization TSS.io_bitmap_base can be used to switch the incoming task to a preallocated I/O bitmap which has all bits zero, i.e. allows access to all I/O ports. Implementing this allows to provide an iopl() emulation mode which restricts the IOPL level 3 permissions to I/O port access but removes the STI/CLI permission which is coming with the hardware IOPL mechansim. Provide a config option to switch IOPL to emulation mode, make it the default and while at it also provide an option to disable IOPL completely. Signed-off-by: Thomas Gleixner Acked-by: Andy Lutomirski commit be9afb4b529d9e3a68da1212e33be677bbfc8d2c Author: Thomas Gleixner Date: Mon Nov 11 23:03:27 2019 +0100 x86/iopl: Fixup misleading comment The comment for the sys_iopl() implementation is outdated and actively misleading in some parts. Fix it up. Signed-off-by: Thomas Gleixner Acked-by: Andy Lutomirski commit 0907a09c2e52210a67a9616427ea71f14b37e826 Author: Thomas Gleixner Date: Mon Nov 11 23:03:26 2019 +0100 selftests/x86/ioperm: Extend testing so the shared bitmap is exercised Add code to the fork path which forces the shared bitmap to be duplicated and the reference count to be dropped. Verify that the child modifications did not affect the parent. Signed-off-by: Thomas Gleixner commit 4804e382c117ce213cd5c43512cf4b1d71bb2650 Author: Thomas Gleixner Date: Mon Nov 11 23:03:25 2019 +0100 x86/ioperm: Share I/O bitmap if identical The I/O bitmap is duplicated on fork. That's wasting memory and slows down fork. There is no point to do so. As long as the bitmap is not modified it can be shared between threads and processes. Add a refcount and just share it on fork. If a task modifies the bitmap then it has to do the duplication if and only if it is shared. Signed-off-by: Thomas Gleixner Acked-by: Andy Lutomirski commit ea5f1cd7ab494f65f50f338299eabb40ad6a1767 Author: Thomas Gleixner Date: Mon Nov 11 23:03:24 2019 +0100 x86/ioperm: Remove bitmap if all permissions dropped If ioperm() results in a bitmap with all bits set (no permissions to any I/O port), then handling that bitmap on context switch and exit to user mode is pointless. Drop it. Move the bitmap exit handling to the ioport code and reuse it for both the thread exit path and dropping it. This allows to reuse this code for the upcoming iopl() emulation. Signed-off-by: Thomas Gleixner Acked-by: Andy Lutomirski commit 22fe5b0439dd53643fd6f4c582c46c6dba0fde53 Author: Thomas Gleixner Date: Mon Nov 11 23:03:23 2019 +0100 x86/ioperm: Move TSS bitmap update to exit to user work There is no point to update the TSS bitmap for tasks which use I/O bitmaps on every context switch. It's enough to update it right before exiting to user space. That reduces the context switch bitmap handling to invalidating the io bitmap base offset in the TSS when the outgoing task has TIF_IO_BITMAP set. The invaldiation is done on purpose when a task with an IO bitmap switches out to prevent any possible leakage of an activated IO bitmap. It also removes the requirement to update the tasks bitmap atomically in ioperm(). Signed-off-by: Thomas Gleixner commit 060aa16fdb7c5078a4159a76e5dc87d6a493af9b Author: Thomas Gleixner Date: Mon Nov 11 23:03:22 2019 +0100 x86/ioperm: Add bitmap sequence number Add a globally unique sequence number which is incremented when ioperm() is changing the I/O bitmap of a task. Store the new sequence number in the io_bitmap structure and compare it with the sequence number of the I/O bitmap which was last loaded on a CPU. Only update the bitmap if the sequence is different. That should further reduce the overhead of I/O bitmap scheduling when there are only a few I/O bitmap users on the system. The 64bit sequence counter is sufficient. A wraparound of the sequence counter assuming an ioperm() call every nanosecond would require about 584 years of uptime. Suggested-by: Linus Torvalds Signed-off-by: Thomas Gleixner commit 577d5cd7e5851d3832066cd0422475fa7db2ee17 Author: Thomas Gleixner Date: Mon Nov 11 23:03:21 2019 +0100 x86/ioperm: Move iobitmap data into a struct No point in having all the data in thread_struct, especially as upcoming changes add more. Make the bitmap in the new struct accessible as array of longs and as array of characters via a union, so both the bitmap functions and the update logic can avoid type casts. Signed-off-by: Thomas Gleixner commit f5848e5fd2f813c3a8009a642dfbcf635287c199 Author: Thomas Gleixner Date: Tue Nov 12 18:45:29 2019 +0100 x86/tss: Move I/O bitmap data into a seperate struct Move the non hardware portion of I/O bitmap data into a seperate struct for readability sake. Originally-by: Ingo Molnar Signed-off-by: Thomas Gleixner commit ecc7e37d4dadd16f6be125ca496feccd05454da4 Author: Thomas Gleixner Date: Mon Nov 11 23:03:20 2019 +0100 x86/io: Speedup schedule out of I/O bitmap user There is no requirement to update the TSS I/O bitmap when a thread using it is scheduled out and the incoming thread does not use it. For the permission check based on the TSS I/O bitmap the CPU calculates the memory location of the I/O bitmap by the address of the TSS and the io_bitmap_base member of the tss_struct. The easiest way to invalidate the I/O bitmap is to switch the offset to an address outside of the TSS limit. If an I/O instruction is issued from user space the TSS limit causes #GP to be raised in the same was as valid I/O bitmap with all bits set to 1 would do. This removes the extra work when an I/O bitmap using task is scheduled out and puts the burden on the rare I/O bitmap users when they are scheduled in. Signed-off-by: Thomas Gleixner commit 32f3bf67ee78332f2caec0984cb9d412cd0a3c23 Author: Thomas Gleixner Date: Tue Nov 12 19:56:19 2019 +0100 x86/ioperm: Avoid bitmap allocation if no permissions are set If ioperm() is invoked the first time and the @turn_on argument is 0, then there is no point to allocate a bitmap just to clear permissions which are not set. Signed-off-by: Thomas Gleixner commit ae31cea86ab31f3d2e15d6cc8710754ad7330c9e Author: Thomas Gleixner Date: Tue Nov 12 19:05:31 2019 +0100 x86/ioperm: Simplify first ioperm() invocation logic On the first allocation of a task the I/O bitmap needs to be allocated. After the allocation it is installed as an empty bitmap and immediately afterwards updated. Avoid that and just do the initial updates (store bitmap pointer, set TIF flag and make TSS limit valid) in the update path unconditionally. If the bitmap was already active this is redundant but harmless. Preparatory change for later optimizations in the context switch code. Signed-off-by: Thomas Gleixner commit b800fc4d4a2bfe4f4a52dc1955e1b4d8649e6d5f Author: Thomas Gleixner Date: Mon Nov 11 23:03:19 2019 +0100 x86/iopl: Cleanup include maze Get rid of superfluous includes. Signed-off-by: Thomas Gleixner Acked-by: Andy Lutomirski commit 6b546e1c9ad2a25f874f8bc6077d0f55f9446414 Author: Thomas Gleixner Date: Mon Nov 11 23:03:18 2019 +0100 x86/tss: Fix and move VMX BUILD_BUG_ON() The BUILD_BUG_ON(IO_BITMAP_OFFSET - 1 == 0x67) in the VMX code is bogus in two aspects: 1) This wants to be in generic x86 code simply to catch issues even when VMX is disabled in Kconfig. 2) The IO_BITMAP_OFFSET is not the right thing to check because it makes asssumptions about the layout of tss_struct. Nothing requires that the I/O bitmap is placed right after x86_tss, which is the hardware mandated tss structure. It pointlessly makes restrictions on the struct tss_struct layout. The proper thing to check is: - Offset of x86_tss in tss_struct is 0 - Size of x86_tss == 0x68 Move it to the other build time TSS checks and make it do the right thing. Signed-off-by: Thomas Gleixner Acked-by: Paolo Bonzini Acked-by: Andy Lutomirski commit 505b789996f64bdbfcc5847dd4b5076fc7c50274 Author: Thomas Gleixner Date: Mon Nov 11 23:03:17 2019 +0100 x86/cpu: Unify cpu_init() Similar to copy_thread_tls() the 32bit and 64bit implementations of cpu_init() are very similar and unification avoids duplicate changes in the future. Signed-off-by: Thomas Gleixner Acked-by: Andy Lutomirski commit 2fff071d28b54f050f62654dad4ec111b8416d8e Author: Thomas Gleixner Date: Mon Nov 11 23:03:16 2019 +0100 x86/process: Unify copy_thread_tls() While looking at the TSS io bitmap it turned out that any change in that area would require identical changes to copy_thread_tls(). The 32 and 64 bit variants share sufficient code to consolidate them into a common function to avoid duplication of upcoming modifications. Signed-off-by: Thomas Gleixner Acked-by: Andy Lutomirski commit 8c40397f22a4ff7996d3abdc2d9d1d90f9fc8054 Author: Thomas Gleixner Date: Mon Nov 11 23:03:15 2019 +0100 x86/ptrace: Prevent truncation of bitmap size The active() callback of the IO bitmap regset divides the IO bitmap size by the word size (32/64 bit). As the I/O bitmap size is in bytes the active check fails for bitmap sizes of 1-3 bytes on 32bit and 1-7 bytes on 64bit. Use DIV_ROUND_UP() instead. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Reviewed-by: Andy Lutomirski commit 585d1183ffeea5cbe2cd24863bbc90196d827257 Author: Lina Iyer Date: Fri Nov 15 15:11:52 2019 -0700 pinctrl/sdm845: Add PDC wakeup interrupt map for GPIOs Add interrupt parents for wakeup capable GPIOs for Qualcomm SDM845 SoC. Signed-off-by: Lina Iyer Signed-off-by: Marc Zyngier Reviewed-by: Linus Walleij Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1573855915-9841-10-git-send-email-ilina@codeaurora.org commit e35a6ae0eb3a7cc451e8d8db55e9b938a95de416 Author: Lina Iyer Date: Fri Nov 15 15:11:51 2019 -0700 pinctrl/msm: Setup GPIO chip in hierarchy Some GPIOs are marked as wakeup capable and are routed to another interrupt controller that is an always-domain and can detect interrupts even when most of the SoC is powered off. The wakeup interrupt controller wakes up the GIC and replays the interrupt at the GIC. Setup the TLMM irqchip in hierarchy with the wakeup interrupt controller and ensure the wakeup GPIOs are handled correctly. Co-developed-by: Maulik Shah Signed-off-by: Lina Iyer Signed-off-by: Marc Zyngier Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1573855915-9841-9-git-send-email-ilina@codeaurora.org ---- Changes in v2: - Address review comments - Fix Co-developed-by tag Changes in v1: - Address minor review comments - Remove redundant call to set irq handler - Move irq_domain_qcom_handle_wakeup() to this patch Changes in RFC v2: - Rebase on top of GPIO hierarchy support in linux-next - Set the chained irq handler for summary line commit e71374c07564536d38caed3e80a1ff1c4609161d Author: Maulik Shah Date: Fri Nov 15 15:11:50 2019 -0700 irqchip/qcom-pdc: Add irqchip set/get state calls Add irqchip calls to set/get interrupt state from the parent interrupt controller. When GPIOs are renabled as interrupt lines, it is desirable to clear the interrupt state at the GIC. This avoids any unwanted interrupt as a result of stale pending state recorded when the line was used as a GPIO. Signed-off-by: Maulik Shah [Lina: updated commit text, rearranged code] Signed-off-by: Lina Iyer Signed-off-by: Marc Zyngier Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1573855915-9841-8-git-send-email-ilina@codeaurora.org commit 81ef8bf88065b07d597c723ca5b0f1f10a808de4 Author: Lina Iyer Date: Fri Nov 15 15:11:47 2019 -0700 irqchip/qcom-pdc: Add irqdomain for wakeup capable GPIOs Introduce a new domain for wakeup capable GPIOs. The domain can be requested using the bus token DOMAIN_BUS_WAKEUP. In the following patches, we will specify PDC as the wakeup-parent for the TLMM GPIO irqchip. Requesting a wakeup GPIO will setup the GPIO and the corresponding PDC interrupt as its parent. Co-developed-by: Stephen Boyd Signed-off-by: Stephen Boyd Signed-off-by: Lina Iyer Signed-off-by: Marc Zyngier Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1573855915-9841-5-git-send-email-ilina@codeaurora.org commit da3f875a4189e643f8eec7f0bffa39c90d3418c6 Author: Lina Iyer Date: Fri Nov 15 15:11:46 2019 -0700 irqchip/qcom-pdc: Do not toggle IRQ_ENABLE during mask/unmask When an interrupt is to be serviced, the convention is to mask the interrupt at the chip and unmask after servicing the interrupt. Enabling and disabling the interrupt at the PDC irqchip causes an interrupt storm due to the way dual edge interrupts are handled in hardware. Skip configuring the PDC when the IRQ is masked and unmasked, instead use the irq_enable/irq_disable callbacks to toggle the IRQ_ENABLE register at the PDC. The PDC's IRQ_ENABLE register is only used during the monitoring mode when the system is asleep and is not needed for active mode detection. Signed-off-by: Lina Iyer Signed-off-by: Marc Zyngier Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1573855915-9841-4-git-send-email-ilina@codeaurora.org commit b2bb01ed0894c6d5d31cfa8aafb6ddbd7df2dd3f Author: Lina Iyer Date: Fri Nov 15 15:11:45 2019 -0700 irqchip/qcom-pdc: Update max PDC interrupts Newer SoCs have increased the number of interrupts routed to the PDC interrupt controller. Update the definition of max PDC interrupts. Signed-off-by: Lina Iyer Signed-off-by: Marc Zyngier Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1573855915-9841-3-git-send-email-ilina@codeaurora.org commit 09d31567f85b6cd0eddf28d90f7b83be09ee282b Author: Lina Iyer Date: Fri Nov 15 15:11:48 2019 -0700 of/irq: Document properties for wakeup interrupt parent Some interrupt controllers in a SoC, are always powered on and have a select interrupts routed to them, so that they can wakeup the SoC from suspend. Add wakeup-parent DT property to refer to these interrupt controllers. Signed-off-by: Lina Iyer Signed-off-by: Marc Zyngier Reviewed-by: Rob Herring Reviewed-by: Linus Walleij Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1573855915-9841-6-git-send-email-ilina@codeaurora.org commit 4a169a95d885fe5c050bac1a21d43c86ba955bcf Author: Maulik Shah Date: Fri Nov 15 15:11:49 2019 -0700 genirq: Introduce irq_chip_get/set_parent_state calls On certain QTI chipsets some GPIOs are direct-connect interrupts to the GIC to be used as regular interrupt lines. When the GPIOs are not used for interrupt generation the interrupt line is disabled. But disabling the interrupt at GIC does not prevent the interrupt to be reported as pending at GIC_ISPEND. Later, when drivers call enable_irq() on the interrupt, an unwanted interrupt occurs. Introduce get and set methods for irqchip's parent to clear it's pending irq state. This then can be invoked by the GPIO interrupt controller on the parents in it hierarchy to clear the interrupt before enabling the interrupt. Signed-off-by: Maulik Shah Signed-off-by: Lina Iyer Signed-off-by: Marc Zyngier Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1573855915-9841-7-git-send-email-ilina@codeaurora.org [updated commit text and minor code fixes] commit d46bca2b5d06cbb5f3e66945080f275bcfab7181 Author: Lina Iyer Date: Fri Nov 15 15:11:44 2019 -0700 irqdomain: Add bus token DOMAIN_BUS_WAKEUP A single controller can handle normal interrupts and wake-up interrupts independently, with a different numbering space. It is thus crucial to allow the driver for such a controller discriminate between the two. A simple way to do so is to tag the wake-up irqdomain with a "bus token" that indicates the wake-up domain. This slightly abuses the notion of bus, but also radically simplifies the design of such a driver. Between two evils, we choose the least damaging. Suggested-by: Stephen Boyd Signed-off-by: Lina Iyer Signed-off-by: Marc Zyngier Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1573855915-9841-2-git-send-email-ilina@codeaurora.org commit 07a594f353655b1628f598add352e7e754f44869 Author: Mika Westerberg Date: Fri Nov 15 18:50:03 2019 +0200 xhci-pci: Allow host runtime PM as default also for Intel Ice Lake xHCI Intel Ice Lake has two xHCI controllers one on PCH and the other as part of the CPU itself. The latter is also part of the so called Type C Subsystem (TCSS) sharing ACPI power resources with the PCIe root ports and the Thunderbolt controllers. In order to put the whole TCSS block into D3cold the xHCI needs to be runtime suspended as well when idle. For this reason allow runtime PM as default for Ice Lake TCSS xHCI controller. Signed-off-by: Mika Westerberg Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/1573836603-10871-5-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 36dc01657b4973ce2e52352e69db2b879c488176 Author: Suwan Kim Date: Fri Nov 15 18:50:02 2019 +0200 usb: host: xhci: Support running urb giveback in tasklet context Patch "USB: HCD: support giveback of URB in tasklet context"[1] introduced giveback of urb in tasklet context. [1] This patch was applied to ehci but not xhci. [2] This patch significantly reduces the hard irq time of xhci. Especially for uvc driver, the hard irq including the uvc completion function runs quite long but applying this patch reduces the hard irq time of xhci. I have tested four SS devices to check if performance degradation occurs when urb completion functions run in the tasklet context. As a result of the test, all devices works well and shows very similar performance with the upstream kernel. Moreover, usb ethernet adapter show better performance than the upstream kernel about 5% for RX and 2% for TX. Four SS devices is as follows. SS devices for test 1. WD My Passport 2TB (external hard drive) 2. Sandisk Ultra Flair USB 3.0 32GB 3. Logitech Brio webcam 4. Iptime 1gigabit ethernet adapter (Mediatek RTL8153) Test description 1. Mass storage (hard drive) performance test - run below command 10 times and compute the average performance dd if=/dev/sdN iflag=direct of=/dev/null bs=1G count=1 2. Mass storage (flash memory) performance test - run below command 10 times and compute the average performance dd if=/dev/sdN iflag=direct of=/dev/null bs=1G count=1 3. Webcam streaming performance test - run simple capture program and get the average frame rate per second - capture 1500 frames - program link https://github.com/asfaca/Webcam-performance-analyzing-tool - video resolution : 4096 X 2160 (4K) at 30 or 24 fps - device (Logitech Brio) spec url for the highest resolution and fps https://support.logitech.com/en_gb/product/brio-stream/specs 4. USB Ethernet adapter performance test - directly connect two linux machines with ethernet cable - run pktgen of linux kernel and send 1500 bytes packets - run vnstat to measure the network bandwidth for 180 seconds Test machine - CPU : Intel i5-7600 @ 3.5GHz Test results 1. Mass storage (hard drive) performance test WD My Passport 2TB (external hard drive) -------------------------------------------------------------------- xhci without tasklet | xhci with tasklet -------------------------------------------------------------------- 103.667MB/s | 103.692MB/s -------------------------------------------------------------------- 2. Mass storage (flash memory) performance test Sandisk Ultra Flair USB 3.0 32GB -------------------------------------------------------------------- xhci without tasklet | xhci with tasklet -------------------------------------------------------------------- 129.727MB/s | 130.2MB/s -------------------------------------------------------------------- 3. Webcam streaming performance test Logitech Brio webcam -------------------------------------------------------------------- xhci without tasklet | xhci with tasklet -------------------------------------------------------------------- 26.4451 fps | 26.3949 fps -------------------------------------------------------------------- 4. USB Ethernet adapter performance test Iptime 1gigabit ethernet adapter (Mediatek RTL8153) -------------------------------------------------------------------- xhci without tasklet | xhci with tasklet -------------------------------------------------------------------- RX 933.86 Mbit/s | 983.86 Mbit/s -------------------------------------------------------------------- TX 830.18 Mbit/s | 882.75 Mbit/s -------------------------------------------------------------------- [1], https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=94dfd7edfd5c9b605caf7b562de7a813d216e011 [2], https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=428aac8a81058e2303677a8fbf26670229e51d3a Signed-off-by: Suwan Kim Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/1573836603-10871-4-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 58b9d71a0f55e2514211875553dd092f74dc2cbc Author: Mathias Nyman Date: Fri Nov 15 18:50:01 2019 +0200 xhci: Add tracing for xhci doorbell register writes Trace when a register in the doorbell array is written, both for host controller command doorbell and device doorbells, including for which endpoint and stream Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/1573836603-10871-3-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit dc0ffbea5729a3abafa577ebfce87f18b79e294b Author: Peter Chen Date: Fri Nov 15 18:50:00 2019 +0200 usb: host: xhci: update event ring dequeue pointer on purpose On some situations, the software handles TRB events slower than adding TRBs, then xhci_handle_event can't return zero long time, the xHC will consider the event ring is full, and trigger "Event Ring Full" error, but in fact, the software has already finished lots of events, just no chance to update ERDP (event ring dequeue pointer). In this commit, we force update ERDP if half of TRBS_PER_SEGMENT events have handled to avoid "Event Ring Full" error. Signed-off-by: Peter Chen Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/1573836603-10871-2-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2a2b5932db67586bacc560cc065d62faece5b996 Author: Brian Foster Date: Fri Nov 15 21:15:08 2019 -0800 xfs: fix attr leaf header freemap.size underflow The leaf format xattr addition helper xfs_attr3_leaf_add_work() adjusts the block freemap in a couple places. The first update drops the size of the freemap that the caller had already selected to place the xattr name/value data. Before the function returns, it also checks whether the entries array has encroached on a freemap range by virtue of the new entry addition. This is necessary because the entries array grows from the start of the block (but end of the block header) towards the end of the block while the name/value data grows from the end of the block in the opposite direction. If the associated freemap is already empty, however, size is zero and the subtraction underflows the field and causes corruption. This is reproduced rarely by generic/070. The observed behavior is that a smaller sized freemap is aligned to the end of the entries list, several subsequent xattr additions land in larger freemaps and the entries list expands into the smaller freemap until it is fully consumed and then underflows. Note that it is not otherwise a corruption for the entries array to consume an empty freemap because the nameval list (i.e. the firstused pointer in the xattr header) starts beyond the end of the corrupted freemap. Update the freemap size modification to account for the fact that the freemap entry can be empty and thus stale. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 050552cbe06a3a9c3f977dcf11ff998ae1d5c2d5 Author: Darrick J. Wong Date: Thu Nov 14 12:51:34 2019 -0800 xfs: fix some memory leaks in log recovery Fix a few places where we xlog_alloc_buffer a buffer, hit an error, and then bail out without freeing the buffer. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 41585bbeeef9402d5d65687747e04246ef4a3a41 Author: Adrian Reber Date: Fri Nov 15 13:36:21 2019 +0100 selftests: add tests for clone3() with *set_tid This tests clone3() with *set_tid to see if all desired PIDs are working as expected. The tests are trying multiple invalid input parameters as well as creating processes while specifying a certain PID in multiple PID namespaces at the same time. Additionally this moves common clone3() test code into clone3_selftests.h. Signed-off-by: Adrian Reber Acked-by: Christian Brauner Link: https://lore.kernel.org/r/20191115123621.142252-2-areber@redhat.com Signed-off-by: Christian Brauner commit 2893c996d8ae021611d02906b9e6fcd0c765fba4 Merge: c3d6324f841b d6f39601ec5e Author: Daniel Borkmann Date: Fri Nov 15 23:49:27 2019 +0100 Merge branch 'bpf-trampoline' Alexei Starovoitov says: ==================== Introduce BPF trampoline that works as a bridge between kernel functions, BPF programs and other BPF programs. The first use case is fentry/fexit BPF programs that are roughly equivalent to kprobe/kretprobe. Unlike k[ret]probe there is practically zero overhead to call a set of BPF programs before or after kernel function. The second use case is heavily influenced by pain points in XDP development. BPF trampoline allows attaching similar fentry/fexit BPF program to any networking BPF program. It's now possible to see packets on input and output of any XDP, TC, lwt, cgroup programs without disturbing them. This greatly helps BPF-based network troubleshooting. The third use case of BPF trampoline will be explored in the follow up patches. The BPF trampoline will be used to dynamicly link BPF programs. It's more generic mechanism than array and link list of programs used in tracing, networking, cgroups. In many cases it can be used as a replacement for bpf_tail_call-based program chaining. See [1] for long term design discussion. v3 -> v4: - Included Peter's "86/alternatives: Teach text_poke_bp() to emulate instructions" as a first patch. If it changes between now and merge window, I'll rebease to newer version. The patch is necessary to do s/text_poke/text_poke_bp/ in patch 3 to fix the race. - In patch 4 fixed bpf_trampoline creation race spotted by Andrii. - Added patch 15 that annotates prog->kern bpf context types. It made patches 16 and 17 cleaner and more generic. - Addressed Andrii's feedback in other patches. v2 -> v3: - Addressed Song's and Andrii's comments - Fixed few minor bugs discovered while testing - Added one more libbpf patch v1 -> v2: - Addressed Andrii's comments - Added more test for fentry/fexit to kernel functions. Including stress test for maximum number of progs per trampoline. - Fixed a race btf_resolve_helper_id() - Added a patch to compare BTF types of functions arguments with actual types. - Added support for attaching BPF program to another BPF program via trampoline - Converted to use text_poke() API. That's the only viable mechanism to implement BPF-to-BPF attach. BPF-to-kernel attach can be refactored to use register_ftrace_direct() whenever it's available. [1] https://lore.kernel.org/bpf/20191112025112.bhzmrrh2pr76ssnh@ast-mbp.dhcp.thefacebook.com/ ==================== Signed-off-by: Daniel Borkmann commit 49cb2fc42ce4b7a656ee605e30c302efaa39c1a7 Author: Adrian Reber Date: Fri Nov 15 13:36:20 2019 +0100 fork: extend clone3() to support setting a PID The main motivation to add set_tid to clone3() is CRIU. To restore a process with the same PID/TID CRIU currently uses /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to ns_last_pid and then (quickly) does a clone(). This works most of the time, but it is racy. It is also slow as it requires multiple syscalls. Extending clone3() to support *set_tid makes it possible restore a process using CRIU without accessing /proc/sys/kernel/ns_last_pid and race free (as long as the desired PID/TID is available). This clone3() extension places the same restrictions (CAP_SYS_ADMIN) on clone3() with *set_tid as they are currently in place for ns_last_pid. The original version of this change was using a single value for set_tid. At the 2019 LPC, after presenting set_tid, it was, however, decided to change set_tid to an array to enable setting the PID of a process in multiple PID namespaces at the same time. If a process is created in a PID namespace it is possible to influence the PID inside and outside of the PID namespace. Details also in the corresponding selftest. To create a process with the following PIDs: PID NS level Requested PID 0 (host) 31496 1 42 2 1 For that example the two newly introduced parameters to struct clone_args (set_tid and set_tid_size) would need to be: set_tid[0] = 1; set_tid[1] = 42; set_tid[2] = 31496; set_tid_size = 3; If only the PIDs of the two innermost nested PID namespaces should be defined it would look like this: set_tid[0] = 1; set_tid[1] = 42; set_tid_size = 2; The PID of the newly created process would then be the next available free PID in the PID namespace level 0 (host) and 42 in the PID namespace at level 1 and the PID of the process in the innermost PID namespace would be 1. The set_tid array is used to specify the PID of a process starting from the innermost nested PID namespaces up to set_tid_size PID namespaces. set_tid_size cannot be larger then the current PID namespace level. Signed-off-by: Adrian Reber Reviewed-by: Christian Brauner Reviewed-by: Oleg Nesterov Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> Acked-by: Andrei Vagin Link: https://lore.kernel.org/r/20191115123621.142252-1-areber@redhat.com Signed-off-by: Christian Brauner commit d6f39601ec5e708fb666a2ad437c7bef4cfab39b Author: Alexei Starovoitov Date: Thu Nov 14 10:57:20 2019 -0800 selftests/bpf: Add a test for attaching BPF prog to another BPF prog and subprog Add a test that attaches one FEXIT program to main sched_cls networking program and two other FEXIT programs to subprograms. All three tracing programs access return values and skb->len of networking program and subprograms. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191114185720.1641606-21-ast@kernel.org commit 4c0963243c5f56bffe8eaba6acc5b076d51797f4 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:19 2019 -0800 selftests/bpf: Extend test_pkt_access test The test_pkt_access.o is used by multiple tests. Fix its section name so that program type can be automatically detected by libbpf and make it call other subprograms with skb argument. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191114185720.1641606-20-ast@kernel.org commit e7bf94dbb882b7d679a6a18e40e4f28076eb249f Author: Alexei Starovoitov Date: Thu Nov 14 10:57:18 2019 -0800 libbpf: Add support for attaching BPF programs to other BPF programs Extend libbpf api to pass attach_prog_fd into bpf_object__open. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-19-ast@kernel.org commit 5b92a28aae4dd0f88778d540ecfdcdaec5a41723 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:17 2019 -0800 bpf: Support attaching tracing BPF program to other BPF programs Allow FENTRY/FEXIT BPF programs to attach to other BPF programs of any type including their subprograms. This feature allows snooping on input and output packets in XDP, TC programs including their return values. In order to do that the verifier needs to track types not only of vmlinux, but types of other BPF programs as well. The verifier also needs to translate uapi/linux/bpf.h types used by networking programs into kernel internal BTF types used by FENTRY/FEXIT BPF programs. In some cases LLVM optimizations can remove arguments from BPF subprograms without adjusting BTF info that LLVM backend knows. When BTF info disagrees with actual types that the verifiers sees the BPF trampoline has to fallback to conservative and treat all arguments as u64. The FENTRY/FEXIT program can still attach to such subprograms, but it won't be able to recognize pointer types like 'struct sk_buff *' and it won't be able to pass them to bpf_skb_output() for dumping packets to user space. The FENTRY/FEXIT program would need to use bpf_probe_read_kernel() instead. The BPF_PROG_LOAD command is extended with attach_prog_fd field. When it's set to zero the attach_btf_id is one vmlinux BTF type ids. When attach_prog_fd points to previously loaded BPF program the attach_btf_id is BTF type id of main function or one of its subprograms. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-18-ast@kernel.org commit 8c1b6e69dcc1e11bd24111e3734dd740aaf3fda1 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:16 2019 -0800 bpf: Compare BTF types of functions arguments with actual types Make the verifier check that BTF types of function arguments match actual types passed into top-level BPF program and into BPF-to-BPF calls. If types match such BPF programs and sub-programs will have full support of BPF trampoline. If types mismatch the trampoline has to be conservative. It has to save/restore five program arguments and assume 64-bit scalars. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191114185720.1641606-17-ast@kernel.org commit ff4bf2f42a40e7dff28379f085b64df322c70b45 Author: Pablo Neira Ayuso Date: Fri Nov 15 11:36:35 2019 +0100 netfilter: nf_tables: add nft_unregister_flowtable_hook() Unbind flowtable callback if hook is unregistered. This patch is implicitly fixing the error path of nf_tables_newflowtable() and nft_flowtable_event(). Fixes: 8bb69f3b2918 ("netfilter: nf_tables: add flowtable offload control plane") Reported-by: wenxu Signed-off-by: Pablo Neira Ayuso commit d7c03a9f5c2577b29a7699bbaa1c1cbcfb56afd3 Author: wenxu Date: Fri Nov 15 19:21:26 2019 +0800 netfilter: nf_tables: check if bind callback fails and unbind if hook registration fails Undo the callback binding before unregistering the existing hooks. This should also check for error of the bind setup call. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit 63b48c73ff567bbab1f940d6e8f3f48607077a13 Author: Pablo Neira Ayuso Date: Thu Nov 14 14:17:28 2019 +0100 netfilter: nf_tables_offload: undo updates if transaction fails The nft_flow_rule_offload_commit() function might fail after several successful commands, thus, leaving the hardware filtering policy in inconsistent state. This patch adds nft_flow_rule_offload_abort() function which undoes the updates that have been already processed if one command in this transaction fails. Hence, the hardware ruleset is left as it was before this aborted transaction. The deletion path needs to create the flow_rule object too, in case that an existing rule needs to be re-added from the abort path. Signed-off-by: Pablo Neira Ayuso commit 23403cd8898dbc9808d3eb2f63bc1db8a340b751 Author: Pablo Neira Ayuso Date: Thu Nov 14 14:17:24 2019 +0100 netfilter: nf_tables_offload: release flow_rule on error from commit path If hardware offload commit path fails, release all flow_rule objects. Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support") Signed-off-by: Pablo Neira Ayuso commit 6ca61c7a8bac2768359f67003ac696260fd0985e Author: Pablo Neira Ayuso Date: Thu Nov 14 14:17:19 2019 +0100 netfilter: nf_tables_offload: remove reference to flow rule from deletion path The cookie is sufficient to delete the rule from the hardware. Signed-off-by: Pablo Neira Ayuso commit 458a1828e9f788d4c1da325069fed2c2eaa000fa Author: wenxu Date: Wed Nov 13 12:46:40 2019 +0800 netfilter: nf_flow_table: remove unnecessary parameter in flow_offload_fill_dir The ct object is already in the flow_offload structure, remove it. Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit ea13ca305177bd02de62087228a9f1e6793ccf2b Author: wenxu Date: Wed Nov 13 12:46:39 2019 +0800 netfilter: nf_flow_table_offload: Fix check ndo_setup_tc when setup_block It should check the ndo_setup_tc in the nf_flow_table_offload_setup. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit 91cc1a99740e2ed1d903b5906afb470cc5a07379 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:15 2019 -0800 bpf: Annotate context types Annotate BPF program context types with program-side type and kernel-side type. This type information is used by the verifier. btf_get_prog_ctx_type() is used in the later patches to verify that BTF type of ctx in BPF program matches to kernel expected ctx type. For example, the XDP program type is: BPF_PROG_TYPE(BPF_PROG_TYPE_XDP, xdp, struct xdp_md, struct xdp_buff) That means that XDP program should be written as: int xdp_prog(struct xdp_md *ctx) { ... } Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-16-ast@kernel.org commit 28f8bfd1ac948403ebd5c8070ae1e25421560059 Author: Phil Sutter Date: Tue Nov 12 17:14:37 2019 +0100 netfilter: Support iif matches in POSTROUTING Instead of generally passing NULL to NF_HOOK_COND() for input device, pass skb->dev which contains input device for routed skbs. Note that iptables (both legacy and nft) reject rules with input interface match from being added to POSTROUTING chains, but nftables allows this. Cc: Eric Garver Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 5c27d8d76ce810c6254cf5917a6019d824f34bd2 Author: Pablo Neira Ayuso Date: Wed Nov 13 14:08:01 2019 +0100 netfilter: nf_flow_table_offload: add IPv6 support Add nf_flow_rule_route_ipv6() and use it from the IPv6 and the inet flowtable type definitions. Rename the nf_flow_rule_route() function to nf_flow_rule_route_ipv4(). Adjust maximum number of actions, which now becomes 16 to leave sufficient room for the IPv6 address mangling for NAT. Signed-off-by: Pablo Neira Ayuso commit 4a766d490d205fbb07712527d0b6956ecbdec5d4 Author: Pablo Neira Ayuso Date: Wed Nov 13 14:08:00 2019 +0100 netfilter: nf_flow_table_offload: add flow_action_entry_next() and use it This function retrieves a spare action entry from the array of actions. Signed-off-by: Pablo Neira Ayuso commit 6408c40c39d8eee5caaf97f5219b7dd4e041cc59 Author: Arnd Bergmann Date: Fri Nov 8 22:32:47 2019 +0100 netfilter: nft_meta: use 64-bit time arithmetic On 32-bit architectures, get_seconds() returns an unsigned 32-bit time value, which also matches the type used in the nft_meta code. This will not overflow in year 2038 as a time_t would, but it still suffers from the overflow problem later on in year 2106. Change this instance to use the time64_t type consistently and avoid the deprecated get_seconds(). The nft_meta_weekday() calculation potentially gets a little slower on 32-bit architectures, but now it has the same behavior as on 64-bit architectures and does not overflow. Fixes: 63d10e12b00d ("netfilter: nft_meta: support for time matching") Signed-off-by: Arnd Bergmann Acked-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit fcbad8293d52864d87d0b9f6035fd87a049d59d8 Author: Arnd Bergmann Date: Fri Nov 8 21:34:28 2019 +0100 netfilter: xt_time: use time64_t The current xt_time driver suffers from the y2038 overflow on 32-bit architectures, when the time of day calculations break. Also, on both 32-bit and 64-bit architectures, there is a problem with info->date_start/stop, which is part of the user ABI and overflows in in 2106. Fix the first issue by using time64_t and explicit calls to div_u64() and div_u64_rem(), and document the seconds issue. The explicit 64-bit division is unfortunately slower on 32-bit architectures, but doing it as unsigned lets us use the optimized division-through-multiplication path in most configurations. This should be fine, as the code already does not allow any negative time of day values. Using u32 seconds values consistently would probably also work and be a little more efficient, but that doesn't feel right as it would propagate the y2106 overflow to more place rather than fewer. Signed-off-by: Arnd Bergmann Signed-off-by: Pablo Neira Ayuso commit 9cc31b3a092d9bf2a18f09ad77e727ddb42a5b1e Author: Alexei Starovoitov Date: Thu Nov 14 10:57:14 2019 -0800 bpf: Fix race in btf_resolve_helper_id() btf_resolve_helper_id() caching logic is a bit racy, since under root the verifier can verify several programs in parallel. Fix it with READ/WRITE_ONCE. Fix the type as well, since error is also recorded. Fixes: a7658e1a4164 ("bpf: Check types of arguments passed into helpers") Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191114185720.1641606-15-ast@kernel.org commit 9fd4a39dc7fe734d26eb89ea97e8c91331c6378c Author: Alexei Starovoitov Date: Thu Nov 14 10:57:13 2019 -0800 bpf: Reserve space for BPF trampoline in BPF programs BPF trampoline can be made to work with existing 5 bytes of BPF program prologue, but let's add 5 bytes of NOPs to the beginning of every JITed BPF program to make BPF trampoline job easier. They can be removed in the future. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-14-ast@kernel.org commit e76d776e9ca1fe266b3a7f8091eee5d1e635a545 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:12 2019 -0800 selftests/bpf: Add stress test for maximum number of progs Add stress test for maximum number of attached BPF programs per BPF trampoline. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-13-ast@kernel.org commit 510312882c4b583fcd4fdf972d00e9ce631ed188 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:11 2019 -0800 selftests/bpf: Add combined fentry/fexit test Add a combined fentry/fexit test. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-12-ast@kernel.org commit d3b0856e5959fbb50a2f2f15a5614e20e51cb522 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:10 2019 -0800 selftests/bpf: Add fexit tests for BPF trampoline Add fexit tests for BPF trampoline that checks kernel functions with up to 6 arguments of different sizes and their return values. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-11-ast@kernel.org commit 11d1e2eefffe86339b3b0b773bd31ef3b88faf7d Author: Alexei Starovoitov Date: Thu Nov 14 10:57:09 2019 -0800 selftests/bpf: Add test for BPF trampoline Add sanity test for BPF trampoline that checks kernel functions with up to 6 arguments of different sizes. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-10-ast@kernel.org commit faeb2dce084aff92d466c6ce68481989b815435b Author: Alexei Starovoitov Date: Thu Nov 14 10:57:08 2019 -0800 bpf: Add kernel test functions for fentry testing Add few kernel functions with various number of arguments, their types and sizes for BPF trampoline testing to cover different calling conventions. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-9-ast@kernel.org commit e41074d39d71aa62a6ec557af09cd42ca0928e05 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:07 2019 -0800 selftest/bpf: Simple test for fentry/fexit Add simple test for fentry and fexit programs around eth_type_trans. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-8-ast@kernel.org commit b8c54ea455dc2e0bda7ea9b0370279c224e21045 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:06 2019 -0800 libbpf: Add support to attach to fentry/fexit tracing progs Teach libbpf to recognize tracing programs types and attach them to fentry/fexit. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191114185720.1641606-7-ast@kernel.org commit 1442e2871b7679271fc9fcbf043ba1be511a7428 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:05 2019 -0800 libbpf: Introduce btf__find_by_name_kind() Introduce btf__find_by_name_kind() helper to search BTF by name and kind, since name alone can be ambiguous. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191114185720.1641606-6-ast@kernel.org commit fec56f5890d93fc2ed74166c397dc186b1c25951 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:04 2019 -0800 bpf: Introduce BPF trampoline Introduce BPF trampoline concept to allow kernel code to call into BPF programs with practically zero overhead. The trampoline generation logic is architecture dependent. It's converting native calling convention into BPF calling convention. BPF ISA is 64-bit (even on 32-bit architectures). The registers R1 to R5 are used to pass arguments into BPF functions. The main BPF program accepts only single argument "ctx" in R1. Whereas CPU native calling convention is different. x86-64 is passing first 6 arguments in registers and the rest on the stack. x86-32 is passing first 3 arguments in registers. sparc64 is passing first 6 in registers. And so on. The trampolines between BPF and kernel already exist. BPF_CALL_x macros in include/linux/filter.h statically compile trampolines from BPF into kernel helpers. They convert up to five u64 arguments into kernel C pointers and integers. On 64-bit architectures this BPF_to_kernel trampolines are nops. On 32-bit architecture they're meaningful. The opposite job kernel_to_BPF trampolines is done by CAST_TO_U64 macros and __bpf_trace_##call() shim functions in include/trace/bpf_probe.h. They convert kernel function arguments into array of u64s that BPF program consumes via R1=ctx pointer. This patch set is doing the same job as __bpf_trace_##call() static trampolines, but dynamically for any kernel function. There are ~22k global kernel functions that are attachable via nop at function entry. The function arguments and types are described in BTF. The job of btf_distill_func_proto() function is to extract useful information from BTF into "function model" that architecture dependent trampoline generators will use to generate assembly code to cast kernel function arguments into array of u64s. For example the kernel function eth_type_trans has two pointers. They will be casted to u64 and stored into stack of generated trampoline. The pointer to that stack space will be passed into BPF program in R1. On x86-64 such generated trampoline will consume 16 bytes of stack and two stores of %rdi and %rsi into stack. The verifier will make sure that only two u64 are accessed read-only by BPF program. The verifier will also recognize the precise type of the pointers being accessed and will not allow typecasting of the pointer to a different type within BPF program. The tracing use case in the datacenter demonstrated that certain key kernel functions have (like tcp_retransmit_skb) have 2 or more kprobes that are always active. Other functions have both kprobe and kretprobe. So it is essential to keep both kernel code and BPF programs executing at maximum speed. Hence generated BPF trampoline is re-generated every time new program is attached or detached to maintain maximum performance. To avoid the high cost of retpoline the attached BPF programs are called directly. __bpf_prog_enter/exit() are used to support per-program execution stats. In the future this logic will be optimized further by adding support for bpf_stats_enabled_key inside generated assembly code. Introduction of preemptible and sleepable BPF programs will completely remove the need to call to __bpf_prog_enter/exit(). Detach of a BPF program from the trampoline should not fail. To avoid memory allocation in detach path the half of the page is used as a reserve and flipped after each attach/detach. 2k bytes is enough to call 40+ BPF programs directly which is enough for BPF tracing use cases. This limit can be increased in the future. BPF_TRACE_FENTRY programs have access to raw kernel function arguments while BPF_TRACE_FEXIT programs have access to kernel return value as well. Often kprobe BPF program remembers function arguments in a map while kretprobe fetches arguments from a map and analyzes them together with return value. BPF_TRACE_FEXIT accelerates this typical use case. Recursion prevention for kprobe BPF programs is done via per-cpu bpf_prog_active counter. In practice that turned out to be a mistake. It caused programs to randomly skip execution. The tracing tools missed results they were looking for. Hence BPF trampoline doesn't provide builtin recursion prevention. It's a job of BPF program itself and will be addressed in the follow up patches. BPF trampoline is intended to be used beyond tracing and fentry/fexit use cases in the future. For example to remove retpoline cost from XDP programs. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20191114185720.1641606-5-ast@kernel.org commit 5964b2000f283ff5df366f718e0f083ebbaae977 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:03 2019 -0800 bpf: Add bpf_arch_text_poke() helper Add bpf_arch_text_poke() helper that is used by BPF trampoline logic to patch nops/calls in kernel text into calls into BPF trampoline and to patch calls/nops inside BPF programs too. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191114185720.1641606-4-ast@kernel.org commit 3b2744e665206ea82ce7673cb3ec889b2898a267 Author: Alexei Starovoitov Date: Thu Nov 14 10:57:02 2019 -0800 bpf: Refactor x86 JIT into helpers Refactor x86 JITing of LDX, STX, CALL instructions into separate helper functions. No functional changes in LDX and STX helpers. There is a minor change in CALL helper. It will populate target address correctly on the first pass of JIT instead of second pass. That won't reduce total number of JIT passes though. Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Acked-by: Song Liu Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20191114185720.1641606-3-ast@kernel.org commit 790756c7e0229dedc83bf058ac69633045b1000e Author: Nick Desaulniers Date: Mon Nov 4 19:31:45 2019 +0100 ARM: 8933/1: replace Sun/Solaris style flag on section directive It looks like a section directive was using "Solaris style" to declare the section flags. Replace this with the GNU style so that Clang's integrated assembler can assemble this directive. The modified instances were identified via: $ ag \.section | grep # Link: https://ftp.gnu.org/old-gnu/Manuals/gas-2.9.1/html_chapter/as_7.html#SEC119 Link: https://github.com/ClangBuiltLinux/linux/issues/744 Link: https://bugs.llvm.org/show_bug.cgi?id=43759 Link: https://reviews.llvm.org/D69296 Acked-by: Nicolas Pitre Reviewed-by: Ard Biesheuvel Reviewed-by: Stefan Agner Signed-off-by: Nick Desaulniers Suggested-by: Fangrui Song Suggested-by: Jian Cai Suggested-by: Peter Smith Signed-off-by: Russell King commit 74d06efb9c2f99b496eb118b1e941dc4c6404e93 Author: Vincenzo Frascino Date: Mon Nov 4 12:04:41 2019 +0100 ARM: 8932/1: Add clock_gettime64 entry point With the release of Linux 5.1 has been added a new syscall, clock_gettime64, that provided a 64 bit time value for a specified clock_ID to make the kernel Y2038 safe on 32 bit architectures. Update the arm specific vDSO library accordingly with what it has been done for the kernel syscall exposing the clock_gettime64 entry point. Signed-off-by: Vincenzo Frascino Signed-off-by: Russell King commit 052e76a31b4a64d7678e270d498e1bc36c342f88 Author: Vincenzo Frascino Date: Mon Nov 4 12:02:19 2019 +0100 ARM: 8931/1: Add clock_getres entry point The generic vDSO library provides an implementation of clock_getres() that can be leveraged by each architecture. Add clock_getres() entry point on arm to be on pair with arm64. Signed-off-by: Vincenzo Frascino Signed-off-by: Russell King commit 20e2fc42312f960f497ac2d617e3742754e1fa5e Author: Vincenzo Frascino Date: Mon Nov 4 11:59:59 2019 +0100 ARM: 8930/1: Add support for generic vDSO The arm vDSO library requires some adaptations to take advantage of the newly introduced generic vDSO library. Introduce the following changes: - Modification vdso.c to be compliant with the common vdso datapage - Use of lib/vdso for gettimeofday - Implementation of elf note Signed-off-by: Vincenzo Frascino Signed-off-by: Russell King commit 9f1984c6ae30e2a379751339ce3375a21099b5d4 Author: Stefan Agner Date: Sun Nov 3 19:22:06 2019 +0100 ARM: 8929/1: use APSR_nzcv instead of r15 as mrc operand LLVM's integrated assembler does not accept r15 as mrc operand. arch/arm/boot/compressed/head.S:1267:16: error: operand must be a register in range [r0, r14] or apsr_nzcv 1: mrc p15, 0, r15, c7, c14, 3 @ test,clean,invalidate D cache ^ Use APSR_nzcv instead of r15. The GNU assembler supports this syntax since binutils 2.21 [0]. [0] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commit;h=db472d6ff0f438a21b357249a9b48e4b74498076 Signed-off-by: Stefan Agner Signed-off-by: Russell King commit bebe668eee368359d0aab06d705532ba5f510b84 Author: Candle Sun Date: Thu Oct 24 08:36:28 2019 +0100 ARM: 8927/1: ARM/hw_breakpoint: add more ARMv8 debug architecture versions support When ARMv8 cores are used in AArch32 mode, arch_hw_breakpoint_init() in arch/arm/kernel/hw_breakpoint.c will be used. From ARMv8 specification, v8 debug architecture versions defined: * 0110 ARMv8, v8 Debug architecture. * 0111 ARMv8.1, v8 Debug architecture, with Virtualization Host Extensions. * 1000 ARMv8.2, v8.2 Debug architecture. * 1001 ARMv8.4, v8.4 Debug architecture. So missing ARMv8.1/ARMv8.2/ARMv8.4 cases will cause enable_monitor_mode() returns -ENODEV,and eventually arch_hw_breakpoint_init() will fail. Signed-off-by: Candle Sun Signed-off-by: Nianfu Bai Signed-off-by: Russell King commit fb033c95c94ca1ee3d16e04ebdb85d65fb55fff8 Author: Ben Dooks Date: Mon Nov 4 18:15:15 2019 +0100 ARM: 8918/2: only build return_address() if needed The system currently warns if the config conditions for building return_address in arch/arm/kernel/return_address.c are not met, leaving just an EXPORT_SYMBOL_GPL(return_address) of a function defined to be 'static linline'. This is a result of aeea3592a13b ("ARM: 8158/1: LLVMLinux: use static inline in ARM ftrace.h"). Since we're not going to build anything other than an exported symbol for something that is already being defined to be an inline-able return of NULL, just avoid building the code to remove the following warning: Fixes: aeea3592a13b ("ARM: 8158/1: LLVMLinux: use static inline in ARM ftrace.h") Signed-off-by: Ben Dooks Signed-off-by: Russell King commit c3d6324f841bab2403be6419986e2b1d1068d423 Author: Peter Zijlstra Date: Wed Jun 5 10:48:37 2019 +0200 x86/alternatives: Teach text_poke_bp() to emulate instructions In preparation for static_call and variable size jump_label support, teach text_poke_bp() to emulate instructions, namely: JMP32, JMP8, CALL, NOP2, NOP_ATOMIC5, INT3 The current text_poke_bp() takes a @handler argument which is used as a jump target when the temporary INT3 is hit by a different CPU. When patching CALL instructions, this doesn't work because we'd miss the PUSH of the return address. Instead, teach poke_int3_handler() to emulate an instruction, typically the instruction we're patching in. This fits almost all text_poke_bp() users, except arch_unoptimize_kprobe() which restores random text, and for that site we have to build an explicit emulate instruction. Tested-by: Alexei Starovoitov Tested-by: Steven Rostedt (VMware) Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Masami Hiramatsu Reviewed-by: Daniel Bristot de Oliveira Acked-by: Alexei Starovoitov Cc: Andy Lutomirski Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Steven Rostedt Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191111132457.529086974@infradead.org Signed-off-by: Ingo Molnar (cherry picked from commit 8c7eebc10687af45ac8e40ad1bac0cf7893dba9f) Signed-off-by: Alexei Starovoitov commit 808c9f7ebfffffc0a9a5d8aee1533759f09f93fc Author: Mao Wenan Date: Thu Nov 14 11:43:51 2019 +0800 bpf, doc: Change right arguments for JIT example code The example code for the x86_64 JIT uses the wrong arguments when calling function bar(). Signed-off-by: Mao Wenan Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191114034351.162740-1-maowenan@huawei.com commit b31333298087f8ee3559bd62bcbd1638f232cac0 Author: Andre Guedes Date: Thu Nov 14 08:28:47 2019 -0800 samples/bpf: Add missing option to xdpsock usage Commit 743e568c1586 (samples/bpf: Add a "force" flag to XDP samples) introduced the '-F' option but missed adding it to the usage() and the 'long_option' array. Fixes: 743e568c1586 (samples/bpf: Add a "force" flag to XDP samples) Signed-off-by: Andre Guedes Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191114162847.221770-2-andre.guedes@intel.com commit 110b2263db8ab91d204378988ca73b932b26dad3 Author: Andre Guedes Date: Thu Nov 14 08:28:46 2019 -0800 samples/bpf: Remove duplicate option from xdpsock The '-f' option is shown twice in the usage(). This patch removes the outdated version. Signed-off-by: Andre Guedes Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191114162847.221770-1-andre.guedes@intel.com commit fcf35131396ace1339e2ca89b45a6b12eed17105 Author: Ilya Leoshkevich Date: Thu Nov 14 16:18:20 2019 +0100 s390/bpf: Make sure JIT passes do not increase code size The upcoming s390 branch length extension patches rely on "passes do not increase code size" property in order to consistently choose between short and long branches. Currently this property does not hold between the first and the second passes for register save/restore sequences, as well as various code fragments that depend on SEEN_* flags. Generate the code during the first pass conservatively: assume register save/restore sequences have the maximum possible length, and that all SEEN_* flags are set. Also refuse to JIT if this happens anyway (e.g. due to a bug), as this might lead to verifier bypass once long branches are introduced. Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191114151820.53222-1-iii@linux.ibm.com commit b7b3fc8dd95bc02bd30680da258e09dda55270db Author: Ilya Leoshkevich Date: Fri Nov 15 13:37:22 2019 +0100 bpf: Support doubleword alignment in bpf_jit_binary_alloc Currently passing alignment greater than 4 to bpf_jit_binary_alloc does not work: in such cases it silently aligns only to 4 bytes. On s390, in order to load a constant from memory in a large (>512k) BPF program, one must use lgrl instruction, whose memory operand must be aligned on an 8-byte boundary. This patch makes it possible to request 8-byte alignment from bpf_jit_binary_alloc, and also makes it issue a warning when an unsupported alignment is requested. Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20191115123722.58462-1-iii@linux.ibm.com commit 9af433840b3f61ac30d569a85234ab8f210f813a Author: Wolfram Sang Date: Sat Nov 9 22:16:33 2019 +0100 i2c: remove helpers for ref-counting clients There are no in-tree users of these helpers anymore, and there shouldn't. Most use cases went away once the driver model started to refcount for us. There have been users like the media subsystem, but they all switched to better refcounting methods meanwhile. Media did this in 2008. Last user (IPMI) left 2018. Remove this cruft. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Reviewed-by: Jean Delvare Tested-by: Luca Ceresoli Reviewed-by: Luca Ceresoli Reviewed-by: Geert Uytterhoeven commit c39e342a050a4425348e6fe7f75827c0a1a7ebc5 Author: Petar Penkov Date: Thu Nov 14 09:52:09 2019 -0800 tun: fix data-race in gro_normal_list() There is a race in the TUN driver between napi_busy_loop and napi_gro_frags. This commit resolves the race by adding the NAPI struct via netif_tx_napi_add, instead of netif_napi_add, which disables polling for the NAPI struct. KCSAN reported: BUG: KCSAN: data-race in gro_normal_list.part.0 / napi_busy_loop write to 0xffff8880b5d474b0 of 4 bytes by task 11205 on cpu 0: gro_normal_list.part.0+0x77/0xb0 net/core/dev.c:5682 gro_normal_list net/core/dev.c:5678 [inline] gro_normal_one net/core/dev.c:5692 [inline] napi_frags_finish net/core/dev.c:5705 [inline] napi_gro_frags+0x625/0x770 net/core/dev.c:5778 tun_get_user+0x2150/0x26a0 drivers/net/tun.c:1976 tun_chr_write_iter+0x79/0xd0 drivers/net/tun.c:2022 call_write_iter include/linux/fs.h:1895 [inline] do_iter_readv_writev+0x487/0x5b0 fs/read_write.c:693 do_iter_write fs/read_write.c:970 [inline] do_iter_write+0x13b/0x3c0 fs/read_write.c:951 vfs_writev+0x118/0x1c0 fs/read_write.c:1015 do_writev+0xe3/0x250 fs/read_write.c:1058 __do_sys_writev fs/read_write.c:1131 [inline] __se_sys_writev fs/read_write.c:1128 [inline] __x64_sys_writev+0x4e/0x60 fs/read_write.c:1128 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 read to 0xffff8880b5d474b0 of 4 bytes by task 11168 on cpu 1: gro_normal_list net/core/dev.c:5678 [inline] napi_busy_loop+0xda/0x4f0 net/core/dev.c:6126 sk_busy_loop include/net/busy_poll.h:108 [inline] __skb_recv_udp+0x4ad/0x560 net/ipv4/udp.c:1689 udpv6_recvmsg+0x29e/0xe90 net/ipv6/udp.c:288 inet6_recvmsg+0xbb/0x240 net/ipv6/af_inet6.c:592 sock_recvmsg_nosec net/socket.c:871 [inline] sock_recvmsg net/socket.c:889 [inline] sock_recvmsg+0x92/0xb0 net/socket.c:885 sock_read_iter+0x15f/0x1e0 net/socket.c:967 call_read_iter include/linux/fs.h:1889 [inline] new_sync_read+0x389/0x4f0 fs/read_write.c:414 __vfs_read+0xb1/0xc0 fs/read_write.c:427 vfs_read fs/read_write.c:461 [inline] vfs_read+0x143/0x2c0 fs/read_write.c:446 ksys_read+0xd5/0x1b0 fs/read_write.c:587 __do_sys_read fs/read_write.c:597 [inline] __se_sys_read fs/read_write.c:595 [inline] __x64_sys_read+0x4c/0x60 fs/read_write.c:595 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 11168 Comm: syz-executor.0 Not tainted 5.4.0-rc6+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver") Signed-off-by: Petar Penkov Reported-by: syzbot Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 20021578ba226bda1f0ddf50e4d4a12ea1c6c6c1 Author: Eric Dumazet Date: Thu Nov 14 08:43:27 2019 -0800 selftests: net: tcp_mmap should create detached threads Since we do not plan using pthread_join() in the server do_accept() loop, we better create detached threads, or risk increasing memory footprint over time. Fixes: 192dc405f308 ("selftests: net: add tcp_mmap program") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 61ca533c0e94104c35fcb7858a23ec9a05d78143 Author: Tonghao Zhang Date: Thu Nov 14 23:51:08 2019 +0800 net: openvswitch: don't call pad_packet if not necessary The nla_put_u16/nla_put_u32 makes sure that *attrlen is align. The call tree is that: nla_put_u16/nla_put_u32 -> nla_put attrlen = sizeof(u16) or sizeof(u32) -> __nla_put attrlen -> __nla_reserve attrlen -> skb_put(skb, nla_total_size(attrlen)) nla_total_size returns the total length of attribute including padding. Cc: Joe Stringer Cc: William Tu Signed-off-by: Tonghao Zhang Acked-by: Pravin B Shelar Signed-off-by: David S. Miller commit 3bb884a4a0c4177c61233424d43d61545c4fc528 Merge: e7be235fa783 56051948773e Author: David S. Miller Date: Fri Nov 15 12:32:17 2019 -0800 Merge branch 'DSA-driver-for-Vitesse-Felix-switch' Vladimir Oltean says: ==================== DSA driver for Vitesse Felix switch This series builds upon the previous "Accomodate DSA front-end into Ocelot" topic and does the following: - Reworks the Ocelot (VSC7514) driver to support one more switching core (VSC9959), used in NPI mode. Some code which was thought to be SoC-specific (ocelot_board.c) wasn't, and vice versa, so it is being accordingly moved. - Exports ocelot driver structures and functions to include/soc/mscc. - Adds a DSA ocelot front-end for VSC9959, which is a PCI device and uses the exported ocelot functionality for hardware configuration. - Adds a tagger driver for the Vitesse injection/extraction DSA headers. This is known to be compatible with at least Ocelot and Felix. ==================== Signed-off-by: David S. Miller commit 56051948773eeb4224fbda88102e891d1ad5cefd Author: Vladimir Oltean Date: Thu Nov 14 17:03:30 2019 +0200 net: dsa: ocelot: add driver for Felix switch family This supports an Ethernet switching core from Vitesse / Microsemi / Microchip (VSC9959) which is part of the Ocelot family (a brand name), and whose code name is Felix. The switch can be (and is) integrated on different SoCs as a PCIe endpoint device. The functionality is provided by the core of the Ocelot switch driver (drivers/net/ethernet/mscc). In this regard, the current driver is an instance of Microsemi's Ocelot core driver, with a DSA front-end. It inherits its name from VSC9959's code name, to distinguish itself from the switchdev ocelot driver. The patch adds the logic for probing a PCI device and defines the register map for the VSC9959 switch core, since it has some differences in register addresses and bitfield mappings compared to the other Ocelot switches (VSC7511, VSC7512, VSC7513, VSC7514). The Felix driver declares the register map as part of the "instance table". Currently the VSC9959 inside NXP LS1028A is the only instance, but presumably it can support other switches in the Ocelot family, when used in DSA mode (Linux running on the external CPU, and not on the embedded MIPS). In a few cases, some h/w operations have to be done differently on VSC9959 due to missing bitfields. This is the case for the switch core reset and init. Because for this operation Ocelot uses some bits that are not present on Felix, the latter has to use a register from the global registers block (GCB) instead. Although it is a PCI driver, it relies on DT bindings for compatibility with DSA (CPU port link, PHY library). It does not have any custom device tree bindings, since we would like to minimize its dependency on device tree though. Signed-off-by: Claudiu Manoil Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 8dce89aa5f3274e7c26132433840f63d129406bb Author: Vladimir Oltean Date: Thu Nov 14 17:03:29 2019 +0200 net: dsa: ocelot: add tagger for Ocelot/Felix switches While it is entirely possible that this tagger format is in fact more generic than just these 2 switch families, I don't have that knowledge. The Seville switch in NXP T1040 has a similar frame format, but there are enough differences (e.g. DEST field starts at bit 57 instead of 56) that calling this file tag_vitesse.c is a bit of a stretch at the moment. The frame format has been listed in a comment so that people who add support for further Vitesse switches can rework this tagger while keeping compatibility with Felix. The "ocelot" name was chosen instead of "felix" because even the Ocelot switch can act as a DSA device when it is used in NPI mode, and the Felix tagger format is almost identical. Currently it is only used for the Felix switch embedded in the NXP LS1028A chip. The ABI for this tagger should be considered "not stable" at the moment. The DSA tag is always placed before the Ethernet header and therefore, we are using the long prefix for RX tags to avoid putting the DSA master port in promiscuous mode. Once there will be an API in DSA for drivers to request DSA masters to be in promiscuous mode unconditionally, we will switch to the "no prefix" extraction frame header, which will save 16 padding bytes for each RX frame. Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit a030dfe1947310a2140b9e371dc9ebfab72c914f Author: Vladimir Oltean Date: Thu Nov 14 17:03:28 2019 +0200 net: mscc: ocelot: publish ocelot_sys.h to include/soc/mscc The Felix DSA driver needs to write to SYS_RAM_INIT_RAM_INIT for its own chip initialization process. Also update the MAINTAINERS file such that the headers exported by the ocelot driver are under the same maintainers' umbrella as the driver itself. Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 5e2563650232a4d998a60b10d3679f65dd4c02fb Author: Vladimir Oltean Date: Thu Nov 14 17:03:27 2019 +0200 net: mscc: ocelot: publish structure definitions to include/soc/mscc/ocelot.h We will be registering another switch driver based on ocelot, which lives under drivers/net/dsa. Make sure the Felix DSA front-end has the necessary abstractions to implement a new Ocelot driver instantiation. This includes the function prototypes for implementing DSA callbacks. Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 3a77b5933fdb2ea4a9c7cdd9bd9b65b6fd23626e Author: Vladimir Oltean Date: Thu Nov 14 17:03:26 2019 +0200 net: mscc: ocelot: separate the implementation of switch reset The Felix switch has a different reset procedure, so a function pointer needs to be created and added to the ocelot_ops structure. The reset procedure has been moved into ocelot_init. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit ba551bc3bc22f3a9f16a31cd856b823e76489009 Author: Vladimir Oltean Date: Thu Nov 14 17:03:25 2019 +0200 net: mscc: ocelot: adjust MTU on the CPU port in NPI mode When using the NPI port, the DSA tag is passed through Ethernet, so the switch's MAC needs to accept it as it comes from the DSA master. Increase the MTU on the external CPU port to account for the length of the injection header. Without this patch, MTU-sized frames are dropped by the switch's CPU port on xmit, which is especially obvious in TCP sessions. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit f24711fddc36aa7286af724393ef7334b92c5702 Author: Vladimir Oltean Date: Thu Nov 14 17:03:24 2019 +0200 net: mscc: ocelot: export a constant for the tag length in bytes This constant will be used in a future patch to increase the MTU on NPI ports, and will also be used in the tagger driver for Felix. Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit fa914e9c4d9485f06b3676791a74587d2642fca3 Author: Vladimir Oltean Date: Thu Nov 14 17:03:23 2019 +0200 net: mscc: ocelot: create a helper for changing the port MTU Since in an NPI/DSA setup, not all ports will have the same MTU, we need to make sure the watermarks for pause frames and/or tail dropping logic that existed in the driver is still coherent for the new MTU values. We need to do this because the NPI (aka external CPU) port needs an increased MTU for the DSA tag. This will be done in a future patch. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 5bc9d2e6e7d546548ae1a7cd3de37672db4075ce Author: Vladimir Oltean Date: Thu Nov 14 17:03:22 2019 +0200 net: mscc: ocelot: move invariant configs out of adjust_link It doesn't make sense to rewrite all these registers every time the PHY library notifies us about a link state change. In a future patch we will customize the MTU for the CPU port, and since the MTU was previously configured from adjust_link, if we don't make this change, its value would have got overridden. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit dc3de2a294eab8b1375f96eb4cf2a1d5edfcc9ab Author: Claudiu Manoil Date: Thu Nov 14 17:03:21 2019 +0200 net: mscc: ocelot: filter out ocelot SoC specific PCS config from common path The adjust_link routine should be generic enough to be (re)used by any SoC that integrates a switch core compatible with the Ocelot core switch driver. Currently all configurations are generic except for the PCS settings that are SoC specific. Move these out to the Ocelot SoC/board instance. Signed-off-by: Claudiu Manoil Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 259630e08c2135df6582040b20bd5bb1383964a3 Author: Claudiu Manoil Date: Thu Nov 14 17:03:20 2019 +0200 net: mscc: ocelot: move resource ioremap and regmap init to common code Let's make this ioremap and regmap init code common. It should not be platform dependent as it should be usable by PCI devices too. Use better names where necessary to avoid clashes. Signed-off-by: Claudiu Manoil Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit e7be235fa783209a661c8a324c1e394a5e4d9170 Merge: 43da44c87678 0b29ec643613 Author: David S. Miller Date: Fri Nov 15 12:28:28 2019 -0800 Merge branch 'net-smc-improve-termination-handling-part-3' Karsten Graul says: ==================== net/smc: improve termination handling (part 3) Part 3 of the SMC termination patches improves the link group termination processing and introduces the ability to immediately terminate a link group. ==================== Signed-off-by: David S. Miller commit 0b29ec6436138721acf5844e558f7334a0fa61d5 Author: Ursula Braun Date: Thu Nov 14 13:02:47 2019 +0100 net/smc: immediate termination for SMCR link groups If the SMC module is unloaded or an IB device is thrown away, the immediate link group freeing introduced for SMCD is exploited for SMCR as well. That means SMCR-specifics are added to smc_conn_kill(). Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 6a37ad3da5d64a632d03a8dc272c65e706cc7160 Author: Ursula Braun Date: Thu Nov 14 13:02:46 2019 +0100 net/smc: wait for tx completions before link freeing Make sure all pending work requests are completed before freeing a link. Dismiss tx pending slots already when terminating a link group to exploit termination shortcut in tx completion queue handler. And kill the completion queue tasklets after destroy of the completion queues, otherwise there is a time window for another tasklet schedule of an already killed tasklet. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 2c1d3e50302fe3e0bd6873323877c2ad19db3f49 Author: Ursula Braun Date: Thu Nov 14 13:02:45 2019 +0100 net/smc: abnormal termination without orderly flag For abnormal termination issue an LLC DELETE_LINK without the orderly flag. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 15e1b99aadfb2766f9379a23a0fc1d4336c8cd8e Author: Ursula Braun Date: Thu Nov 14 13:02:44 2019 +0100 net/smc: no WR buffer wait for terminating link group Avoid waiting for a free work request buffer, if the link group is already terminating. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 5edd6b9cb8d7c6c346c93c52a53735591127e879 Author: Ursula Braun Date: Thu Nov 14 13:02:43 2019 +0100 net/smc: introduce bookkeeping of SMCD link groups If the ism module is unloaded return control from exit routine only, if all link groups are freed. If an IB device is thrown away return control from device removal only, if all link groups belonging to this device are freed. A counters for the total number of SMCD link groups per ISM device is introduced. ism module unloading continues only if the total number of SMCD link groups for all ISM devices is zero. ISM device removal continues only it the total number of SMCD link groups per ISM device has decreased to zero. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 5421ec281df9dfda4418c02959e1f76097cabd9a Author: Ursula Braun Date: Thu Nov 14 13:02:42 2019 +0100 net/smc: abnormal termination of SMCD link groups A final cleanup due to SMCD device removal means immediate freeing of all link groups belonging to this device in interrupt context. This patch introduces a separate SMCD link group termination routine, which terminates all link groups of an SMCD device. This new routine smcd_terminate_all ()is reused if the smc module is unloaded. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 42bfba9eaa33dd4af0b50b87508062a41ec26653 Author: Ursula Braun Date: Thu Nov 14 13:02:41 2019 +0100 net/smc: immediate termination for SMCD link groups SMCD link group termination is called when peer signals its shutdown of its corresponding link group. For regular shutdowns no connections exist anymore. For abnormal shutdowns connections must be killed and their DMBs must be unregistered immediately. That means the SMCR method to delay the link group freeing several seconds does not fit. This patch adds immediate termination of a link group and its SMCD connections and makes sure all SMCD link group related cleanup steps are finished. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 50c6b20eff8e10cb91f06262d8003a5d9be3dfab Author: Ursula Braun Date: Thu Nov 14 13:02:40 2019 +0100 net/smc: fix final cleanup sequence for SMCD devices If peer announces shutdown, use the link group terminate worker for local cleanup of link groups and connections to terminate link group in proper context. Make sure link groups are cleaned up first before destroying the event queue of the SMCD device, because link group cleanup may raise events. Send signal shutdown only if peer has not done it already. Send socket abort or close only, if peer has not already announced shutdown. Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 43da44c87678612f301d6ef6314064a6b52aad60 Merge: 983db6198f0d 8d07a7930434 Author: David S. Miller Date: Fri Nov 15 12:25:42 2019 -0800 Merge branch 'net-stmmac-CPU-Performance-Improvements' Jose Abreu says: ==================== net: stmmac: CPU Performance Improvements CPU Performance improvements for stmmac. Please check bellow for results before and after the series. Patch 1/7, allows RX Interrupt on Completion to be disabled and only use the RX HW Watchdog. Patch 2/7, setups the default RX coalesce settings instead of using the minimum value. Patch 3/7 and 4/7, removes the uneeded computations for RX Flow Control activation/de-activation, on some cases. Patch 5/7, tunes-up the default coalesce settings. Patch 6/7, re-works the TX coalesce timer activation logic. Patch 7/7, removes the now uneeded TBU interrupt. NetPerf UDP Results: -------------------- Socket Message Elapsed Messages CPU Service Size Size Time Okay Errors Throughput Util Demand bytes bytes secs # # 10^6bits/sec % SS us/KB --- XGMAC@2.5G: Before 212992 1400 10.00 2100620 0 2351.7 36.69 5.112 212992 10.00 2100539 2351.6 26.18 3.648 --- XGMAC@2.5G: After 212992 1400 10.00 2108972 0 2361.5 21.73 3.015 212992 10.00 2097038 2348.1 19.21 2.666 --- GMAC5@1G: Before 212992 1400 10.00 786000 0 880.2 34.71 12.923 212992 10.00 786000 880.2 23.42 8.719 --- GMAC5@1G: After 212992 1400 10.00 842648 0 943.7 14.12 4.903 212992 10.00 842648 943.7 12.73 4.418 Perf TCP Results on RX Path: ---------------------------- --- XGMAC@2.5G: Before 22.51% swapper [stmmac] [k] dwxgmac2_dma_interrupt 10.82% swapper [stmmac] [k] dwxgmac2_host_mtl_irq_status 5.21% swapper [stmmac] [k] dwxgmac2_host_irq_status 4.67% swapper [stmmac] [k] dwxgmac3_safety_feat_irq_status 3.63% swapper [kernel.kallsyms] [k] stack_trace_consume_entry 2.74% iperf3 [kernel.kallsyms] [k] copy_user_enhanced_fast_string 2.52% swapper [kernel.kallsyms] [k] update_stack_state 1.94% ksoftirqd/0 [stmmac] [k] dwxgmac2_dma_interrupt 1.45% iperf3 [kernel.kallsyms] [k] queued_spin_lock_slowpath 1.26% swapper [kernel.kallsyms] [k] create_object --- XGMAC@2.5G: After 7.43% swapper [kernel.kallsyms] [k] stack_trace_consume_entry 5.86% swapper [stmmac] [k] dwxgmac2_dma_interrupt 5.68% swapper [kernel.kallsyms] [k] update_stack_state 4.71% iperf3 [kernel.kallsyms] [k] copy_user_enhanced_fast_string 2.88% swapper [kernel.kallsyms] [k] create_object 2.69% swapper [stmmac] [k] dwxgmac2_host_mtl_irq_status 2.61% swapper [stmmac] [k] stmmac_napi_poll_rx 2.52% swapper [kernel.kallsyms] [k] unwind_next_frame.part.4 1.48% swapper [kernel.kallsyms] [k] unwind_get_return_address 1.38% swapper [kernel.kallsyms] [k] arch_stack_walk --- GMAC5@1G: Before 31.29% swapper [stmmac] [k] dwmac4_dma_interrupt 14.57% swapper [stmmac] [k] dwmac4_irq_mtl_status 10.66% swapper [stmmac] [k] dwmac4_irq_status 1.97% swapper [kernel.kallsyms] [k] stack_trace_consume_entry 1.73% iperf3 [kernel.kallsyms] [k] copy_user_enhanced_fast_string 1.59% swapper [kernel.kallsyms] [k] update_stack_state 1.15% iperf3 [kernel.kallsyms] [k] do_syscall_64 1.01% ksoftirqd/0 [stmmac] [k] dwmac4_dma_interrupt 0.89% swapper [kernel.kallsyms] [k] __default_send_IPI_dest_field 0.75% swapper [stmmac] [k] stmmac_napi_poll_rx --- GMAC5@1G: After 6.70% swapper [kernel.kallsyms] [k] stack_trace_consume_entry 5.79% swapper [stmmac] [k] dwmac4_dma_interrupt 5.29% swapper [kernel.kallsyms] [k] update_stack_state 3.52% iperf3 [kernel.kallsyms] [k] copy_user_enhanced_fast_string 2.83% swapper [stmmac] [k] dwmac4_irq_mtl_status 2.62% swapper [kernel.kallsyms] [k] create_object 2.46% swapper [stmmac] [k] stmmac_napi_poll_rx 2.32% swapper [kernel.kallsyms] [k] unwind_next_frame.part.4 2.19% swapper [stmmac] [k] dwmac4_irq_status 1.39% swapper [kernel.kallsyms] [k] unwind_get_return_address ==================== Signed-off-by: David S. Miller commit 8d07a7930434afd7ca4faa90ed478552d4a84b17 Author: Jose Abreu Date: Thu Nov 14 12:42:51 2019 +0100 net: stmmac: xgmac: Do not enable TBU interrupt Now that TX Coalesce has been rewritten we no longer need this additional interrupt enabled. This reduces CPU usage. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit c2837423cb54551302f037106830ee607b4563e0 Author: Jose Abreu Date: Thu Nov 14 12:42:50 2019 +0100 net: stmmac: Rework TX Coalesce logic Coalesce logic currently increments the number of packets and sets the IC bit when the coalesced packets have passed a given limit. This does not reflect very well what coalesce was meant for as we can have a large number of packets that are coalesced and then a single one, sent later on that has the IC bit. Rework the logic so that it coalesces only upon a limit of packets and sets the IC bit for large number of packets. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit da20245100319b54af770df707f358f2ebc3b16d Author: Jose Abreu Date: Thu Nov 14 12:42:49 2019 +0100 net: stmmac: Tune-up default coalesce settings Tune-up the defalt coalesce settings for optimal values. This gives the best performance in most of the use-cases. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 52f96cd135b160d44db4cb62a5b614b3bca20fbc Author: Jose Abreu Date: Thu Nov 14 12:42:48 2019 +0100 net: stmmac: xgmac: Remove uneeded computation for RFA/RFD RFA and RFD should not be dependent on FIFO size. In fact, the more FIFO space we have, the later we can activate Flow Control. Let's use hard-coded values for RFA and RFD for all FIFO sizes with the exception of 4k, which is a special case. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 854248e5ec810afe2c3dcf017bb76b7224b97c47 Author: Jose Abreu Date: Thu Nov 14 12:42:47 2019 +0100 net: stmmac: gmac4+: Remove uneeded computation for RFA/RFD RFA and RFD should not be dependent on FIFO size. In fact, the more FIFO space we have, the later we can activate Flow Control. Let's use hard-coded values for RFA and RFD for all FIFO sizes with the exception of 4k, which is a special case. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 4e4337ccf780978881f8f41c5c30dad626a4a51e Author: Jose Abreu Date: Thu Nov 14 12:42:46 2019 +0100 net: stmmac: Setup a default RX Coalesce value instead of the minimum For performance reasons, sometimes using the minimum RX Coalesce value is not optimal. Lets setup a default value that is optimal in most of the use cases. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 09146abebc788a2f133a6eae9cd6dc8c91c05047 Author: Jose Abreu Date: Thu Nov 14 12:42:45 2019 +0100 net: stmmac: Do not set RX IC bit if RX Coalesce is zero We may only want to use the RX Watchdog so lets check if RX Coalesce settings are non-zero and only set the RX Interrupt on Completion bit if its not. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 983db6198f0d0ee406f365069901387e7834c3c0 Author: Ido Schimmel Date: Thu Nov 14 11:54:19 2019 +0200 mlxsw: spectrum_router: Allocate discard adjacency entry when needed Commit 0c3cbbf96def ("mlxsw: Add specific trap for packets routed via invalid nexthops") allocated an adjacency entry during driver initialization whose purpose is to discard packets hitting the route pointing to it. These adjacency entries are allocated from a resource called KVD linear (KVDL). There are situations in which the user can decide to set the size of this resource (via devlink-resource) to 0, in which case the driver will not be able to load. Therefore, instead of pre-allocating this adjacency entry, simply allocate it only when needed. A variable indicating the validity of the entry is added and is used to ensure it is only allocated and written once and that it is freed after all the routes were flushed. Fixes: 0c3cbbf96def ("mlxsw: Add specific trap for packets routed via invalid nexthops") Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit d6649d788e1a40b9bf2064bee4d7960fe85bd81e Author: YueHaibing Date: Thu Nov 14 15:39:46 2019 +0800 net/tls: Fix unused function warning If PROC_FS is not set, gcc warning this: net/tls/tls_proc.c:23:12: warning: 'tls_statistics_seq_show' defined but not used [-Wunused-function] Use #ifdef to guard this. Reported-by: Hulk Robot Signed-off-by: YueHaibing Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 49e9d1a9faf2f71fdfd80a30697ee9a15070626d Author: Sebastian Andrzej Siewior Date: Fri Nov 15 19:01:25 2019 +0100 workqueue: Add RCU annotation for pwq list walk An additional check has been recently added to ensure that a RCU related lock is held while the RCU list is iterated. The `pwqs' are sometimes iterated without a RCU lock but with the &wq->mutex acquired leading to a warning. Teach list_for_each_entry_rcu() that the RCU usage is okay if &wq->mutex is acquired during the list traversal. Fixes: 28875945ba98d ("rcu: Add support for consolidated-RCU reader checking") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Tejun Heo commit dffe969aa7abfd866bc86780762a6aafa196d286 Author: Anson Huang Date: Fri Nov 15 11:30:14 2019 -0800 Input: imx_sc_key - correct SCU message structure to avoid stack corruption The SCU message's data field used for receiving response data from SCU should be 32-bit width, as SCU will send back 32-bit width data. This solves kernel panic when CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG is enabled. [ 1.950768] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted [ 1.980607] Workqueue: events imx_sc_check_for_events [ 1.985657] Call trace: [ 1.988104] dump_backtrace+0x0/0x140 [ 1.991768] show_stack+0x14/0x20 [ 1.995090] dump_stack+0xb4/0xf8 [ 1.998407] panic+0x158/0x324 [ 2.001463] print_tainted+0x0/0xa8 [ 2.004950] imx_sc_check_for_events+0x18c/0x190 [ 2.009569] process_one_work+0x198/0x320 [ 2.013579] worker_thread+0x48/0x420 [ 2.017252] kthread+0xf0/0x120 [ 2.020394] ret_from_fork+0x10/0x18 [ 2.023977] SMP: stopping secondary CPUs [ 2.027901] Kernel Offset: disabled [ 2.031391] CPU features: 0x0002,2100600c [ 2.035401] Memory Limit: none Signed-off-by: Anson Huang Fixes: 688f1dfb69b4 ("Input: keyboard - imx_sc: Add i.MX system controller key support") Link: https://lore.kernel.org/r/1573730499-2224-1-git-send-email-Anson.Huang@nxp.com Signed-off-by: Dmitry Torokhov commit d537858ac8aaf4311b51240893add2fc62003b97 Author: Mikulas Patocka Date: Wed Nov 13 06:48:16 2019 -0500 dm integrity: fix excessive alignment of metadata runs Metadata runs are supposed to be aligned on 4k boundary (so that they work efficiently with disks with 4k sectors). However, there was a programming bug that makes them aligned on 128k boundary instead. The unused space is wasted. Fix this bug by providing a proper 4k alignment. In order to keep existing volumes working, we introduce a new flag SB_FLAG_FIXED_PADDING - when the flag is clear, we calculate the padding the old way. In order to make sure that the old version cannot mount the volume created by the new version, we increase superblock version to 4. Also in order to not break with old integritysetup, we fix alignment only if the parameter "fix_padding" is present when formatting the device. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit c5ab54e9945b5f3dc8e9c31b93bb334fcea126f4 Author: Green Wan Date: Thu Nov 7 16:49:20 2019 +0800 riscv: dts: add support for PDMA device of HiFive Unleashed Rev A00 Add PDMA support to (arch/riscv/boot/dts/sifive/fu540-c000.dtsi) Signed-off-by: Green Wan Signed-off-by: Paul Walmsley commit 128161f47bc3797b0d068da13e311770685d6e4f Author: Steven Rostedt (VMware) Date: Fri Nov 15 14:14:45 2019 -0500 ftrace: Add helper find_direct_entry() to consolidate code Both unregister_ftrace_direct() and modify_ftrace_direct() needs to normalize the ip passed in to match the rec->ip, as it is acceptable to have the ip on the ftrace call site but not the start. There are also common validity checks with the record found by the ip, these should be done for both unregister_ftrace_direct() and modify_ftrace_direct(). Signed-off-by: Steven Rostedt (VMware) commit 406acdd32d3e7d5a6dcb7f67798e89068fbe0d77 Author: Steven Rostedt (VMware) Date: Fri Nov 15 14:19:04 2019 -0500 ftrace: Add another check for match in register_ftrace_direct() As an instruction pointer passed into register_ftrace_direct() may just exist on the ftrace call site, but may not be the start of the call site itself, register_ftrace_direct() still needs to update test if a direct call exists on the normalized site, as only one direct call is allowed at any one time. Fixes: 763e34e74bb7d ("ftrace: Add register_ftrace_direct()") Signed-off-by: Steven Rostedt (VMware) commit 1c7f9b673dc0a15753274c4e7f5ebfd4468fc69f Author: Steven Rostedt (VMware) Date: Fri Nov 15 14:13:20 2019 -0500 ftrace: Fix accounting bug with direct->count in register_ftrace_direct() The direct->count wasn't being updated properly, where it only was updated when the first entry was added, but should be updated every time. Fixes: 013bf0da04748 ("ftrace: Add ftrace_find_direct_func()") Signed-off-by: Steven Rostedt (VMware) commit db8c33f8b5bea59d00ca12dcd6b65d01b1ea98ef Author: Fenghua Yu Date: Mon Sep 16 15:39:58 2019 -0700 x86/cpu: Align the x86_capability array to size of unsigned long The x86_capability array in cpuinfo_x86 is of type u32 and thus is naturally aligned to 4 bytes. But, set_bit() and clear_bit() require the array to be aligned to size of unsigned long (i.e. 8 bytes on 64-bit systems). The array pointer is handed into atomic bit operations. If the access is not aligned to unsigned long then the atomic bit operations can end up crossing a cache line boundary, which causes the CPU to do a full bus lock as it can't lock both cache lines at once. The bus lock operation is heavy weight and can cause severe performance degradation. The upcoming #AC split lock detection mechanism will issue warnings for this kind of access. Force the alignment of the array to unsigned long. This avoids the massive code changes which would be required when converting the array data type to unsigned long. [ tglx: Rewrote changelog so it contains information WHY this is required ] Suggested-by: David Laight Suggested-by: Thomas Gleixner Signed-off-by: Fenghua Yu Signed-off-by: Tony Luck Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190916223958.27048-4-tony.luck@intel.com commit f6a892ddd53e555362dbf64d31b47fde0f550ec4 Author: Fenghua Yu Date: Mon Sep 16 15:39:56 2019 -0700 x86/cpu: Align cpu_caps_cleared and cpu_caps_set to unsigned long cpu_caps_cleared[] and cpu_caps_set[] are arrays of type u32 and therefore naturally aligned to 4 bytes, which is also unsigned long aligned on 32-bit, but not on 64-bit. The array pointer is handed into atomic bit operations. If the access not aligned to unsigned long then the atomic bit operations can end up crossing a cache line boundary, which causes the CPU to do a full bus lock as it can't lock both cache lines at once. The bus lock operation is heavy weight and can cause severe performance degradation. The upcoming #AC split lock detection mechanism will issue warnings for this kind of access. Force the alignment of these arrays to unsigned long. This avoids the massive code changes which would be required when converting the array data type to unsigned long. [ tglx: Rewrote changelog ] Signed-off-by: Fenghua Yu Signed-off-by: Tony Luck Signed-off-by: Thomas Gleixner Reviewed-by: Borislav Petkov Link: https://lkml.kernel.org/r/20190916223958.27048-2-tony.luck@intel.com commit 2fa6b1e01a9b1a54769c394f06cd72c3d12a2d48 Author: Al Viro Date: Tue Nov 12 16:13:06 2019 -0500 fs/namei.c: fix missing barriers when checking positivity Pinned negative dentries can, generally, be made positive by another thread. Conditions that prevent that are * ->d_lock on dentry in question * parent directory held at least shared * nobody else could have observed the address of dentry Most of the places working with those fall into one of those categories; however, d_lookup() and friends need to be used with some care. Fortunately, there's not a lot of call sites, and with few exceptions all of those fall under one of the cases above. Exceptions are all in fs/namei.c - in lookup_fast(), lookup_dcache() and mountpoint_last(). Another one is lookup_slow() - there dcache lookup is done with parent held shared, but the result is used after we'd drop the lock. The same happens in do_last() - the lookup (in lookup_one()) is done with parent locked, but result is used after unlocking. lookup_fast(), do_last() and mountpoint_last() flat-out reject negatives. Most of lookup_dcache() calls are made with parent locked at least shared; the only exception is lookup_one_len_unlocked(). It might return pinned negative, needs serious care from callers. Fortunately, almost nobody calls it directly anymore; all but two callers have converted to lookup_positive_unlocked(), which rejects negatives. lookup_slow() is called by the same lookup_one_len_unlocked() (see above), mountpoint_last() and walk_component(). In those two negatives are rejected. In other words, there is a small set of places where we need to check carefully if a pinned potentially negative dentry is, in fact, positive. After that check we want to be sure that both ->d_inode and type bits in ->d_flags are stable and observed. The set consists of follow_managed() (where the rejection happens for lookup_fast(), walk_component() and do_last()), last_mountpoint() and lookup_positive_unlocked(). Solution: 1) transition from negative to positive (in __d_set_inode_and_type()) stores ->d_inode, then uses smp_store_release() to set ->d_flags type bits. 2) aforementioned 3 places in fs/namei.c fetch ->d_flags with smp_load_acquire() and bugger off if it type bits say "negative". That way anyone downstream of those checks has dentry know positive pinned, with ->d_inode and type bits of ->d_flags stable and observed. I considered splitting off d_lookup_positive(), so that the checks could be done right there, under ->d_lock. However, that leads to massive duplication of rather subtle code in fs/namei.c and fs/dcache.c. It's worse than it might seem, thanks to autofs ->d_manage() getting involved ;-/ No matter what, autofs_d_manage()/autofs_d_automount() must live with the possibility of pinned negative dentry passed their way, becoming positive under them - that's the intended behaviour when lookup comes in the middle of automount in progress, so we can't keep them out of the area that has to deal with those, more's the pity... Reported-by: Ritesh Harjani Signed-off-by: Al Viro commit e84009336711d2bba885fc9cea66348ddfce3758 Author: Al Viro Date: Thu Oct 31 01:43:31 2019 -0400 fix dget_parent() fastpath race We are overoptimistic about taking the fast path there; seeing the same value in ->d_parent after having grabbed a reference to that parent does *not* mean that it has remained our parent all along. That wouldn't be a big deal (in the end it is our parent and we have grabbed the reference we are about to return), but... the situation with barriers is messed up. We might have hit the following sequence: d is a dentry of /tmp/a/b CPU1: CPU2: parent = d->d_parent (i.e. dentry of /tmp/a) rename /tmp/a/b to /tmp/b rmdir /tmp/a, making its dentry negative grab reference to parent, end up with cached parent->d_inode (NULL) mkdir /tmp/a, rename /tmp/b to /tmp/a/b recheck d->d_parent, which is back to original decide that everything's fine and return the reference we'd got. The trouble is, caller (on CPU1) will observe dget_parent() returning an apparently negative dentry. It actually is positive, but CPU1 has stale ->d_inode cached. Use d->d_seq to see if it has been moved instead of rechecking ->d_parent. NOTE: we are *NOT* going to retry on any kind of ->d_seq mismatch; we just go into the slow path in such case. We don't wait for ->d_seq to become even either - again, if we are racing with renames, we can bloody well go to slow path anyway. Signed-off-by: Al Viro commit 6c2d4798a8d16cf4f3a28c3cd4af4f1dcbbb4d04 Author: Al Viro Date: Thu Oct 31 01:21:58 2019 -0400 new helper: lookup_positive_unlocked() Most of the callers of lookup_one_len_unlocked() treat negatives are ERR_PTR(-ENOENT). Provide a helper that would do just that. Note that a pinned positive dentry remains positive - it's ->d_inode is stable, etc.; a pinned _negative_ dentry can become positive at any point as long as you are not holding its parent at least shared. So using lookup_one_len_unlocked() needs to be careful; lookup_positive_unlocked() is safer and that's what the callers end up open-coding anyway. Signed-off-by: Al Viro commit d41efb522e902364ab09c782d511c1bedc388ddd Author: Al Viro Date: Mon Nov 4 22:30:52 2019 -0500 fs/namei.c: pull positivity check into follow_managed() There are 4 callers; two proceed to check if result is positive and fail with ENOENT if it isn't; one (in handle_lookup_down()) is guaranteed to yield positive and one (in lookup_fast()) is _preceded_ by positivity check. However, follow_managed() on a negative dentry is a (fairly cheap) no-op on anything other than autofs. And negative autofs dentries are never hashed, so lookup_fast() is not going to run into one of those. Moreover, successful follow_managed() on a _positive_ dentry never yields a negative one (and we significantly rely upon that in callers of lookup_fast()). In other words, we can easily transpose the positivity check and the call of follow_managed() in lookup_fast(). And that allows to fold the positivity check *into* follow_managed(), simplifying life for the code downstream of its calls. Signed-off-by: Al Viro commit ca16d5bee59807bf04deaab0a8eccecd5061528c Author: Yang Tao Date: Wed Nov 6 22:55:35 2019 +0100 futex: Prevent robust futex exit race Robust futexes utilize the robust_list mechanism to allow the kernel to release futexes which are held when a task exits. The exit can be voluntary or caused by a signal or fault. This prevents that waiters block forever. The futex operations in user space store a pointer to the futex they are either locking or unlocking in the op_pending member of the per task robust list. After a lock operation has succeeded the futex is queued in the robust list linked list and the op_pending pointer is cleared. After an unlock operation has succeeded the futex is removed from the robust list linked list and the op_pending pointer is cleared. The robust list exit code checks for the pending operation and any futex which is queued in the linked list. It carefully checks whether the futex value is the TID of the exiting task. If so, it sets the OWNER_DIED bit and tries to wake up a potential waiter. This is race free for the lock operation but unlock has two race scenarios where waiters might not be woken up. These issues can be observed with regular robust pthread mutexes. PI aware pthread mutexes are not affected. (1) Unlocking task is killed after unlocking the futex value in user space before being able to wake a waiter. pthread_mutex_unlock() | V atomic_exchange_rel (&mutex->__data.__lock, 0) <------------------------killed lll_futex_wake () | | |(__lock = 0) |(enter kernel) | V do_exit() exit_mm() mm_release() exit_robust_list() handle_futex_death() | |(__lock = 0) |(uval = 0) | V if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr)) return 0; The sanity check which ensures that the user space futex is owned by the exiting task prevents the wakeup of waiters which in consequence block infinitely. (2) Waiting task is killed after a wakeup and before it can acquire the futex in user space. OWNER WAITER futex_wait() pthread_mutex_unlock() | | | |(__lock = 0) | | | V | futex_wake() ------------> wakeup() | |(return to userspace) |(__lock = 0) | V oldval = mutex->__data.__lock <-----------------killed atomic_compare_and_exchange_val_acq (&mutex->__data.__lock, | id | assume_other_futex_waiters, 0) | | | (enter kernel)| | V do_exit() | | V handle_futex_death() | |(__lock = 0) |(uval = 0) | V if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr)) return 0; The sanity check which ensures that the user space futex is owned by the exiting task prevents the wakeup of waiters, which seems to be correct as the exiting task does not own the futex value, but the consequence is that other waiters wont be woken up and block infinitely. In both scenarios the following conditions are true: - task->robust_list->list_op_pending != NULL - user space futex value == 0 - Regular futex (not PI) If these conditions are met then it is reasonably safe to wake up a potential waiter in order to prevent the above problems. As this might be a false positive it can cause spurious wakeups, but the waiter side has to handle other types of unrelated wakeups, e.g. signals gracefully anyway. So such a spurious wakeup will not affect the correctness of these operations. This workaround must not touch the user space futex value and cannot set the OWNER_DIED bit because the lock value is 0, i.e. uncontended. Setting OWNER_DIED in this case would result in inconsistent state and subsequently in malfunction of the owner died handling in user space. The rest of the user space state is still consistent as no other task can observe the list_op_pending entry in the exiting tasks robust list. The eventually woken up waiter will observe the uncontended lock value and take it over. [ tglx: Massaged changelog and comment. Made the return explicit and not depend on the subsequent check and added constants to hand into handle_futex_death() instead of plain numbers. Fixed a few coding style issues. ] Fixes: 0771dfefc9e5 ("[PATCH] lightweight robust futexes: core") Signed-off-by: Yang Tao Signed-off-by: Yi Wang Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/1573010582-35297-1-git-send-email-wang.yi59@zte.com.cn Link: https://lkml.kernel.org/r/20191106224555.943191378@linutronix.de commit d99724c3c36ae73ed3908f5e3f2d103a48cd9ad0 Author: Bob Peterson Date: Fri Nov 15 10:45:41 2019 -0500 gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS This patch closes a timing window in which two processes compete and overlap in the execution of do_xmote for the same glock: Process A Process B ------------------------------------ ----------------------------- 1. Grabs gl_lockref and calls do_xmote 2. Grabs gl_lockref but is blocked 3. Sets GLF_INVALIDATE_IN_PROGRESS 4. Unlocks gl_lockref 5. Calls do_xmote 6. Call glops->go_sync 7. test_and_clear_bit GLF_DIRTY 8. Call gfs2_log_flush Call glops->go_sync 9. (slow IO, so it blocks a long time) test_and_clear_bit GLF_DIRTY It's not dirty (step 7) returns 10. Tests GLF_INVALIDATE_IN_PROGRESS 11. Calls go_inval (rgrp_go_inval) 12. gfs2_rgrp_relse does brelse 13. truncate_inode_pages_range 14. Calls lm_lock UN In step 14 we've just told dlm to give the glock to another node when, in fact, process A has not finished the IO and synced all buffer_heads to disk and make sure their revokes are done. This patch fixes the problem by changing the GLF_INVALIDATE_IN_PROGRESS to use test_and_set_bit, and if the bit is already set, process B just ignores it and trusts that process A will do the do_xmote in the proper order. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 52b1cdcb7a84a4a3cec0093eaf390bf2e11e4278 Author: Bob Peterson Date: Fri Nov 15 09:42:46 2019 -0500 gfs2: Abort gfs2_freeze if io error is seen Before this patch, an io error, such as -EIO writing to the journal would cause function gfs2_freeze to go into an infinite loop, continuously retrying the freeze operation. But nothing ever clears the -EIO except unmount after withdraw, which is impossible if the freeze operation never ends (fails). Instead you get: [ 6499.767994] gfs2: fsid=dm-32.0: error freezing FS: -5 [ 6499.773058] gfs2: fsid=dm-32.0: retrying... [ 6500.791957] gfs2: fsid=dm-32.0: error freezing FS: -5 [ 6500.797015] gfs2: fsid=dm-32.0: retrying... This patch adds a check for -EIO in gfs2_freeze, and if seen, it dequeues the freeze glock, aborts the loop and returns the error. Also, there's no need to pass the freeze holder to function gfs2_lock_fs_check_clean since it's only called in one place and it's a well-known superblock pointer, so this simplifies that. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 760f8bc7c89c87bff9c01a8746e85dcc6e771ea8 Author: Colin Ian King Date: Fri Nov 15 08:59:38 2019 +0000 ftrace/selftests: Fix spelling mistake "wakeing" -> "waking" There is a spelling mistake in a trace_printk message. As well as in the selftests that search for this string. Link: http://lkml.kernel.org/r/20191115085938.38947-1-colin.king@canonical.com Link: http://lkml.kernel.org/r/20191115090356.39572-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Steven Rostedt (VMware) commit 58a74a2925a5b4125dd4f4e728490b9642534c81 Author: Artem Bityutskiy Date: Fri Nov 15 11:17:30 2019 +0200 tracing: Increase SYNTH_FIELDS_MAX for synthetic_events Increase the maximum allowed count of synthetic event fields from 16 to 32 in order to allow for larger-than-usual events. Link: http://lkml.kernel.org/r/20191115091730.9192-1-dedekind1@gmail.com Reviewed-by: Tom Zanussi Signed-off-by: Artem Bityutskiy Signed-off-by: Steven Rostedt (VMware) commit 3c0edea9b29f9be6c093f236f762202b30ac9431 Author: David Howells Date: Fri Nov 1 20:52:24 2019 +0000 pipe: Remove sync on wake_ups commit cefa80ced57a29179313da7ab3cbb26afb040b6f Author: David Howells Date: Thu Oct 31 15:59:24 2019 +0000 pipe: Increase the writer-wakeup threshold to reduce context-switch count Increase the threshold at which the reader sends a wake event to the writers in the queue such that the queue must be half empty before the wake is issued rather than the wake being issued when just a single slot available. This reduces the number of context switches in the tests significantly, without altering the amount of work achieved. With my pipe-bench program, there's a 20% reduction versus an unpatched kernel. Suggested-by: Konstantin Khlebnikov Signed-off-by: David Howells commit 8df441294dd34fb0b16b45f550f55e96db6af4dc Author: David Howells Date: Mon Oct 7 16:30:51 2019 +0100 pipe: Check for ring full inside of the spinlock in pipe_write() Make pipe_write() check to see if the ring has become full between it taking the pipe mutex, checking the ring status and then taking the spinlock. This can happen if a notification is written into the pipe as that happens without the pipe mutex. Signed-off-by: David Howells commit 7e25a73f1a52b58fc8206557e40d990cd791ad25 Author: David Howells Date: Mon Oct 7 15:10:06 2019 +0100 pipe: Remove redundant wakeup from pipe_write() Remove a redundant wakeup from pipe_write(). Signed-off-by: David Howells commit a194dfe6e6f6f7205eea850a420f2bc6a1541209 Author: David Howells Date: Fri Sep 20 16:32:19 2019 +0100 pipe: Rearrange sequence in pipe_write() to preallocate slot Rearrange the sequence in pipe_write() so that the allocation of the new buffer, the allocation of a ring slot and the attachment to the ring is done under the pipe wait spinlock and then the lock is dropped and the buffer can be filled. The data copy needs to be done with the spinlock unheld and irqs enabled, so the lock needs to be dropped first. However, the reader can't progress as we're holding pipe->mutex. We also need to drop the lock as that would impact others looking at the pipe waitqueue, such as poll(), the consumer and a future kernel message writer. We just abandon the preallocated slot if we get a copy error. Future writes may continue it and a future read will eventually recycle it. Signed-off-by: David Howells commit 8446487feba988a92e7649c60367510f0b0445a8 Author: David Howells Date: Tue Sep 24 16:07:04 2019 +0100 pipe: Conditionalise wakeup in pipe_read() Only do a wakeup in pipe_read() if we made space in a completely full buffer. The producer shouldn't be waiting on pipe->wait otherwise. Signed-off-by: David Howells commit b667b867344301e24f21d4a4c844675ff61d89e1 Author: David Howells Date: Tue Sep 24 16:09:04 2019 +0100 pipe: Advance tail pointer inside of wait spinlock in pipe_read() Advance the pipe ring tail pointer inside of wait spinlock in pipe_read() so that the pipe can be written into with kernel notifications from contexts where pipe->mutex cannot be taken. Signed-off-by: David Howells commit 6718b6f855a0b4962d54bd625be2718cb820cec6 Author: David Howells Date: Wed Oct 16 16:47:32 2019 +0100 pipe: Allow pipes to have kernel-reserved slots Split pipe->ring_size into two numbers: (1) pipe->ring_size - indicates the hard size of the pipe ring. (2) pipe->max_usage - indicates the maximum number of pipe ring slots that userspace orchestrated events can fill. This allows for a pipe that is both writable by the general kernel notification facility and by userspace, allowing plenty of ring space for notifications to be added whilst preventing userspace from being able to pin too much unswappable kernel space. Signed-off-by: David Howells commit fd70466d37bf3fe0118d18c56ddde85b428f86cf Author: Kai-Heng Feng Date: Thu Nov 7 22:28:11 2019 +0800 HID: i2c-hid: Reset ALPS touchpads on resume Commit 52cf93e63ee6 ("HID: i2c-hid: Don't reset device upon system resume") fixes many touchpads and touchscreens, however ALPS touchpads start to trigger IRQ storm after system resume. Since it's total silence from ALPS, let's bring the old behavior back to ALPS touchpads. Fixes: 52cf93e63ee6 ("HID: i2c-hid: Don't reset device upon system resume") Signed-off-by: Kai-Heng Feng Signed-off-by: Jiri Kosina commit 0c8432236dea20a95f68fa17989ea3f8af0186a5 Author: Aaron Ma Date: Thu Nov 14 03:12:47 2019 +0800 HID: i2c-hid: fix no irq after reset on raydium 3118 On some ThinkPad L390 some raydium 3118 touchscreen devices doesn't response any data after reset, but some does. Add this ID to no irq quirk, then don't wait for any response alike on these touchscreens. All kinds of raydium 3118 devices work fine. BugLink: https://bugs.launchpad.net/bugs/1849721 Signed-off-by: Aaron Ma Signed-off-by: Jiri Kosina commit 3c845acd0237caef617f330a0e3b37ad8ae9fea5 Author: Jan Kara Date: Fri Nov 15 11:22:10 2019 +0100 jbd2: make jbd2_handle_buffer_credits() handle reserved handles The helper jbd2_handle_buffer_credits() doesn't correctly handle reserved handles which can lead to crashes. Fix it getting of journal pointer to work for reserved handles as well. Fixes: a9a8344ee171 ("ext4, jbd2: Provide accessor function for handle credits") Reported-by: Eric Biggers Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20191115102210.29445-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit 942437c97fd9ff23a17c13118f50bd0490f6868c Author: Arnd Bergmann Date: Mon Jul 15 11:46:10 2019 +0200 y2038: allow disabling time32 system calls At the moment, the compilation of the old time32 system calls depends purely on the architecture. As systems with new libc based on 64-bit time_t are getting deployed, even architectures that previously supported these (notably x86-32 and arm32 but also many others) no longer depend on them, and removing them from a kernel image results in a smaller kernel binary, the same way we can leave out many other optional system calls. More importantly, on an embedded system that needs to keep working beyond year 2038, any user space program calling these system calls is likely a bug, so removing them from the kernel image does provide an extra debugging help for finding broken applications. I've gone back and forth on hiding this option unless CONFIG_EXPERT is set. This version leaves it visible based on the logic that eventually it will be turned off indefinitely. Acked-by: Christian Brauner Signed-off-by: Arnd Bergmann commit bd40a175769d411b2a37e1c087082ac7ee2c15bb Author: Arnd Bergmann Date: Thu Nov 7 15:27:39 2019 +0100 y2038: itimer: change implementation to timespec64 There is no 64-bit version of getitimer/setitimer since that is not actually needed. However, the implementation is built around the deprecated 'struct timeval' type. Change the code to use timespec64 internally to reduce the dependencies on timeval and associated helper functions. Minor adjustments in the code are needed to make the native and compat version work the same way, and to keep the range check working after the conversion. Signed-off-by: Arnd Bergmann commit ddbc7d0657e9fd38b69f16bd0310703367b52d29 Author: Arnd Bergmann Date: Fri Oct 25 21:37:43 2019 +0200 y2038: move itimer reset into itimer.c Preparing for a change to the itimer internals, stop using the do_setitimer() symbol and instead use a new higher-level interface. The do_getitimer()/do_setitimer functions can now be made static, allowing the compiler to potentially produce better object code. Reviewed-by: Thomas Gleixner Signed-off-by: Arnd Bergmann commit 4c22ea2b91203564fdf392b3d3cae249b652a8ae Author: Arnd Bergmann Date: Fri Oct 25 16:59:39 2019 +0200 y2038: use compat_{get,set}_itimer on alpha The itimer handling for the old alpha osf_setitimer/osf_getitimer system calls is identical to the compat version of getitimer/setitimer, so just use those directly. Signed-off-by: Arnd Bergmann commit c1745f84be2657f5702388133551b759b9237f59 Author: Arnd Bergmann Date: Fri Oct 25 10:46:22 2019 +0200 y2038: itimer: compat handling to itimer.c The structure is only used in one place, moving it there simplifies the interface and helps with later changes to this code. Rename it to match the other time32 structures in the process. Reviewed-by: Thomas Gleixner Signed-off-by: Arnd Bergmann commit 5e0fb1b57bea8d11fe77da2bc80f4c9a67e28318 Author: Arnd Bergmann Date: Wed Aug 15 20:04:11 2018 +0200 y2038: time: avoid timespec usage in settimeofday() The compat_get_timeval() and timeval_valid() interfaces are deprecated and getting removed along with the definition of struct timeval itself. Change the two implementations of the settimeofday() system call to open-code these helpers and completely avoid references to timeval. The timeval_valid() call is not needed any more here, only a check to avoid overflowing tv_nsec during the multiplication, as there is another range check in do_sys_settimeofday64(). Tested-by: syzbot+dccce9b26ba09ca49966@syzkaller.appspotmail.com Signed-off-by: Arnd Bergmann commit bde9e963af2d0a9762781c4dccaef21696d5bb94 Author: Arnd Bergmann Date: Fri Apr 20 22:03:38 2018 +0200 y2038: timerfd: Use timespec64 internally timerfd_show() uses a 'struct itimerspec' internally, but that is deprecated because of the time_t overflow and a conflict with the glibc type of the same name that is now incompatible in user space. Use a pair of timespec64 variables instead as a simple replacement. As this removes the last use of itimerspec from the kernel, allowing the removal of the definition from the uapi headers along with timespec and timeval later. Reviewed-by: Thomas Gleixner Signed-off-by: Arnd Bergmann commit e2bb80d55d75ce7fd300fcd8d47a97413c3cd322 Author: Arnd Bergmann Date: Thu Nov 23 13:46:33 2017 +0100 y2038: elfcore: Use __kernel_old_timeval for process times We store elapsed time for a crashed process in struct elf_prstatus using 'timeval' structures. Once glibc starts using 64-bit time_t, this becomes incompatible with the kernel's idea of timeval since the structure layout no longer matches on 32-bit architectures. This changes the definition of the elf_prstatus structure to use __kernel_old_timeval instead, which is hardcoded to the currently used binary layout. There is no risk of overflow in y2038 though, because the time values are all relative times, and can store up to 68 years of process elapsed time. There is a risk of applications breaking at build time when they use the new kernel headers and expect the type to be exactly 'timeval' rather than a structure that has the same fields as before. Those applications have to be modified to deal with 64-bit time_t anyway. Signed-off-by: Arnd Bergmann commit 693737b6cc2edc258040b28462a90b63503394d9 Author: Arnd Bergmann Date: Thu Nov 23 14:22:06 2017 +0100 y2038: make ns_to_compat_timeval use __kernel_old_timeval This gets us one step closer to removing 'struct timeval' from the kernel. We still keep __kernel_old_timeval for interfaces that we cannot fix otherwise, and ns_to_compat_timeval() is provably safe for interfaces that are legitimate users of __kernel_old_timeval on native kernels, so this is an obvious change. Signed-off-by: Arnd Bergmann commit df1b4ba9d4a8454285c53c2ec7224228105bc5c8 Author: Arnd Bergmann Date: Fri Oct 25 22:04:46 2019 +0200 y2038: socket: use __kernel_old_timespec instead of timespec The 'timespec' type definition and helpers like ktime_to_timespec() or timespec64_to_timespec() should no longer be used in the kernel so we can remove them and avoid introducing y2038 issues in new code. Change the socket code that needs to pass a timespec to user space for backward compatibility to use __kernel_old_timespec instead. This type has the same layout but with a clearer defined name. Slightly reformat tcp_recv_timestamp() for consistency after the removal of timespec64_to_timespec(). Acked-by: Deepa Dinamani Signed-off-by: Arnd Bergmann commit 0309f98f2fdc3526317e9bac150ca690f1f94ce6 Author: Arnd Bergmann Date: Sun Oct 27 18:09:32 2019 +0100 y2038: socket: remove timespec reference in timestamping In order to remove the 'struct timespec' definition and the timespec64_to_timespec() helper function, change over the in-kernel definition of 'struct scm_timestamping' to use the __kernel_old_timespec replacement and open-code the assignment. Acked-by: Deepa Dinamani Signed-off-by: Arnd Bergmann commit 75d319c06e6a76f67549c0ae1007dc3167804f4e Author: Arnd Bergmann Date: Fri Oct 25 22:56:17 2019 +0200 y2038: syscalls: change remaining timeval to __kernel_old_timeval All of the remaining syscalls that pass a timeval (gettimeofday, utime, futimesat) can trivially be changed to pass a __kernel_old_timeval instead, which has a compatible layout, but avoids ambiguity with the timeval type in user space. Acked-by: Christian Brauner Acked-by: Rafael J. Wysocki Signed-off-by: Arnd Bergmann commit bdd565f817a74b9e30edec108f7cb1dbc762b8a6 Author: Arnd Bergmann Date: Fri Oct 25 22:46:48 2019 +0200 y2038: rusage: use __kernel_old_timeval There are two 'struct timeval' fields in 'struct rusage'. Unfortunately the definition of timeval is now ambiguous when used in user space with a libc that has a 64-bit time_t, and this also changes the 'rusage' definition in user space in a way that is incompatible with the system call interface. While there is no good solution to avoid all ambiguity here, change the definition in the kernel headers to be compatible with the kernel ABI, using __kernel_old_timeval as an unambiguous base type. In previous discussions, there was also a plan to add a replacement for rusage based on 64-bit timestamps and nanosecond resolution, i.e. 'struct __kernel_timespec'. I have patches for that as well, if anyone thinks we should do that. Reviewed-by: Cyrill Gorcunov Signed-off-by: Arnd Bergmann commit 2a785996cc5e2fc1d1d29d196f530905f68d2dc2 Author: Arnd Bergmann Date: Tue Nov 5 11:10:01 2019 +0100 y2038: uapi: change __kernel_time_t to __kernel_old_time_t This is mainly a patch for clarification, and to let us remove the time_t definition from the kernel to prevent new users from creeping in that might not be y2038-safe. All remaining uses of 'time_t' or '__kernel_time_t' are part of the user API that cannot be changed by that either have a replacement or that do not suffer from the y2038 overflow. Acked-by: Deepa Dinamani Acked-by: Christian Brauner Signed-off-by: Arnd Bergmann commit 1bf883c1a9cf88a60234039356aac8f23479dce9 Author: Arnd Bergmann Date: Tue Nov 5 09:22:38 2019 +0100 y2038: stat: avoid 'time_t' in 'struct stat' The time_t definition may differ between user space and kernel space, so replace time_t with an unambiguous 'long' for the mips and sparc. The same structures also contain 'off_t', which has the same problem, so replace that as well on those two architectures and powerpc. Signed-off-by: Arnd Bergmann commit caf5e32d4ea7253820f38dd7c429f8d4a8019c5f Author: Arnd Bergmann Date: Mon Nov 4 21:17:26 2019 +0100 y2038: ipc: remove __kernel_time_t reference from headers There are two structures based on time_t that conflict between libc and kernel: timeval and timespec. Both are now renamed to __kernel_old_timeval and __kernel_old_timespec. For time_t, the old typedef is still __kernel_time_t. There is nothing wrong with that name, but it would be nice to not use that going forward as this type is used almost only in deprecated interfaces because of the y2038 overflow. In the IPC headers (msgbuf.h, sembuf.h, shmbuf.h), __kernel_time_t is only used for the 64-bit variants, which are not deprecated. Change these to a plain 'long', which is the same type as __kernel_time_t on all 64-bit architectures anyway, to reduce the number of users of the old type. Signed-off-by: Arnd Bergmann commit 176ed98c8a76ee08babf99b25b00992c2a5e7bbc Author: Arnd Bergmann Date: Sun Oct 27 17:26:55 2019 +0100 y2038: vdso: powerpc: avoid timespec references As a preparation to stop using 'struct timespec' in the kernel, change the powerpc vdso implementation: - split up the vdso data definition to have equivalent members for seconds and nanoseconds instead of an xtime structure - use timespec64 as an intermediate for the xtime update - change the asm-offsets definition to be based the appropriate fixed-length types This is only a temporary fix for changing the types, in order to actually support a 64-bit safe vdso32 version of clock_gettime(), the entire powerpc vdso should be replaced with the generic lib/vdso/ implementation. If that happens first, this patch becomes obsolete. Signed-off-by: Arnd Bergmann commit e6071b182df0622636b9cd97a80038a495ccb06f Author: Arnd Bergmann Date: Thu Oct 24 23:35:28 2019 +0200 y2038: vdso: nds32: open-code timespec_add_ns() The nds32 vdso is now the last user of the deprecated timespec_add_ns(). Change it to an open-coded version like the one it already uses in do_realtime(). What we should really do though is to use the generic vdso implementation that is now used in x86. arm and mips. Signed-off-by: Arnd Bergmann commit 21346564ccad17b928cf0d51584608531d91d298 Author: Arnd Bergmann Date: Tue Nov 5 11:10:01 2019 +0100 y2038: vdso: change time_t to __kernel_old_time_t Only x86 uses the 'time' syscall in vdso, so change that to __kernel_old_time_t as a preparation for removing 'time_t' and '__kernel_time_t' later. Reviewed-by: Thomas Gleixner Signed-off-by: Arnd Bergmann commit 82210fc778982d9386e266fa5f0b52cde5c2f0cf Author: Arnd Bergmann Date: Sun Oct 27 19:26:41 2019 +0100 y2038: vdso: change timespec to __kernel_old_timespec In order to remove 'timespec' completely from the kernel, all internal uses should be converted to a y2038-safe type, while those that are only for compatibity with existing user space should be marked appropriately. Change vdso to use __kernel_old_timespec in order to avoid the deprecated type and mark these interfaces as outdated. Signed-off-by: Arnd Bergmann commit ddccf40fe82b7ac7c44b186ec4b6d1d1bbc2cbff Author: Arnd Bergmann Date: Thu Nov 23 14:29:37 2017 +0100 y2038: vdso: change timeval to __kernel_old_timeval The gettimeofday() function in vdso uses the traditional 'timeval' structure layout, which will be incompatible with future versions of glibc on 32-bit architectures that use a 64-bit time_t. This interface is problematic for y2038, when time_t overflows on 32-bit architectures, but the plan so far is that a libc with 64-bit time_t will not call into the gettimeofday() vdso helper at all, and only have a method for entering clock_gettime(). This means we don't have to fix it here, though we probably want to add a new clock_gettime() entry point using a 64-bit version of 'struct timespec' at some point. Changing the vdso code to use __kernel_old_timeval helps isolate this usage from the other ones that still need to be fixed properly, and it gets us closer to removing the 'timeval' definition from the kernel sources. Reviewed-by: Thomas Gleixner Signed-off-by: Arnd Bergmann commit 94c467ddb273dc9a6a4fb09aef392c119b151edb Author: Arnd Bergmann Date: Fri Oct 25 22:03:06 2019 +0200 y2038: add __kernel_old_timespec and __kernel_old_time_t The 'struct timespec' definition can no longer be part of the uapi headers because it conflicts with a a now incompatible libc definition. Also, we really want to remove it in order to prevent new uses from creeping in. The same namespace conflict exists with time_t, which should also be removed. __kernel_time_t could be used safely, but adding 'old' in the name makes it clearer that this should not be used for new interfaces. Add a replacement __kernel_old_timespec structure and __kernel_old_time_t along the lines of __kernel_old_timeval. Acked-by: Deepa Dinamani Signed-off-by: Arnd Bergmann commit 3ca47e958a64b1116a2c35e65dcf467fc53d52de Author: Arnd Bergmann Date: Tue Apr 23 17:43:50 2019 +0200 y2038: remove CONFIG_64BIT_TIME The CONFIG_64BIT_TIME option is defined on all architectures, and can be removed for simplicity now. Signed-off-by: Arnd Bergmann commit d6a62a4b5f3f7cb88d05f13ad0da0cbc2c322272 Author: Chunyan Zhang Date: Mon Nov 11 17:02:29 2019 +0800 dt-bindings: serial: Add a new compatible string for SC9863A SC9863A use the same serial device which SC9836 uses. Signed-off-by: Chunyan Zhang Signed-off-by: Rob Herring commit 12e72714cfffcc69f299cc7e716ade45a18ea796 Author: Chunyan Zhang Date: Mon Nov 11 17:02:27 2019 +0800 dt-bindings: serial: Convert sprd-uart to json-schema Convert the sprd-uart binding to DT schema using json-schema. Signed-off-by: Chunyan Zhang [robh: dual license GPL/BSD] Signed-off-by: Rob Herring commit ee906c6b9c6e7e4ad749f5cfdf65768455f4bf43 Author: Kai Vehmanen Date: Fri Nov 15 14:44:49 2019 +0200 ALSA: hda - remove forced polling workaround for CFL and CNL Remove the workarounds added in commit fa763f1b2858 ("ALSA: hda - Force polling mode on CNL for fixing codec communication") and commit a8d7bde23e71 ("ALSA: hda - Force polling mode on CFL for fixing codec communication"). The workarounds are no longer needed after the more generic change done in commit 2756d9143aa5 ("ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips"). This change applies to a larger set of hardware and covers CFL and CNL as well. Similar change was already done to SOF DSP HDA driver with no regressions detected. Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20191115124449.20512-4-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit c8e3eb9be57f91751aeb9397118755390dbff9a4 Author: Kai Vehmanen Date: Fri Nov 15 14:44:48 2019 +0200 ALSA: hda: hdmi - remove redundant code comments Remove unnecessary comments related to pin mapping on Intel platforms. Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20191115124449.20512-3-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit d577cf76fa3192f9e656bb101aa54d25a6a71347 Author: Kai Vehmanen Date: Fri Nov 15 14:44:47 2019 +0200 ALSA: hda: hdmi - fix port numbering for ICL and TGL platforms Semantics of port#0 differ between ICL and TGL: ICL port#0 -> never used for HDAudio ICL port#1 -> should be mapped to first pin (0x04) TGL port#0 -> typically not used, but HW has the support, so should be mapped to first pin (0x04) TGL port#1 -> should be mapped to 2nd pin (0x06) Refactor the port mapping logic to allow to take the above differences into account. Fixes issues with HDAudio on some TGL platforms. Co-developed-by: Pan Xiuli Signed-off-by: Pan Xiuli Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20191115124449.20512-2-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit 5ba03f8f681a8c894514c55cf7a9027ef897590e Author: Li Yang Date: Fri Nov 8 16:40:56 2019 -0600 rtc: fsl-ftm-alarm: remove select FSL_RCPM and default y from Kconfig The Flextimer alarm is primarily used as a wakeup source for system power management. But it shouldn't select the power management driver as they don't really have dependency of each other. Also remove the default y as it is not a critical feature for the systems. Signed-off-by: Li Yang Link: https://lore.kernel.org/r/1573252856-11759-1-git-send-email-leoyang.li@nxp.com Signed-off-by: Alexandre Belloni commit 3f86a7e090d1dfb974a9dc9d44049f9bff01e6a5 Author: Hans de Goede Date: Thu Nov 14 11:25:59 2019 +0100 gpiolib: acpi: Print pin number on acpi_gpiochip_alloc_event errors Print pin number and error-code on acpi_gpiochip_alloc_event errors, to help debugging these. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20191114102600.34558-1-hdegoede@redhat.com Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 4f5969c36a4572dbaf8737dd9f486382d4e44b4a Author: YueHaibing Date: Mon Nov 11 03:34:27 2019 +0000 rtw88: remove duplicated include from ps.c Remove duplicated include. Signed-off-by: YueHaibing Reviewed-by: Simon Horman Signed-off-by: Kalle Valo commit 38860bdf28b7b01e744834b7b1277812ad82786d Author: Zheng Yongjun Date: Sun Nov 10 18:49:55 2019 +0800 rtl8xxxu: Remove set but not used variable 'rsr' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c: In function rtl8xxxu_gen2_config_channel: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:1266:13: warning: variable rsr set but not used [-Wunused-but-set-variable] rsr is never used, so remove it. Reported-by: Hulk Robot Signed-off-by: Zheng Yongjun Reviewed-by: Chris Chiu Signed-off-by: Kalle Valo commit 92fe0f81b64b1983f21e096a5b5b2bcb60294ca7 Author: Eduardo Abinader Date: Thu Nov 7 17:07:46 2019 +0100 brcmsmac: remove unnecessary return Signed-off-by: Eduardo Abinader Signed-off-by: Kalle Valo commit 61005d65b6c7dcf61c19516e6ebe5acc02d2cdda Author: Hans de Goede Date: Thu Nov 14 15:30:46 2019 +0100 HID: logitech-hidpp: Silence intermittent get_battery_capacity errors My Logitech M185 (PID:4038) 2.4 GHz wireless HID++ mouse is causing intermittent errors like these in the log: [11091.034857] logitech-hidpp-device 0003:046D:4038.0006: hidpp20_batterylevel_get_battery_capacity: received protocol error 0x09 [12388.031260] logitech-hidpp-device 0003:046D:4038.0006: hidpp20_batterylevel_get_battery_capacity: received protocol error 0x09 [16613.718543] logitech-hidpp-device 0003:046D:4038.0006: hidpp20_batterylevel_get_battery_capacity: received protocol error 0x09 [23529.938728] logitech-hidpp-device 0003:046D:4038.0006: hidpp20_batterylevel_get_battery_capacity: received protocol error 0x09 We are already silencing error-code 0x09 (HIDPP_ERROR_RESOURCE_ERROR) errors in other places, lets do the same in hidpp20_batterylevel_get_battery_capacity to remove these harmless, but scary looking errors from the dmesg output. Signed-off-by: Hans de Goede Signed-off-by: Jiri Kosina commit 4f6585815084dc42089449ff32849b8069ea2604 Author: You-Sheng Yang Date: Fri Nov 15 13:36:46 2019 +0800 HID: i2c-hid: remove orphaned member sleep_delay This was introduced in commit 00b790ea545b ("HID: i2c-hid: Add a small delay after sleep command for Raydium touchpanel") which has been effectively reverted by commit 67b18dfb8cfc ("HID: i2c-hid: Remove runtime power management"). Signed-off-by: You-Sheng Yang Signed-off-by: Jiri Kosina commit 04358e40ba96d687c0811c21d9dede73f5244a98 Author: Chuhong Yuan Date: Fri Nov 15 16:31:22 2019 +0800 spi: tegra20-slink: add missed clk_unprepare The driver misses calling clk_unprepare in probe failure and remove. Add the calls to fix it. Signed-off-by: Chuhong Yuan Link: https://lore.kernel.org/r/20191115083122.12278-1-hslester96@gmail.com Signed-off-by: Mark Brown commit 912a7df474d2cb22fc99a1fcf77997f2cea7d85e Author: Peter Ujfalusi Date: Wed Nov 13 11:42:56 2019 +0200 spi: tegra20-slink: Use dma_request_chan() directly for channel request dma_request_slave_channel_reason() is: #define dma_request_slave_channel_reason(dev, name) \ dma_request_chan(dev, name) Signed-off-by: Peter Ujfalusi Acked-by: Jon Hunter Link: https://lore.kernel.org/r/20191113094256.1108-10-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit 4c973b98cdd3b413216fdb9655a420737c46a4cb Author: Peter Ujfalusi Date: Wed Nov 13 11:42:55 2019 +0200 spi: tegra114: Use dma_request_chan() directly for channel request dma_request_slave_channel_reason() is: #define dma_request_slave_channel_reason(dev, name) \ dma_request_chan(dev, name) Signed-off-by: Peter Ujfalusi Acked-by: Jon Hunter Link: https://lore.kernel.org/r/20191113094256.1108-9-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit df1b0141788527c032a9851c0589a1712d7e46b8 Author: Peter Ujfalusi Date: Wed Nov 13 11:42:54 2019 +0200 spi: s3c64xx: Use dma_request_chan() directly for channel request dma_request_slave_channel_reason() is: #define dma_request_slave_channel_reason(dev, name) \ dma_request_chan(dev, name) Signed-off-by: Peter Ujfalusi Acked-by: Krzysztof Kozlowski Acked-by: Andi Shyti Link: https://lore.kernel.org/r/20191113094256.1108-8-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit 194e1d4bc262c2d23ba9a8a5c03855c372ea1b5c Author: Peter Ujfalusi Date: Wed Nov 13 11:42:53 2019 +0200 spi: qup: Use dma_request_chan() directly for channel request dma_request_slave_channel_reason() is: #define dma_request_slave_channel_reason(dev, name) \ dma_request_chan(dev, name) Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20191113094256.1108-7-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit c1008957ff1aee0ac92c28c55947173fb68cd451 Author: Peter Ujfalusi Date: Wed Nov 13 11:42:52 2019 +0200 spi: pl022: Use dma_request_chan() directly for channel request dma_request_slave_channel_reason() is: #define dma_request_slave_channel_reason(dev, name) \ dma_request_chan(dev, name) Signed-off-by: Peter Ujfalusi Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20191113094256.1108-6-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit 5d3aa9ccf40cdc9b94d1a708d11de9062e2d9eed Author: Peter Ujfalusi Date: Wed Nov 13 11:42:51 2019 +0200 spi: imx: Use dma_request_chan() directly for channel request dma_request_slave_channel_reason() is: #define dma_request_slave_channel_reason(dev, name) \ dma_request_ch